Hacked email? 6 recovery steps to regain access and stop resets

Some links in this guide are affiliate links: if you buy, TechForLive may earn a commission at no extra cost to you. Details.

What to do if your email account is hacked: the first hour

Act as soon as you can, but do not abandon the process if an hour has passed. Attackers often change recovery details, create forwarding rules and contact your address book.

Use a device the attacker has not accessed. A phone on mobile data can work if your computer seems infected. If you cannot act safely now, disconnect the suspect device, write down the time, and use a known-clean device as soon as possible.

Your email can reset banking, shopping and social accounts. Secure it before changing passwords elsewhere. If this is a work or school account, contact IT immediately. Enterprise accounts use different controls and recovery rules.

Keep a record while you work. Save alerts, strange messages, times, sender addresses and screenshots. Do not delete evidence until you have reported the incident and checked for financial loss.

1. Use a known-clean phone or computer, preferably on a trusted network or mobile data
2. Open the provider's official site and sign in, if access still works
3. Change the password to a long, unique password
4. Check the recovery email and phone number, then restore any changed detail
5. Record alerts, unfamiliar messages and account changes with dates and times

Check the device before entering a new password

Use a different device you know is clean if the laptop shows pop-ups, new extensions, unknown antivirus alerts or strange keyboard behaviour. A borrowed device from someone you trust is safer than the suspect computer.

On Windows, run Microsoft Defender Offline from Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan. Microsoft also lists the process at support.microsoft.com/windows/microsoft-defender-offline.

If you must use the computer, disconnect it from the internet and boot into Safe Mode before scanning. A rescue USB made on a clean computer can scan the drive without starting the installed operating system. Follow the instructions from your antivirus maker.

Look for unfamiliar browser extensions, remote-access software, new startup items and unknown user accounts. Remove nothing important before saving evidence, but uninstall tools you did not install after recording their names.

• Safer option: use a known-clean phone or computer
• Windows scan: Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan
• Suspected keylogger: stop typing passwords on that device until it has been scanned
• Severe infection: use a rescue USB or have a reputable repair shop examine it

Reset the password and restore recovery details

Use a passphrase of four or five unrelated words, or let your password manager create at least 16 random characters. Do not reuse an old password or make a small change to it.

Open the account security page and read the recovery email and phone number carefully. Restore your recovery address now if an attacker replaced it. Use an address you control, preferably with a different provider.

Check security questions if the provider still uses them. Replace answers attackers could guess from social media with unique answers stored in your password manager.

Some providers notify the old and new addresses when security settings change. Save those notices. They show what changed and when.

• Password: four or more random words, or a manager-generated string of 16 or more characters
• Recovery email: one you own and can access
• Recovery phone: your current number, if you use one
• Security questions: answers no one can infer from public information

Remove forwarding rules, mail rules and app passwords

Check forwarding and mail rules after changing the password. These settings can copy new messages, hide security alerts or move reset emails into an obscure folder.

In Gmail, open Settings > See all settings > Forwarding and POP/IMAP. Remove forwarding addresses you did not add. Then check Filters and Blocked Addresses for filters that delete or move messages.

In Outlook on the web, open Settings > Mail > Forwarding and turn off unknown forwarding. Open Settings > Mail > Rules and remove rules you did not create.

App passwords can keep older apps signed in without your main password. In Google, open myaccount.google.com/security, choose 2-Step Verification, then App passwords. In Microsoft, open account.microsoft.com/security and choose Advanced security options. Delete unknown app passwords.

Review connected apps and websites on the same security page. Revoke access for anything unfamiliar, including email clients or cloud services.

1. Gmail: Settings > See all settings > Forwarding and POP/IMAP, then Filters and Blocked Addresses
2. Outlook: Settings > Mail > Forwarding, then Mail > Rules
3. Google app passwords: myaccount.google.com/security > 2-Step Verification > App passwords
4. Microsoft app access: account.microsoft.com/security > Advanced security options
5. Remove unknown connected apps and revoke their access

Revoke active sessions and trusted devices

A password change does not always close browsers and apps already signed in. Sign out every session from the provider's security page.

For Google, open myaccount.google.com/security and choose Your devices. Select an unfamiliar device and choose Sign out. Review Recent security activity on the same page.

For Microsoft, open account.microsoft.com/security, select Advanced security options, then choose Sign out everywhere when available. Review Recent activity for unfamiliar locations or devices.

