Think your email was hacked? Do these 7 things
Scan your computer first, then change the password, sign out everywhere, turn on two-step verification, and check that nothing in the account's settings was changed. Do it in that order: changing your password on a computer that still has harmful software on it can hand the new password to the same person.
Signs your account was hacked
- You can't sign in.
- You got a notice about a password or username change you didn't make.
- You got a notice about a sign-in from a device or place you don't recognize.
- Friends or family say they got emails from you that you didn't send.
Steps
- Scan your computer before anything else. Make sure your security software is up to date and run a full scan. Microsoft's advice is to run a full scan before you change your password. Our guide shows how to scan with Windows Security.
- Get back in. If you can still sign in, go to the next step. If you can't, use your email provider's account recovery page and answer the questions as well as you can.
- Change the password. Make it long and different from every other password you use. See strong passwords and password managers.
- Sign out of all devices. Most email services have this in their security settings. It kicks out anyone who is still signed in.
- Turn on two-step verification. With it, a stolen password alone is not enough to get in. See turn on two-step verification.
- Check the account's settings. Look at the recovery email address and phone number: are they yours? Look for forwarding rules that send your mail to another address, and delete any you didn't create. Check automatic replies and connected accounts too.
- Look at what was done, and tell your contacts. Check the Sent folder and the Deleted folder. Then send your contacts a short note: you were hacked, don't click links in recent emails from you, and ignore any request for money.
Why email matters more than other accounts
Password reset links for your other accounts are sent to your email. Someone who controls your email can ask for those links, change those passwords and lock you out one account at a time. That is why email deserves your longest password and two-step verification.
If that didn't work
If the recovery form doesn't get you back in, try it again and give as many details as you can. If banking or card details were saved in the account, contact your bank and make sure nobody gave it instructions in your name.
Sources
- How To Recover Your Hacked Email or Social Media Account, Federal Trade Commission (FTC) (checked )
- How to recover a hacked or compromised Microsoft account, Microsoft Support (checked )
- Secure a hacked or compromised Google Account, Google Account Help (checked )
We check these steps against the sources above and review this guide by April 6, 2027. Software changes; if a screen looks different from what we describe, trust the source.