How to Recover a Hacked Email Account

A hacked email account gives cybercriminals access to your personal data, contacts, and other online accounts. Quick action can minimize damage and restore your account security.

1. Attempt to log in and check for account changes. Go to your email provider's login page and try your usual credentials. If successful, immediately check your account settings for unauthorized changes like forwarding rules, signature modifications, or unfamiliar recovery information. Look for sent emails you didn't write.
2. Use account recovery if locked out. Click 'Forgot password' or 'Can't access account' on the login page. Follow your provider's recovery process using backup email, phone number, or security questions. For Gmail, go to accounts.google.com/signin/recovery. For Outlook, use account.live.com/acsr.
3. Change your password immediately. Create a strong, unique password with at least 12 characters including uppercase, lowercase, numbers, and symbols. Avoid personal information or dictionary words. Use a password manager to generate and store it securely.
4. Enable two-factor authentication. Navigate to your account's security settings and activate 2FA. Choose authenticator apps like Google Authenticator or Authy over SMS when possible. Download backup codes and store them in a secure location separate from your devices.
5. Review and revoke suspicious access. Check your account's active sessions and connected apps. For Gmail, go to myaccount.google.com/security. For Outlook, visit account.microsoft.com/security. Sign out all sessions and remove any unfamiliar third-party app permissions.
6. Scan for malware on your devices. Run full antivirus scans on all computers and mobile devices that access this email account. Use Windows Defender, Malwarebytes, or your preferred security software. Update all software and operating systems to patch vulnerabilities.
7. Secure related accounts and notify contacts. Change passwords for accounts using this email address, especially banking, shopping, and social media. Check for unauthorized password reset emails. Send a message to your contacts warning them about potential malicious emails from your account.
8. Monitor account activity and set up alerts. Enable login notifications and suspicious activity alerts in your email security settings. Review account activity regularly for the next few weeks. Set up email forwarding alerts to catch any new unauthorized rules.