You open your inbox and something feels off. For example, a password-reset email you never asked for arrives. Then, a friend asks why you sent a strange link at 3 a.m. That cold feeling is real. It is also useful. Finally, the next hour is when you can do the most good.
Here’s the thing most people get wrong when they wonder what to do if your email is hacked: they panic. Or they change one password and call it done. However, a hacked inbox is not a single broken lock. Instead, it is a key. It opens many other doors: your bank, your shopping accounts, and your social media. It also opens anything that sends a “forgot password” email to that address. Therefore, the order you work in matters.
This checklist walks you through that first hour, step by step. No jargon. No scare tactics. Just the sequence that locks an attacker out and keeps them out.
First, is it really hacked — or just a scare email?
First, not every alarming email means someone is inside your account. Scammers send fake “your account has been compromised” messages. They want you to click without thinking. Before you do anything else, stop. Finally, check one thing: did the warning come from inside your account, or just into it?
Picture this. For example, you make tea. Then, a mate messages: “Did you just send me a crypto link?” You did not send it. That is a real sign. In fact, something sent mail from your account. Compare that with a random email. It claims your account will close in 24 hours unless you click a link. However, that second email is usually just phishing. Our guide covers how scammers trick people, not computers.
Start with mail you did not send. Then check for a password change you did not make. Next, look for a recovery change you did not make. Also check sign-ins from unfamiliar places. Then look for new forwarding rules and filters. Finally, check for spam from your address. If you see one of those, treat it as a hack. Work through the checklist below. If you only got a scary email, do not click its links. Nothing inside your account changed in that case. Go to your account’s security page directly. Type the address yourself, and check there.
The first hour, in order
Work through these four steps in order. Each step closes a door. In addition, the previous step left that door open. Skipping ahead lets attackers stay in. For example, they stay in even after a password change. Finally, this sequence is the heart of what to do if your email is hacked.
1. Get back in from a clean device
If you can still sign in, use a device you trust. For example, use your own phone or laptop. However, do not use a shared computer. Also, do not use a device that might carry malware. Next, if your password no longer works, go straight to your provider’s official recovery page. Google’s page helps most people. In addition, its hacked-account guide walks through the same sequence. Then, answer the recovery questions as best you can. Use a familiar device and network if you can. Providers trust those more. As a result, that trust makes recovery smoother.
Here is a mistake people make at this stage. For example, they try to fix things from the same browser session. In addition, an attacker may already control that session. Or they click a “recover your account” link in a suspicious email. However, do not do that. Instead, type the provider’s address yourself. Or open its app. If you use a work or school account, tell your IT contact early. Managed accounts have their own recovery route. Finally, personal steps do not always apply.
2. Change your password — and sign out everywhere
Pick a new password. First, make it long. Next, make it unique. Also, use it nowhere else. However, do not add “!” to the old one. That trick does not count as new. If you reused the old password anywhere, change those accounts too. Most of us reused a password somewhere. Finally, start with your bank. Then change any shopping account with a saved card.
Then sign out of all other sessions. Every provider offers a version of this. For example, look for a “sign out of all devices” page. Or look for a “manage devices” page in security settings. However, people skip this step often. In fact, it matters most. A password change alone does not always kick out a signed-in session. Signing out everywhere does that. Next, check the device list while you are there. Finally, remove anything you do not recognise.
3. Check the quiet changes: recovery details, forwarding and filters
This part is sneaky. For example, it explains why a hacked inbox can feel “fixed”. Then it goes wrong again a week later. An attacker who gets in often makes small, quiet changes. In addition, those changes let the attacker return. Also, they let the attacker keep a copy of your mail.
Check three places, in order. First, check your recovery email and phone number. If either one is not yours, change it back at once. That detail gives an attacker a way back in through “forgot password”. Second, check forwarding addresses and mail rules. Look for any rule that forwards incoming mail. Next, check rules that archive incoming mail. Also, check rules that delete incoming mail. Finally, look for any forwarding address you did not add. Attackers use these rules to copy your reset emails quietly. They keep copying mail even after you change your password. Third, check connected apps and third-party access. Remove anything you do not recognise. Finally, remove anything you no longer use.
Imagine it like this. You changed the locks. However, someone left a spare key under the mat. In addition, someone pointed a camera at the letterbox. Recovery details act as the spare key. Forwarding rules act as the camera. Until you remove both, you are not actually secure.
