Accounts & passwords
My email account has been hacked. What do I do?
Your email is the master key to almost everything else. Password resets for your bank, shopping, social media and work accounts all land there. So if someone has got in, it’s worth dealing with properly, not just changing the password and hoping for the best.
The short version
Do these first
- Change the password from a device you trust.
- Sign out every other session.
- Check recovery details, forwarding and filters.
- Turn on two-step verification, then warn your contacts.
Signs your email has been hacked
- Friends or customers say they got strange emails from you.
- You see sent emails you didn’t write, or emails missing from your inbox.
- You get alerts about sign-ins from places or devices you don’t recognise.
- Your password suddenly doesn’t work.
- Password reset emails arrive for other accounts you didn’t request.
If you can still sign in
Use a device you trust
If you think your computer might have malware on it, use a different phone or computer for these steps.
Change your password
Make it long and unique, ideally generated by a password manager. Don’t reuse an old password or a small variation of the hacked one.
Sign out of every other session
- Gmail: open your Google Account, go to Security, then Your devices, and sign out of any device you don’t recognise.
- Outlook.com: in your Microsoft account, go to Security and use the option to sign out everywhere.
- Work Microsoft 365 or Google Workspace: ask your IT admin to revoke all sessions. They can do this centrally and more thoroughly.
Check recovery details
Attackers often add their own phone number or backup email so they can get back in later. Make sure only your own details are listed.
Check forwarding and filters
This is the step most people miss. Look for:
- Forwarding that sends a copy of your email to an unknown address.
- Filters or rules that move, delete or mark certain emails as read, especially ones mentioning “invoice”, “payment”, “bank” or the names of people you deal with.
In Gmail, check Settings, then Forwarding and POP/IMAP and Filters and blocked addresses. In Outlook, check Settings, then Mail, then Rules and Forwarding. Delete anything you didn’t create.
Check connected apps
Remove any third-party apps or services with access to your account that you don’t recognise.
Turn on two-step verification
See our guide on two-step verification. This is the single biggest protection against it happening again.
If you’ve been locked out
- Google: use the account recovery page at accounts.google.com/signin/recovery and answer as many questions as you can, from a device and location you’ve used before.
- Microsoft: use the account recovery form at account.live.com/acsr.
- Work email: contact your IT administrator straight away.
- Your own domain’s email: contact whoever hosts your email, or your IT provider.
Be patient with recovery forms. Giving old passwords you remember, and using a familiar device and network, helps prove it’s you.
Watch for business email compromise
If it’s a work or business mailbox, attackers may have read conversations about payments and be waiting to send a fake invoice or change of bank details to your customers. Warn your regular customers and suppliers by phone, and see our guide to invoice and payment redirection scams.
After you’re back in
- Change passwords on other accounts that used the same password, and on important accounts linked to this email, such as banking, myGov, shopping and social media.
- Warn your contacts that any odd messages from you recently weren’t from you, and they shouldn’t click links in them.
- Check your sent folder to see what the attacker sent, and to whom.
- Scan your computer for malware if you think that’s how the password was stolen.
- Report it to ReportCyber, especially if money or business data was involved.
How it usually happens
- A phishing email led to a fake sign-in page. See how to spot a phishing email.
- The same password was used on another site that had a data breach.
- Malware on a computer captured the password.
- A sign-in request was approved by mistake.
Common questions
Should I just delete the account and start again?
Usually not. Too many other accounts depend on it, and an abandoned address can be a risk. Recover and secure it instead.
I changed my password, but the problem came back.
Check again for forwarding rules, recovery details and connected apps, and make sure every session was signed out. Also check your computer for malware.
How do I know which of my passwords were leaked?
The free service Have I Been Pwned shows whether your email appears in known data breaches.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.