Email is often the master key for banks, shopping accounts, social media, and password resets. If someone gets into it, the response needs to happen in order: lock the account, remove persistence, then check what else was accessed.
Does this affect you?
Use this for Gmail, Outlook, Hotmail, Yahoo Mail, iCloud Mail, ISP email, or work email when sent messages appear, contacts report strange emails, or the password suddenly stops working.
Immediate lockdown
Do these first, even if you are not completely sure yet.
- Change the email password from a trusted phone or computer, not a public machine. Use a password you have never used elsewhere.
- Check email forwarding, rules, and filters. Delete anything that sends, archives, deletes, or hides mail without your approval.
- Review sign-in activity or recent activity and sign out devices or sessions you do not recognize.
- Check connected apps, app passwords, third-party access, or authorized websites and remove anything unfamiliar.
- Turn on two-factor authentication if it was not already enabled.
Check what happened while the attacker had access
Once the account is locked down, look for damage and backdoors.
- Open Sent mail and find messages you did not write, especially bulk messages to contacts.
- Search for password reset, security alert, verification code, and changed email messages from other services.
- Check contacts for unfamiliar additions.
- Review the email signature for spam links or changed contact details.
- If another account was reset through your email, secure that account next by changing its password and checking its login activity.
More control
Warn contacts if messages went out
A short note telling people the account was compromised can stop friends or coworkers from clicking scam links or sending money or gift cards.
Use a unique email password
Because email protects so many other accounts, it deserves a password that is not reused anywhere. Password reuse is one of the most common takeover causes.
Update recovery options
Check that the recovery phone and backup email are current. Good recovery settings turn a future lockout into a short reset instead of a multi-day ordeal.
Consider migration only for severe cases
If the attacker had access for a long time, changed recovery details, or may have seen sensitive reset links, you may choose to move banking and critical accounts to a new email address. Most cases do not require this once the old account is properly secured.
Sources
- Google Safety Center – What to do if your Google Account is compromised (2025)
- Microsoft Support – My Outlook.com account has been hacked (2025)
- CISA – Recovering from a cyber attack: compromised accounts (2024)