What Should I Do If My Email Gets Hacked? Recovery Steps That Work

That sinking feeling when you can’t log into your email — or worse, when friends start asking why you’re sending them strange links — is horrible. If you’re wondering what to do if your email gets hacked, take a breath: in most cases you can recover the account fully, provided you act quickly and methodically. Panic-clicking, on the other hand, tends to make things worse.

Your email account is the single most valuable target a criminal can compromise. It’s not about the emails themselves — it’s because nearly every other account you own (banking, shopping, social media) can be reset through your inbox. That’s why recovering your email properly, and then hardening it, matters more than almost any other security task.

What should I do if my email gets hacked? Act in this order

Step 1: Try to regain access immediately

Go to your provider’s account recovery page right now — for Gmail it’s google.com/accounts/recovery, for Outlook it’s account.live.com/acsr, for Yahoo there’s a similar recovery flow. Use the “forgot password” option and follow the identity verification steps. The sooner you act, the better: hackers often change recovery details quickly to lock you out permanently, and every hour counts.

If the hacker has changed your password and your recovery email and phone number, don’t give up — the recovery forms let you prove ownership in other ways, such as answering security questions, confirming recent emails you’ve sent, or verifying from a device and location you’ve used before. Fill in as much detail as you can; partial information is better than none.

Step 2: Once you’re back in, lock the hacker out

Regaining access isn’t enough — you need to make sure they can’t stroll back in. Do all of this in one sitting:

• Change the password to something long, random, and unique — generated by a password manager, not invented by you.
• Check recovery options. Hackers routinely add their own recovery email and phone number. Go through every recovery method on the account and remove anything you don’t recognise.
• Review active sessions. Gmail: scroll to the bottom of your inbox → Details → sign out all other sessions. Outlook: account security page → review devices. Boot every unknown device.
• Check forwarding rules and filters. This is the trick most victims miss. Hackers often set up silent email forwarding or filters so copies of your password-reset emails keep going to them even after you’ve changed the password. In Gmail: Settings → Forwarding and POP/IMAP, and Settings → Filters. Delete anything suspicious.
• Turn on two-factor authentication immediately — see what two-factor authentication is and whether you should use it if you haven’t set it up before.

Step 3: Check what else is compromised

With inbox access, a hacker can reset passwords anywhere. Search your email (including sent items and trash) for password-reset emails you didn’t request — that tells you which accounts they targeted. Then, one by one, secure your most important accounts: online banking first, then other financial services, then social media, then shopping sites. Change each password and enable 2FA. It’s tedious, but it’s the only way to be sure.

Also check Have I Been Pwned to see if your address appeared in a known breach — that often explains how the hacker got in (usually a reused password from an old breach). Our guide to protecting your personal data from data breaches explains the credential-stuffing trick behind most email hacks.

Step 4: Warn your contacts

Hackers love using compromised inboxes to scam the victim’s contacts — “I’m stuck abroad, please send money” is the classic. Send a brief message to your frequent contacts (or post on social media) saying your email was compromised and to ignore suspicious messages. Most people are understanding; nobody judges you for being hacked.

How did they get in? (So you can stop it happening again)

In the vast majority of cases, it’s one of three things. Password reuse — your password leaked in an old breach and was tried against your email. Phishing — you clicked a convincing fake login page at some point. Or malware — a keylogger on your device captured the password as you typed it. The defences map directly: unique passwords via a manager (see setting up a password manager for your family), 2FA everywhere, and a malware scan of your devices.

For authoritative UK-specific guidance, the National Cyber Security Centre’s hacked-email guidance is clear and practical. And if the hack has led to financial fraud, report it to Action Fraud on 0300 123 2040 — and tell your bank immediately.

What if you can’t get back in?

Sometimes the hacker was faster than you, and the standard recovery options fail. Don’t despair — you still have moves. First, use the provider’s dedicated account recovery form rather than the basic password reset: Google’s and Microsoft’s forms let you provide extensive proof of ownership (old passwords you remember, when you created the account, frequent contacts, labels or folders you’ve set up). People are often surprised what gets accepted.

If that fails, contact the provider’s support directly — Google, Microsoft, and Yahoo all have hacked-account support flows that escalate beyond the automated form. Be prepared to verify your identity with photo ID. While you’re locked out, work on damage control: warn your bank and any financial services that your email may be compromised, so they can flag your accounts for extra verification. And if recovery ultimately proves impossible, create a brand-new email address and systematically move your important accounts to it, starting with banking — then close or abandon the compromised address. It’s a painful afternoon, but a clean break beats an account you can never trust again.

One final habit worth building: set a calendar reminder to review your email security once a year. Check the recovery options are still yours, glance at the active sessions, and confirm 2FA is still enabled. Email providers occasionally change settings during updates, and a yearly five-minute check catches anything that’s drifted. It’s the digital equivalent of checking your smoke alarm batteries — boring, quick, and the thing you’ll be glad you did.

The takeaway: act fast on recovery, then ruthlessly purge the hacker’s footholds (recovery details, sessions, forwarding rules), secure your other accounts starting with banking, and finally fix the root cause with unique passwords and two-factor authentication. Most hacked inboxes are fully recoverable — but only if you’re thorough about step two.