How to Recover a Hacked Email Account Step by Step

Your password stopped working, friends are asking why you sent them a strange link, or a "new sign-in" alert arrived from a city you have never visited. A hacked email account is more serious than any single lost login, because your inbox is the reset key for your bank, your shopping accounts and your social media. The first hour matters, and the steps need to happen in the right order.

This is the recovery sequence I walk people through, from regaining access to closing the doors the attacker left open behind them.

Signs your email account has been hacked

Sometimes it is obvious. Often it is not, because attackers who want to stay hidden will leave your password alone and quietly read your mail. Look for:

• Sent messages you did not write, especially links or requests for money.
• Password reset emails from services you did not try to reset.
• Security alerts about new devices or locations.
• Emails that you know arrived but are missing, or are already marked as read.
• New forwarding rules or filters you did not create.
• Changes to your recovery phone number or backup email address.

Any one of these is enough reason to act now rather than wait for a second sign.

Step 1: Regain control of the hacked email account

If you can still sign in, do it from a device you trust, ideally not the one you suspect was compromised. Change the password straight away to a long, unique passphrase that you have never used anywhere else. If you need a method for making one, our guide on creating a strong passphrase you can remember takes about five minutes.

If you are locked out, use the provider's official account recovery page. Type the address yourself rather than clicking any link in an email. Recovery forms ask questions such as:

• The last password you remember, even an old one.
• When you created the account, roughly by month and year.
• Email addresses you often write to.
• Folder or label names you made.

Answer from the device and network you usually use, because providers weigh familiar locations heavily. If the first attempt fails, wait 24 hours and try again with more detail rather than submitting ten times in a row, which can trigger a temporary block.

Step 2: Kick the attacker out

Changing the password does not always end existing sessions. Go to the security or devices section of your account and choose the option to sign out of all other sessions. On major providers this is a single button.

Then check the places attackers use to keep access after you change your password:

1. Forwarding and filters. Delete any rule you did not create. A common trick is a filter that forwards anything containing "bank" or "invoice" to an outside address, then deletes it from your inbox.
2. Recovery phone and email. Make sure both belong to you. If the attacker swapped them, they can simply reset the password again tomorrow.
3. Connected apps. Remove anything you do not recognise. Third party apps with mail access can read your inbox without your password.
4. App passwords. Some providers let you create special passwords for older mail apps. Revoke all of them and recreate only what you need.
5. Signature and auto reply. Check these were not changed to include a malicious link.

Step 3: Turn on stronger sign-in protection

Switch on two-factor authentication now. An authenticator app or a passkey is much harder to steal than a text message code. If you are unsure which to pick, our explanation of passkeys covers when they are the better choice.

Save the backup codes the setup offers. Print them or store them in a password manager, not in the same inbox you are protecting. There is more on that in where to keep 2FA backup codes.

Step 4: Contain the damage beyond your inbox

Assume the attacker searched your mail for anything valuable. Work through this list over the next day:

Search your own inbox for words like "passport", "statement", "tax" and "password". Anything that turns up is something the attacker may have seen. If you find scanned ID documents, delete them from the inbox and the trash folder, then ask your bank if it can add a password or extra identity checks to your account. If a passport scan was exposed, report it to the issuing office so a replacement can be considered.

Why running a virus scan first wastes time

The standard advice is to start by scanning your computer for malware. I disagree with doing it first. Most email takeovers today come from reused passwords leaked in someone else's breach, or from a phishing page, not from malware on your machine. Spending the first hour on a full scan gives the attacker an hour to change your recovery details and lock you out for good.

Secure the account first, from a trusted device. Then scan the device you normally use. If you find malware, change the email password again afterwards, because anything typed on an infected device should be treated as exposed.

What to do if recovery fails

If the provider will not return the account after several attempts, focus on cutting it off from everything else. Change the email address on your bank, shopping and social media accounts to a new one. Tell your contacts the old address is no longer yours. Keep a record of dates and screenshots in case you need to report fraud later.

Expect recovery to take anywhere from a few minutes to around a week, depending on the provider and how much you can prove. During that time, avoid signing in from new devices or networks, which can make the provider less confident it is really you.

For a work or business account, contact your administrator immediately. They can reset access, force sign-outs and review logs in minutes, which is far faster than any consumer recovery form.

Frequently asked questions

How did my email account get hacked?

The most common cause is a password reused on another site that suffered a breach. The next most common is a phishing page that captured your login. Malware is less common but possible, so scan your devices once the account is secure.

Can a hacker still access my email after I change my password?

Yes, if you do not also sign out other sessions, remove forwarding rules and check recovery details. Those let an attacker keep reading mail or reset the password again. Turning on two-factor authentication closes most of these gaps.

Should I delete a hacked email account and start fresh?

Usually not. Once you regain control and secure it, keeping the account stops someone else from claiming the address later and using it to reset your old logins. Only abandon it if recovery truly fails, and move your other accounts to a new address first.