The short answer
Change your email password right away from a device you trust, sign out of all other sessions, and turn on two-factor authentication. Then check your recovery phone and email, forwarding rules and filters, which hackers often change. If you're locked out, use your provider's official account recovery page, not a “support” number from a search ad.
Your email is the key to almost everything else. Whoever controls it can reset the passwords to your bank, shopping and social accounts. So if you think it’s been hacked, it’s worth acting quickly and in the right order.
Signs your email was hacked
- Emails in your Sent folder that you didn’t write.
- Friends say they got strange messages or money requests from you.
- Security alerts about sign-ins from new devices or locations.
- Password-reset emails for other accounts you didn’t request.
- Your password stops working.
If you can still sign in: do this now
Work from a device you trust and that’s up to date, ideally not the one you think might be infected.
- Change your password to a long, unique one you’ve never used before. A passphrase of five random words works well. See how to create strong passwords.
- Sign out of all other sessions. Most providers have a “sign out of all devices” option in the security settings.
- Turn on two-factor authentication if it wasn’t on. An authenticator app or passkey is stronger than text codes. See our 2FA guide.
- Check recovery details. Make sure the recovery phone number and backup email are yours. Hackers often change them so they can get back in later.
- Check forwarding rules and filters. Attackers set up rules that quietly forward your mail to them or delete security alerts. Remove anything you didn’t create.
- Review connected apps and remove any you don’t recognize.
If you’re locked out
- Use the official recovery page of your provider (Google, Microsoft, Apple, Yahoo and others). Find it by typing the provider’s web address yourself.
- Answer the recovery questions on a device and network you’ve used before. That helps the provider recognize you.
- Don’t call numbers from search ads offering “email support.” The FTC warns that scammers pose as tech support to get remote access and money.
Then secure everything connected to it
Once your email is back under your control:
- Change passwords for your bank, payment apps, shopping and social media accounts, especially any that used the same password.
- Check for unexpected orders, payments or account changes.
- Tell your contacts not to trust messages sent from your account during the hack.
- Scan your devices with up-to-date security software.
If the hacker used your account for scams
If messages asked friends for money or gift cards, warn them right away. If you lost money or think your identity is at risk, report it at ReportFraud.ftc.gov and use IdentityTheft.gov for a recovery plan. Consider a credit freeze at the three credit bureaus if personal documents were in your inbox.
How it probably happened
The most common causes are a reused password that leaked from another site, a phishing email that captured your login, or malware on a device. Using a password manager and passkeys helps prevent the next one.
Related guides
Going forward, keep a different password for every account in a password manager, and consider passkeys where they’re offered.
The bottom line
Change the password, kick out other sessions, turn on two-factor authentication and check your recovery details and forwarding rules. Do those four things first and you’ll close most of the doors a hacker can use.
Frequently asked questions
How do I know if my email was hacked?
Common signs are messages in your Sent folder you didn't write, friends getting strange emails from you, password-reset emails for other accounts, security alerts about new sign-ins, or your password suddenly not working.
Should I call a support number to recover my account?
Only use recovery pages and contact details from your email provider's official website. Search ads for “Gmail support” or “Outlook support” numbers are a common trap for tech support scams.
Do I need to tell my contacts?
Yes, if messages were sent from your account. Let them know not to click links or send money in response to anything that came from you during the hack.
Why you can trust this guide
- Based on official sources. The steps here are checked against the 3 official sources listed below, such as the help pages of the companies involved.
- Checked and dated. Last checked on November 10, 2026. We update guides when software or advice changes.
- Independent. No company paid for or reviewed this guide. We don't sell products, and ads never influence our advice.
- Open to corrections. Spotted an error? Tell us and we'll fix it. Read how we research.
Sources
- Federal Trade Commission — How To Recover Your Hacked Email or Social Media Account
- Google Account Help — Secure a hacked or compromised Google Account
- CISA — Turn On Multifactor Authentication
This guide is general information. Menus and features can change with software updates, and steps may differ on your device or version. Back up important data before making big changes. Read our disclaimer.