4. Turn on stronger sign-in protection
Now lock the door properly. First, turn on two-factor authentication. An authenticator app beats a text-message code. A security key also beats a text code. Attackers can phish text codes. However, use text codes if that is all your provider offers. In fact, any second factor beats none. Our guide to turning on two-factor authentication for every important account walks through the setup account by account.
Where your provider offers passkeys, set one up. A passkey ties itself to the real service. However, a fake login page cannot steal it. In contrast, a fake page can steal a password. Passkey setup takes a couple of minutes. Finally, it removes the most common way attackers take over accounts.
The checks most people skip
Once you finish the four steps, spend ten more minutes on wider fallout. This part separates a quick fix from a proper recovery.
First, look at your Sent folder. Next, look at your deleted mail. Did the attacker send anything? If friends or colleagues got spam or phishing from your address, warn them. A short, plain message works best: “My email was hacked, please don’t click any link from me yesterday, I’ve secured it now.” People respect honesty here. Nobody judges you for it. Finally, a warning stops the scam spreading through your contacts.
Then think about what else your email opens. Any account that uses this address for password resets deserves attention. That includes banking, shopping, social media, and cloud storage. If it shared the old password, give it a fresh password. Also, check its recent activity. Next, check saved payment methods on shopping accounts. If you spot a purchase you did not make, contact your bank straight away. However, do not wait to see if it sorts itself out. The same applies to a transfer you did not make.
If you can’t get back in at all
Sometimes the attacker changed the password first. Then, the attacker changed the recovery details. As a result, normal sign-in will not work. Do not panic. Definitely do not pay anyone who promises to “recover” your account for a fee. Those services are almost always scams. Finally, real providers never charge for account recovery.
Use the provider’s official recovery flow. First, answer as honestly as you can. Even partial answers help on a familiar device. Google’s official guide for a hacked or compromised Google Account lays out this path. It starts with recovery. Then you do a security review once you are back in. If recovery keeps failing, try your provider’s help community next. However, do not use a paid stranger.
While you are locked out, protect accounts that depend on that email. If you can, change the recovery email on your most important accounts. First, start with your bank. Next, use a different address you still control. As a result, a reset email will not go to an inbox you cannot reach.
How to stop it happening again
The habits that prevent a repeat are boring. That is the point. First, use a password manager. Then every account gets its own long password. You do not need to remember any of them. Next, turn on two-factor or passkeys everywhere your provider offers them. Start with email, banking, and your main social accounts. Then, glance at your account’s device list every few months. Also, check connected apps. That check takes two minutes. Finally, it catches problems while they are still small.
Get suspicious in the right direction. The next time an email urges you to act urgently, pause. For example, it may say verify this, confirm that, or click here or else. Instead, go to the service directly. That one habit blocks most tricks. Finally, those tricks lead to a hacked inbox in the first place.
Frequently asked questions
How do I know if my email has been hacked?
Start with mail you did not send. Then check a password change you did not make. Next, check a recovery change you did not make. Also look for sign-ins from unfamiliar places. Finally, check new forwarding rules and filters. A scary email alone usually means just phishing. However, nothing changed inside your account in that case. Finally, check your account’s security page directly instead of clicking its links.
What should I do first if my email is hacked?
First, sign in from a device you trust. Or use the provider’s official recovery page if you are locked out. Next, change the password to a long unique one. Then, sign out of all other sessions. After that, check your recovery details. Also, check forwarding rules. Finally, check connected apps. Only then turn on two-factor or a passkey.
Does changing my password kick the hacker out?
Not on its own. For example, an already-signed-in session can survive a password change. In addition, a forwarding rule can let an attacker back in. Also, a changed recovery detail can do the same. Therefore, you need the full sequence. First, use a new password. Next, sign out everywhere. Finally, check recovery details and mail rules.
Should I pay a service that promises to recover my hacked account?
No. Real providers recover accounts for free. They use their official recovery flows. However, paid “recovery” services are a common scam. If the official flow fails, use the provider’s help community. Finally, do not use a stranger who charges a fee.
Is two-factor authentication enough to stop this happening again?
It stops most password-based attacks. However, attackers can still phish text codes. An authenticator app is stronger. A security key is stronger still. A passkey is strongest of all. For example, a fake login page cannot steal a passkey. Finally, use the strongest option your provider offers.
The takeaway
A hacked inbox feels personal. The first hour feels frantic. However, the fix is a sequence, not a scramble. First, get back in from a clean device. Next, change the password and sign out everywhere. Then, hunt down quiet changes to recovery details and mail rules. Finally, lock it with two-factor or a passkey. That is what to do if your email is hacked, done properly instead of in a panic.