On this page
If someone has accessed your email, start with the provider's official recovery process or security settings, using a device you trust. Change the password, remove unfamiliar access, and check recovery details. A password change alone may not close every door.
Email often controls password resets for your other accounts, so act promptly without following links in alarming messages. Work or school accounts should also be reported to your IT team immediately; administrators may need to preserve evidence and revoke access centrally.
Confirm the problem and choose a trusted device
Warning signs include unfamiliar sent messages, changed recovery details, missing mail, or sign-in alerts you cannot explain. An unexpected verification code can indicate an attempted login, but it does not by itself prove someone got in.
Likewise, a message claiming to have hacked you is not proof. Criminals sometimes include an old leaked password to make an extortion demand believable. Check account activity directly rather than replying or paying.
Use an updated device you control. If the suspected compromise followed a software download, remote-support session, or malware warning, use a different trusted device for recovery. Otherwise, a malicious program could capture your replacement credentials.
Before making changes, save screenshots of unfamiliar activity if you can do so quickly. Note approximate times and any suspicious payment requests. Do not delay securing the account just to collect a perfect record.
Recover access or replace the password
If you cannot sign in, type your provider's known address into the browser and select its account-recovery option. Do not use a recovery service promoted in search ads or social media replies.
Official starting points include Google Account recovery, Microsoft account recovery, and Yahoo Sign-in Helper. Follow the process that matches your account type; organization-managed accounts may require an administrator instead.
A familiar browser, device, and location can help a provider recognize you. Answer questions accurately, and avoid repeated random guesses. Nobody legitimate needs payment in cryptocurrency to unlock your mailbox.
If you still have access:
- Open your account's security settings directly.
- Replace the password with a unique one you have never used elsewhere.
- Save it in a trusted password manager.
- Continue with session, recovery, and mail-setting checks before considering the job finished.
The Password & Hash Generator can help create a replacement. Do not paste your current password or recovery codes into any generator. Change reused passwords on other services as well.
Remove sessions and hidden access
Look for controls named Your devices, Recent activity, Where you're signed in, or Manage sessions. Sign out unfamiliar devices and use a sign-out-everywhere option when offered. Your current device may also need to sign in again.
Do not assume changing a password invalidates every existing session or connected app. Providers handle these differently, so review each access category explicitly.
For Google, start at Google Account > Security & sign-in, or the similarly named Security section. Review devices and connections to third-party apps and services. For a personal Microsoft account, open the account dashboard's Security area and review sign-in activity and advanced security options. Labels can change.
Remove unfamiliar connected apps, app passwords, passkeys, and security keys. App passwords are separate credentials used by some older mail applications; revoke ones you do not recognize or need.
Check recovery phone numbers, backup email addresses, and authentication methods. Remove anything unfamiliar after confirming you have a working recovery method of your own. Generate replacement backup codes if the provider supports them, and invalidate the previous set.
Check what happens inside the mailbox
An attacker may leave forwarding or filtering rules that keep exposing your mail after you recover the login. Review settings even when your inbox looks normal.
- Forwarding: Remove destinations you did not authorize.
- Rules and filters: Look for automatic deletion, archiving, or forwarding of security alerts and financial messages.
- Delegation: Remove people or accounts that should not be able to read or send mail for you.
- Sending identities: Check unexpected aliases, reply addresses, signatures, and automatic replies.
- Mail access: Review POP or IMAP access if your provider exposes those controls.
In Gmail on the web, open Settings > See all settings, then inspect Forwarding and POP/IMAP, Filters and Blocked Addresses, and Accounts and Import. Some options depend on the account.
In Outlook on the web, open Settings > Mail and inspect Rules and Forwarding. Also review the settings available for connected accounts or synchronization.
Check Sent, Trash, Deleted Items, and Archive for suspicious activity. Preserve evidence of fraud before removing messages, particularly if your employer, bank, or law enforcement may need it.
Protect connected accounts and people
Prioritize accounts that can move money, reveal sensitive records, or reset other passwords. Review your password manager, bank accounts, mobile carrier account, cloud storage, shopping accounts, and social profiles.
Look for password-reset emails you did not request and changes to shipping addresses or payment details. Go directly to each service to review activity. Do not assume that every account was accessed, but treat suspicious evidence seriously.
Warn contacts if the attacker sent messages from your address. Use a separate trusted channel when possible. Explain the approximate time window and ask recipients not to open unexpected attachments, send money, or follow payment changes.
If money moved, contact the bank or payment provider immediately. If sensitive identity information was exposed, use IdentityTheft.gov for recovery guidance. Work-related data exposure belongs with your organization's incident-response team, not just your personal cleanup checklist.
Strengthen access and watch for recurrence
Enable a passkey or strong two-factor authentication when available. Passkeys Explained: Signing In Without Passwords describes why passkeys resist ordinary credential-phishing pages. If you use an authenticator app, keep recovery codes somewhere safe outside the mailbox.
Update your devices and remove suspicious software or browser extensions. Follow How to Spot a Phishing Email in 30 Seconds to reduce the risk of another stolen login.
For the next several weeks, watch security notifications, account activity, and financial statements. If unfamiliar access returns, revisit connected apps and device security rather than repeatedly changing only the password.
Finish with a recovery check
Make sure you can sign in, your recovery methods work, unknown sessions are gone, and forwarding rules are clean. Keep notes of what you changed.
Regaining access is the first milestone. Removing persistent access and protecting the accounts tied to your email are what make recovery stick.
Reach designers & developers at work
Put your product next to the tools people use every day. One sponsor per placement, no tracking pixels.
Become a sponsor