Introduction
A hacked email account is more than an inbox problem. Your email is the key to almost everything else you own online: password-reset links for your bank, your shopping accounts, your social media and your cloud storage all land there. Whoever controls your email can, in the words of the US Federal Trade Commission (FTC), request a password-reset link for any of your other accounts, change the password and lock you out.
The good news is that a takeover is fixable, and the order you work in matters more than speed alone. Secure the email account first, then work outward to the accounts connected to it. This guide follows the FTC’s recovery guidance and the major providers’ own recovery pages, and it splits the work into two paths: one for when you can still sign in, and one for when you are locked out.
How to tell your email has been hacked
Watch for friends receiving strange emails from you, sent mail you did not write, messages missing from your inbox, settings changed without you touching them, a password that suddenly stops working, or sign-in alerts from places you have never been. Security alerts from other services going quiet can also be a clue — an intruder may have set up a filter to hide them.
One warning: if a message tells you your account was hacked and offers a link to fix it, do not click it. That message itself is often the trap. Go to your provider yourself, by typing its address or opening the app you already have — the FTC warns that scammers sometimes buy paid search results, so a recovery page that turns up in a search may not be your provider’s.
First: work from a device you trust
Before you start changing passwords, pick the right device. If you can, use a phone, tablet or computer the intruder could not have reached. The FTC’s first step is to make sure your security software is up to date and run a scan; if it finds suspicious software, delete it and restart your computer. Microsoft gives the same advice: run a full scan of your PC before you change your password. Changing a password on a compromised device can hand the new one straight to the attacker.
Path 1: you can still sign in
If you can still get in, you have an advantage — act before the intruder changes the password. Work in this order.
1. Change the password — and make it unique
Set a strong, unique password you have never used anywhere else. If the same password protects other accounts, those are exposed too, and you will change them in a later step. Our guide to creating strong passwords and storing them safely walks through what a good one looks like and how a password manager makes unique passwords practical.
2. Sign out of every other session
Once the password is changed, sign out of all devices. The FTC lists this as a core step: it kicks anyone signed in on another device out of the account. In Google this lives under Security; in Microsoft it is under Security and sign-in activity; Yahoo has the same option on its account security page.
3. Check your recovery information
Attackers add their own recovery email address or phone number so they can get back in after you lock them out. The FTC’s instruction is direct: make sure the recovery email addresses and phone numbers listed are ones you entered and have access to. Remove anything you do not recognize.
4. Turn on two-factor authentication
Turn on two-factor authentication (2FA) now, before the intruder gets another chance. It asks for a second proof — a code or an app prompt — when you sign in. Before you switch it on, choose a second step you will still have next month and save any backup codes your provider offers, or you could lock yourself out later. Our guide to enabling two-factor authentication covers the setup step by step, and if your provider supports it, a passkey is an even stronger option — see our comparison of passkeys vs passwords.
5. Hunt for forwarding rules, filters and other hidden changes
This is the step most people skip, and it is the one that lets an intruder keep access after the password is fixed. Check your email settings for rules set up to forward emails — the FTC calls this out specifically. Look for automatic forwarding to an address you do not recognize; filters that move, mark as read, or delete mail from your bank or other services; a changed sending name or added send-only addresses; mail delegation granting someone else access to your mailbox; a changed signature containing a link you did not add; and remote access (IMAP or POP) or third-party apps you do not recognize. Google’s own help page lists exactly these settings to review, and Yahoo’s help lists new filters, a changed sending name and unfamiliar auto-replies. Delete anything you did not set up.
Then check your sent folder for emails the intruder sent from your account, and your deleted folder for mail they read and then deleted. This tells you who they contacted and what they may have taken — useful for the warning step below and for any report you file.
Path 2: you are locked out
If the password was changed and you cannot sign in, do not use an ordinary password-reset link from a search result. Go straight to your provider’s official account-recovery page by typing its address yourself. Only the provider can restore access — third-party sites that charge to “recover” an account for a fee are usually scams.
Gmail (Google)
Google’s recovery page is at accounts.google.com/signin/recovery. Enter your Gmail address and follow the prompts to verify your identity, typically through your recovery phone or backup email. If the intruder changed those too, look for the “Try another way” option — it offers other ways to prove the account is yours, such as a previous password. Once you are back in, run Google’s Security Checkup to review recent activity, remove unknown devices, check third-party app access and turn on 2-Step Verification.