For Yahoo, open login.yahoo.com/account/security and review Recent activity and connected devices. Apple users can open appleid.apple.com, choose Devices, and remove unknown devices.

Remove trusted or remembered devices after the reset. Sign in again yourself and check recent activity. An unfamiliar login after this step means you need to repeat the device and access checks.

• Sessions: sign out every device from the security page
• Trusted devices: remove unfamiliar or remembered devices
• Login history: check devices, locations and times after the reset

Turn on stronger sign-in protection

Turn on two-step verification from the provider's security page. An authenticator app or passkey is safer than text messages because phone numbers can be hijacked.

Save backup codes offline before closing the page. Keep them in a password manager or another safe place, not only in the account you are repairing.

Check alerts for new sign-ins, password changes and new devices. Point them to a recovery address you control. Change passwords on other accounts that reused the old email password, starting with banking and shopping.

Check financial accounts for unfamiliar transactions. Contact the bank immediately through its official number or app. Ask about stopping payments and protecting the account.

• Two-step verification: use an authenticator app or passkey where possible
• Backup codes: save them offline
• Security alerts: send them to a working recovery address
• Reused passwords: change them on other accounts
• Financial activity: contact the bank immediately if anything looks wrong

Use the official recovery form if you are locked out

Use the provider's own recovery page, not a search advert or paid recovery service. Familiar devices, locations, old passwords and account details can help prove ownership.

Google: visit accounts.google.com/signin/recovery. Enter the affected address and follow the prompts. Google also links this flow from its sign-in page through Forgot password.

Microsoft: visit account.live.com/acsr. Enter the account address, a contact address you can access, and as many old details as possible. Work or school Microsoft accounts need your administrator instead.

Yahoo: visit login.yahoo.com/forgot. Enter the email address or recovery phone and follow the Sign-in Helper prompts. Options depend on the recovery details still attached to the account.

If you cannot act within an hour, secure the device, warn close contacts and start the recovery form later that day. Check the account at least daily for provider notices. Do not keep guessing passwords, because repeated attempts can add delays.

1. Google: accounts.google.com/signin/recovery
2. Microsoft consumer accounts: account.live.com/acsr
3. Yahoo: login.yahoo.com/forgot
4. Work or school accounts: contact IT or the account administrator immediately
5. Save every recovery result and provider message

Protect money, evidence and other accounts

If you’re deciding what to do if your email account is hacked, protect money and evidence before deleting anything. Contact your bank or card provider about fraudulent transactions. Use the number printed on your card or the bank’s official app. Don’t trust contact details inside a suspicious email.

US readers can place a credit freeze with Equifax, Experian and TransUnion. A fraud alert from one bureau tells the other two. Check your country’s credit agency if you live elsewhere. Watch bank statements, card activity and credit reports for unfamiliar changes.

Save bank messages, support chats, receipts, call references and provider emails. Keep original files where possible. Record dates, times, affected accounts and financial losses. Export suspicious emails with their headers if your provider supports that option.

Preserve evidence before wiping a device or deleting messages. A clean copy can help your bank, provider or police understand what happened. Don’t reset the suspect device until you’ve saved needed files or asked investigators for guidance.

Report financial loss or identity theft to local law enforcement. US readers can report online crime at ic3.gov and identity theft at IdentityTheft.gov. UK readers can use Action Fraud. Other countries should use their national cybercrime service or police.

Warn your contacts about the compromise. Tell them to ignore payment requests, links and password-reset messages from the address. Check other accounts using the same password, then change those passwords from a clean device.

1. Contact the bank immediately about fraudulent transactions
2. Place a credit freeze or fraud alert if identity details may be exposed
3. Save communications, receipts, alerts and case numbers
4. Preserve emails and device evidence before deleting or resetting anything
5. Report losses to local law enforcement and the relevant cybercrime service

Quick answers

How do I know if my email was hacked?

Look for unfamiliar sign-ins, sent messages you didn’t write, changed recovery details or contacts receiving scam requests. Check your provider’s recent activity page.

Is changing the password enough?

No. Remove unknown forwarding rules, mail rules, app passwords, connected apps, sessions and trusted devices. Turn on two-step verification afterward.

What if I can’t access the account?

Use the provider’s official recovery form from a clean device. Work and school accounts need the IT team or administrator, not the consumer recovery process.

Should I delete the hacked account?

Only consider deletion after recovery fails and you check linked services. The address may still receive password resets for banking and other accounts.