Your email account was hacked: what to do first

Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.

What to do if your email account is hacked: the first hour

Start with what you can see. Mail you never sent sits in the Sent folder. Messages vanish from the inbox and are not in Trash. Your password stops working overnight. Any one of these can mean someone else is inside your account. The first hour matters most. An intruder will often change the recovery address quickly, so reset emails go to them instead of you.

Do not reply to the strange mail, and do not click any link inside it. The intruder may have left links that steal a fresh password. Tell the people who got the odd messages that your account was hacked, so they ignore anything else from it. Ask them not to open attachments or click links in that mail. Run your provider's security check after you change the password. It lists recent sign-ins and devices. Remove anything you do not recognise.

Money is the other urgent check. Look at your bank and card statements for purchases you did not make. Email is often the key to shopping and payment accounts, so an intruder may try those next. If you find a charge you do not recognise, call your bank and say the account may be compromised. Many banks can freeze a card quickly if you call: check your bank's app or hotline.

1. Try to sign in. If your password still works, change it at once to something long and new.
2. Sign out every other session. In your Google Account page, open Your devices, then Manage devices, and pick any device you do not recognise.
3. Warn the people who received strange mail from you, and check your bank statements for purchases you did not make.

How to tell what the intruder changed

Changing the password locks the front door, but the intruder may have left other doors open. The most common trick is a forwarding rule. Every new message is copied to an address the intruder controls, so they keep reading your mail after you change the password. Filters can do the same job quietly: mail from your bank is marked as read and moved to a folder you never open. In Gmail, look under Settings, then See all settings, then Forwarding and POP/IMAP.

Next, look at the recovery details. An intruder who changes the recovery email or phone number can reset your password again whenever they like. Open your account settings and read the recovery email and phone number carefully. If either one is unfamiliar, replace it with your own. Check the account name and the reply-to address too. Some intruders change the name, so their mail looks like it comes from you.

Check what else the account touches. Look at the list of apps and sites signed in with your email address, and remove any you do not recognise. In Google, that list sits under your account's Security page, in the section for third-party access. Also look for payment methods saved in the account. Check Google Pay for purchases and cards you do not recognise.

Locked out? How recovery works at Google, Microsoft and Apple

Being locked out feels final, but it usually is not. Every large provider has a recovery page, and it works by asking questions only the real owner can answer. Use a device and a network you have signed in from before, because the provider trusts those more. A home computer beats a library computer. Answer every question as best you can, even if you have to guess at a date. A wrong guess costs nothing. Other providers, such as Yahoo and Proton, run their own recovery pages on the same idea.

Google's recovery page asks for the last password you remember, and may send a code to your recovery phone or email. If the password and the recovery details were both changed, the page still lets you try, using older passwords and account details as proof. Google checks the answers automatically. There is no person to call for a free Gmail account, so the form is the only route.

Microsoft works the same way, with its own recovery form. Fill it in from a computer you have used before, and give a contact email address that works right now. Microsoft aims to reply within about 24 hours, and limits apply on how often you can submit the form. Make each one count and add every detail you can. Apple users start at Apple's account recovery page, and a trusted device or phone number speeds things up.

Lock the account down so it cannot happen again

Once you are back in, make the account harder to break into. Turn on two-factor authentication, which Google calls 2-Step Verification. It asks for a code from your phone as well as your password. A stolen password alone is then useless. The code can come from an authenticator app, a text message, or a security key. An app or a key is stronger than a text message, because a number can be hijacked through SIM swapping. Pick the method you will actually use. If your provider offers passkeys, set one up: it replaces the password entirely.

Next, give the account a password nobody can guess and you have never used anywhere else. Long beats clever. Four random words with a number are easier to remember than a short jumble of symbols, and far harder to crack. Do not reuse the old password, and do not reuse this one on other sites. If remembering many passwords is the problem, a password manager solves it. It makes a different password for every site and fills it in for you.

Finish with the recovery details and a clean-up. Make sure the recovery email and phone number are yours, and add a second recovery option if the provider allows it. Then sign out of every session and device you do not recognise, and remove apps that have access to the account. Run your provider's security check if one is offered. It walks through the same checks in one place. If the password was stolen on your own computer, run an antivirus scan on it too. A fresh password typed into an infected device can be stolen again.

The other accounts tied to your email need attention too

Your email address is the spare key for most of your online life. Shopping sites, banks, social media and work tools all send their password resets to it. An intruder who held your inbox for even an hour may have reset passwords elsewhere. Start with the accounts that hold money: your bank, your card provider and any shopping account with a saved card. Change those passwords first, and check their recent activity.

Any site where you signed in with your email address deserves a look. That includes sites that use Sign in with Google or Sign in with Apple. Open the list of connected apps in your account settings and remove anything you do not recognise. If a site used the same password as your email, change that password too, and make it different this time. A password used in two places is a password that fails in two places.

If money or identity documents were involved, take it further. Tell your bank what happened, and ask what they can watch for. In the United States, the Federal Trade Commission runs a site for reporting identity theft and building a recovery plan. Reporting there creates a record you can show to a bank or a creditor. Keep every email about the break-in. Dates matter if a charge is disputed later.

Myths you can ignore about hacked email

The first myth is that changing the password fixes everything. It does not. A forwarding rule, a changed recovery address or a connected app can keep the intruder inside after the password changes. The password is step one, not the whole job. Check the settings, the devices and the connected apps before you call it done. The second myth is that only famous or rich people get hacked. Most break-ins are automatic.

The third myth is that a company can recover your account for a fee. It cannot, and anyone offering to do it is running a scam. Google does not charge for account recovery and does not take calls about free Gmail accounts. Microsoft's recovery form is free too. If a website or a person asks for money, gift cards or remote access to your computer to fix a hacked account, walk away. The fourth myth is that deleting the account solves the problem. It will not.

The last myth is that a strong password alone keeps you safe. It helps, but it is not enough. Passwords leak in breaches, and people reuse them. Keep the recovery details current, and check the account every few months. A hacked email account is a bad day, but it does not have to become a bad month. Work through the steps in order, and the account is yours again.

Quick answers

How do I know if my email was hacked or just glitching?

A glitch rarely sends mail from your account or changes your settings. Check the Sent folder for mail you did not write, and look at the forwarding rules and recovery details. If mail you never sent exists, or the recovery email is unfamiliar, the account was hacked.

Can I recover a hacked Gmail account if the recovery email was changed?

Yes, you can still try. Google's recovery page lets you answer with older passwords and account details, and it weighs everything you can prove. There is no phone support for free Gmail accounts, so the recovery page is the only route.

How long does Microsoft account recovery take?

Microsoft aims to reply to a recovery form within about 24 hours. Limits apply to how often you can submit the form, so add as much detail as you can to each one. Use a contact email that works, and fill the form in from a computer you have used with the account before.

Should I delete a hacked email account?

No, not first. Deleting the account does not undo password resets the intruder may have made elsewhere, and you lose the mail that shows what happened. Recover the account and lock it down first, then decide whether to keep it.

Does changing my password stop the hacker?

Not by itself. A new password helps, but only after you undo what the intruder changed. Work through the recovery checks in order before you call it done.