Outlook / Hotmail (Microsoft)
Microsoft’s recovery form is at account.live.com/acsr. You can enter any email address you currently have access to, and Microsoft sends recovery instructions there. Fill out the form with as much detail as you can remember — old passwords, recent subjects, contacts — because that is how Microsoft judges ownership; Microsoft says a response can take up to 24 hours. Once you are back in, check Security, then sign-in activity, to review suspicious sign-ins, and confirm your personal information on the Security basics page.
Yahoo Mail
Yahoo’s starting point is the Sign-in Helper at login.yahoo.com/forgot. Enter your Yahoo address or phone number and follow the prompts; Yahoo will try to reach you through your recovery phone or email, and offers other verification options if the intruder changed those. After you regain access, create a new strong password, review your account security page for recent activity and recovery information, and turn on 2-step verification.
Apple Account (iCloud Mail)
If the intruder changed your Apple Account password, go to iforgot.apple.com and enter your Apple Account email address. Apple will try to verify you through a trusted device or trusted phone number. If you set up a Recovery Contact — a trusted person who can generate a code — ask them for it, and if you created a 28-character Recovery Key and stored it safely, you can use it at iforgot.apple.com to regain access without waiting. If none of those options work, Apple starts Account Recovery, a waiting period that can last several days or longer while Apple checks that nobody else is trying to take over the account; Apple Support cannot shorten it. Avoid using devices signed in to the account while the request runs, and check its status at iforgot.apple.com. Once you are back in, remove unknown devices, review payment methods and purchases, and revoke app-specific passwords.
After you are back in: reset the accounts connected to your email
Your email was the key, so the intruder may already have used it. Work through your other accounts in this order: banking and payments first — change those passwords and check recent transactions, contacting the company’s fraud department right away if you see fraud; then shopping and delivery accounts, which hold saved cards and your home address; then social media and messaging, checking for posts sent in your name; and finally, any account that shared the old password — change it everywhere you reused it, and make each one different. Our guide on checking whether your email was in a data breach is a useful next step if you suspect the password leaked earlier.
Warn your contacts
Send your contacts a quick email or text to let them know your email was hacked. The FTC’s exact wording to pass on: tell them not to click on links in emails from you, and to ignore pleas for help or money. Reach out through a different channel — a text, a call, or another account — so the warning does not come from the compromised mailbox itself, where the intruder could delete it.
When to report it
Not every hacked inbox needs a formal report, but report it when money, identity or further harm is involved. If money moved or fraud was attempted, report to your bank or card issuer first, then to the FTC at IdentityTheft.gov if your information was misused — the FTC builds a personal recovery plan from your report. If a crime was committed with your account, the FBI’s Internet Crime Complaint Center (IC3) takes complaints about internet crime. If the hack started with a phishing email, forward the message to your provider’s abuse address and, in the US, to [email protected]. Learning to recognize the next one matters too — see our guide on how to spot a phishing email.
Frequently asked questions
I can still sign in, but my password no longer works on my phone. Am I hacked?
Not necessarily — a changed password, a sign-in from a new device, or a provider security hold can all cause that. Try signing in on the web from a device you trust. If it works there, the phone session may simply need the new password; if it does not work anywhere, start the provider’s account-recovery process.
The hacker changed my recovery email and phone. Can I still get the account back?
Usually, yes, but it takes longer. Google’s recovery flow offers “Try another way” options such as a previous password; Microsoft’s recovery form lets you supply a different contact email and answer ownership questions; Apple’s Account Recovery uses a waiting period while it verifies ownership. The providers’ recovery pages are the only safe route — never pay a third-party “recovery” service.
Should I delete the hacked account and start a new one?
Rarely. The account still holds your purchase history, your contacts, and the reset path for your other accounts, and deleting it can make recovery harder. Recover and secure it first; only consider a fresh address as a secondary mailbox once the old one is locked down.
How do I stop this happening again?
Three habits cover most cases: a unique password for every account (kept in a password manager), two-factor authentication — or a passkey — on your email and financial accounts, and a habit of checking your account’s recent sign-in activity and forwarding rules every few months. Most takeovers start with a reused password or a phishing message.
The bottom line
A hacked email feels urgent, and it is — but panic is not a plan. Work from a clean device, secure the mailbox first, then move outward: sign out every session, fix the recovery details, switch on two-factor authentication, hunt down forwarding rules and filters, reset the passwords on the accounts that email protects, and warn your contacts through another channel. If you are locked out, use only your provider’s official recovery page and be patient with its verification process. Do it in that order, and the intruder ends up with nothing but a closed door.
