Hacked Email: How to Recover Your Account

Your email is not just another account. It is where password resets for your bank, social media and shopping accounts are sent, so whoever controls it can quietly take over the rest. That is why getting it back, and locking it down properly, comes before anything else. Here is how to do it.

Signs your email has been hacked

• Your password suddenly stops working.
• Alerts about sign-ins from new devices or places you do not recognise.
• Contacts receive messages from you that you did not send.
• Emails are missing, or appear in your sent folder without your knowledge.
• Password reset or "new sign-in" emails from other services you did not request.

If you can still sign in

Act immediately, from a device you trust:

1. Change the password to a long, unique one you have never used elsewhere.
2. Turn on two-step verification. An authenticator app, a passkey or a security key is stronger than a text message code.
3. Sign out of all other sessions in the security settings.
4. Then work through the checklist in "Once you are back in", below.

If you are locked out

Gmail and Google accounts

Go to Google's account recovery page (accounts.google.com/signin/recovery) and follow the steps. Google's own advice is to answer as many questions as you can rather than skipping them, to use a device and location where you have signed in before, and to check your recovery email's spam folder for messages from Google.

Outlook, Hotmail and Microsoft accounts

Start with the "Forgot password" option on the Microsoft sign-in page. If you no longer have access to the recovery phone or email, use Microsoft's account recovery form at account.live.com/acsr, and give as much detail as you can, such as old passwords you remember and subjects of recent emails.

Other providers

Yahoo, Apple iCloud and other providers have their own recovery pages. Find them by typing the provider's web address yourself or through its official app, never through a link in a message or a search advert.

Once you are back in: the checklist

Attackers rarely just read email. They often set things up to keep access or hide what they are doing. Check each of these:

Then secure everything connected to it

1. Change passwords on accounts that reset through this email, starting with banking, payment apps and social media.
2. Change any password you reused anywhere else.
3. Check your financial accounts for changed details or unfamiliar transactions.
4. Warn your contacts, especially if messages were sent in your name asking for money or clicks.
5. Check your devices for malware if you cannot explain how the attacker got your password.

If you cannot get it back

Sometimes recovery fails. If so, create a new account with strong protections, move your important accounts to the new address one by one, and tell your contacts the old address is no longer yours. Report the account as compromised to the provider so it can be locked, and report any fraud to your national service.

How it usually happens, and how to prevent it

Most email takeovers start with a stolen or reused password, often from a phishing page or an old data breach, or with a code the victim was tricked into sharing. A unique password, strong two-step verification and a habit of never sharing codes stop most of them. If you ever receive a sign-in code you did not ask for, someone may be trying to get in. Do not share it, and change your password.

Email is one part of a bigger picture. Our complete guide to identity theft and account security covers passwords, two-step methods, data breaches and a quarterly checkup.

Frequently asked questions

Sources

1. Tips to complete account recovery steps, Google Account Help
2. Microsoft account recovery form, Microsoft
3. Recovering a hacked account, UK National Cyber Security Centre
4. How To Recover Your Hacked Email or Social Media Account, US Federal Trade Commission
5. Activate 2-step verification on your email, UK National Cyber Security Centre