What to do if your email has been hacked

My email has been hacked: what do I do first?

Common signs are contacts receiving messages you never sent, password reset emails you didn't ask for, login alerts from places you've never been, missing emails, or simply not being able to log in any more.

Start with the two things that lock the attacker out. Do this from a device you trust, such as your phone or another computer, not from a device you think might be infected.

1. 1Regain access. If you can still log in, go straight to the next step. If the password has been changed, use your provider's official "forgot password" or account recovery page. Type the provider's address yourself rather than clicking a link in an email, because attackers often follow a hack with fake recovery emails.
2. 2Change your password to a long, new one that you have never used anywhere else. A passphrase of four or five random words works well. See our guide on how to create a strong password.

Email account hacked: what to do next, step by step

Changing the password is not enough on its own. Attackers usually leave themselves a way back in, so work through these steps in your account's security settings.

1. 1Sign out of all other sessions. Most providers have a "sign out of all other devices" or "sign out everywhere" option. This kicks out anyone who is still logged in with the old password.
2. 2Turn on two-factor authentication (2FA). With 2FA, a stolen password alone is no longer enough to get in. An authenticator app, security key or passkey is stronger than SMS. Our guide two-factor authentication explained covers the options.
3. 3Check forwarding rules and filters. This is the step people miss most. Attackers often add a rule that quietly forwards a copy of every email to them, or one that deletes security alerts and replies from your bank. Look in settings under forwarding, rules or filters and remove anything you didn't create.
4. 4Check your recovery email and phone number. If the attacker replaced them with their own, they can take the account back whenever they like. Make sure only your own details are listed.
5. 5Review connected apps and app passwords. Remove apps, add-ons and app-specific passwords you don't recognise. These can keep access even after a password change.
6. 6Look at your sent, deleted and archived folders. This shows what the attacker did with your account, such as scam emails sent to your contacts or messages they tried to hide.

Warn your contacts

If scam messages went out from your address, tell your contacts that your account was compromised and that they should ignore or delete any unusual message from you, especially ones asking for money, gift cards, payment or a click on a link. Send the warning from your recovered account or another channel they know is really you.

For a business or non-profit, warn customers and suppliers too. A common follow-up scam is a fake invoice or "new bank details" email sent from the real, hacked account.

Scan your devices and change reused passwords

Your password may have been stolen by malware on your computer or phone. Update your operating system and run a full scan with the security software built into your device (for example Windows Security on Windows). If anything is found, fix it before you log in to important accounts again.

Then change the password on every other account where you used the same or a similar password. Start with the accounts that matter most: banking and payment services, other email accounts, your website or hosting, and social media. From now on, use a different password for every account. A password manager makes that easy.

Check whether your details were in a data breach

Many email hacks start with a password leaked in a breach of some other website. Free services such as Have I Been Pwned tell you whether your email address appears in known breaches. If it does, change the password on the breached site and anywhere else you used it.

When and where to report it

• Your email provider: most have a way to report a hacked account, and their support team can help if you can't get back in.
• Your bank, straight away, if money was taken or payment details may have been exposed.
• The police or your national cybercrime reporting service if you lost money or are being blackmailed. Examples are the FBI's IC3 in the US, the Canadian Anti-Fraud Centre, ReportCyber in Australia, and the police in the UK and Ireland.
• Your data protection authority, if you're an organisation and other people's personal data may have been exposed. In the EU and the UK, organisations generally have to report this within 72 hours of finding out.

What to do if your email is hacked again: prevention

• Use a long, unique password for your email, stored in a password manager.
• Keep 2FA switched on, and prefer an authenticator app, security key or passkey over SMS.
• Be suspicious of login pages you reach from a link in an email. Type the address yourself. Our guide on how to spot a phishing email shows the warning signs.
• Keep your recovery email and phone number up to date.
• Keep your devices and browser updated, and check your forwarding rules every few months.