What Should You Do After Your Email Account Is Hacked?

An email account can be the key to resetting passwords, receiving financial alerts, and proving ownership of other online accounts. If someone accessed it, changing the password is important, but it may not be enough. An attacker could have added their own recovery method, created a forwarding rule, authorized an app, or used your mailbox to target other people.

Work through the steps below in order. If you are unsure whether the account was actually compromised, treat suspicious activity seriously without deleting evidence or making rushed changes.

1. Stop using suspicious links and messages

Do not use a password-reset link, phone number, or support contact included in a message that claims your account was hacked. A second phishing attempt often follows the first incident. The message may imitate Microsoft, Google, Apple, a bank, or your email provider.

Instead, open a new browser window and type the provider’s known web address yourself, use its official app, or use a bookmark you created previously. If you are dealing with a work or school account, contact the organization’s IT department through a known phone number or internal channel.

2. Secure the device before changing important passwords

If the computer or phone you normally use has malware, a keylogger, a malicious browser extension, or a stolen browser session, changing the password on that device may expose the new password too. Use a trusted, updated device if possible.

On the affected computer, pause before performing major cleanup. If you may need professional investigation or the account is connected to a business, preserve useful evidence such as suspicious messages, login alerts, browser extensions, and visible account settings. Do not install random “account recovery” utilities or remote-support software offered by unsolicited callers.

Warning: If the account contains sensitive business records, legal information, financial documents, or confidential client data, avoid deleting messages or wiping the computer until the appropriate business contact or technician has considered evidence and reporting requirements.

3. Change the email password from an official account page

After reaching the provider through a trusted route, change the password to a long, unique password that has not been used anywhere else. A password manager can generate and store one safely. Do not reuse the same password for banking, shopping, social media, or cloud storage.

If you cannot sign in, use the provider’s official account-recovery process. Answer recovery questions accurately and provide only information requested by the provider. There is no legitimate technical shortcut for bypassing account security, multi-factor authentication, activation controls, or identity checks.

If the attacker changed the recovery email address or phone number, the recovery process may take time. Keep records of the account address, previous recovery information, approximate date of the incident, and any legitimate billing or account details the provider requests. Never send passwords or one-time codes to another person.

4. Sign out other sessions and remove unfamiliar access

Look for a security area labeled something like devices, recent activity, active sessions, or where you’re signed in. Sign out devices, browsers, and locations you do not recognize. If the provider offers an option to sign out everywhere, use it after changing the password.

Review these settings carefully:

Recovery email addresses and phone numbers
Two-step verification methods and backup codes
Authenticator apps or security keys
App passwords
Connected applications and third-party access
Mail delegates, shared mailbox permissions, and account aliases
Automatic forwarding and filtering rules

Remove anything you did not add. Pay special attention to a rule that forwards messages, marks them as read, moves security alerts into a hidden folder, or deletes replies. A forwarding rule can allow an attacker to continue receiving password-reset messages even after you change the password.

When resetting multi-factor authentication, save new backup codes in a secure place and do not leave old codes available to someone who may have copied them. If you use a work account, some settings may be controlled by an administrator rather than by you.

5. Check what the attacker may have done

Review the Sent, Drafts, Deleted, Archive, and Spam folders. Look for password-reset requests, messages asking contacts for money, unusual invoices, changed payment details, links sent in your name, or messages that reveal private information. Check mailbox rules and search for terms such as “verification,” “security,” “invoice,” and “password” if the mailbox is large.

Tell contacts what happened using a separate communication method. Keep the notice short: explain that recent messages or links from the account may not be trustworthy and should be deleted. Do not forward suspicious attachments or links while warning people.

If the mailbox contains financial statements, tax documents, identification records, medical information, or business credentials, consider which organizations need to be notified. Monitor bank and payment accounts for unfamiliar activity. If money was sent or payment information was exposed, contact the financial institution through its official number as soon as possible.

6. Protect other accounts connected to the email address

Assume that the attacker may have attempted password resets elsewhere. Start with accounts that could cause the most harm: banking, payment services, cloud storage, shopping, social media, payroll, domain registration, and business administration accounts.

Change passwords for those accounts from official websites, use a different password for every service, and enable multi-factor authentication. Check their sign-in history, recovery settings, forwarding or notification preferences, and connected applications. If an account uses the compromised email address for recovery, secure that account after securing the email account or temporarily change its recovery method.

Do not approve an unexpected login prompt just because it appears on your phone. An attacker may already know the password and be trying to persuade you to accept a sign-in request. Reject unexpected prompts and report them to the provider.

7. Scan and update the computers and phones you use

An email compromise may result from phishing, a reused password, a stolen browser session, an unsafe application, or malware. The cause is not always visible from the mailbox alone. Update the operating system, browser, and security software. Run a scan using the built-in security tools or a reputable security product obtained from its official source.

Review browser extensions and remove ones you do not recognize or no longer need. Check for unfamiliar remote-access applications and recently installed programs. If the computer shows other warning signs—such as repeated account takeovers, unexpected security changes, pop-ups outside the browser, or disabled security tools—stop entering sensitive passwords and seek qualified help.

Do not assume that a scan proves the computer is clean. Security tools can miss a problem, and an account can be compromised without malware being present. The right next step depends on the device, operating system, account type, and evidence available.

8. Know when to involve the provider or a technician

Contact the email provider when you cannot regain access, recovery information was changed, unfamiliar forwarding continues, or the provider shows activity you cannot explain. Use only official support channels. Be cautious of people who promise instant recovery in exchange for gift cards, cryptocurrency, passwords, remote access, or verification codes.

For a small business, involve the administrator promptly. A compromised mailbox may affect shared files, Microsoft 365 or Google Workspace settings, customer records, invoices, and other users. The administrator may need to revoke sessions, review audit records, reset additional accounts, and check whether forwarding or delegated access was added.

A local computer technician can help inspect a Windows PC or Mac for unsafe software, review browser and email settings, and improve account security. That work cannot guarantee that an online account provider will restore access, and it should not replace the provider’s own recovery process.

9. Prevent a repeat incident

Use a unique password for every important account.
Enable multi-factor authentication, preferably with an authenticator app or security key when supported.
Keep recovery information current and protected.
Use a password manager rather than storing passwords in plain text.
Be cautious with unexpected attachments, login pages, and urgent requests.
Review account sessions, forwarding rules, and connected apps periodically.
Keep operating systems, browsers, phones, and security software updated.
Maintain separate, tested backups for important files; email access is not a backup.

If you suspect your email was hacked, focus first on safe access, password and session control, recovery settings, and connected accounts. Move carefully, preserve evidence when the incident may affect a business or sensitive information, and stop before entering more credentials if the device itself may be compromised.

When to call a professional

If the problem continues, the data is important, or the repair requires work beyond your comfort level, AME Computers can provide professional diagnosis and repair or call 402-505-6600.