Your Email Was Hacked: The First Hour
Friends are getting strange messages from you, your password stopped working, or there are sent emails you never wrote. Someone has been inside your mailbox. Your email is the key to almost every other account you own, so what you do in the next hour matters more than usual.
If you read nothing else, do two things: from a device you trust, take the account back and change the password, then look for the forwarding rule they almost always leave behind. Everything below is the detail, in the order it matters.
An email account is not just mail. It is where every “forgot password” link goes, for your bank, your Amazon account, your phone carrier and everything else. Whoever controls the mailbox can reset all of them. That is why the attacker wanted it, and why it comes first.
First: Is It Really Hacked?
Some things that look like a hack are not. Spam that shows your address as the sender is often forged and never touched your account; if it is not in your own Sent folder, that may be all it is. A security alert email asking you to click a link and “verify your account” is itself a common phishing trick. Never click it. Open the email site or app the way you normally do and check its security page there.
These, on the other hand, mean someone was in:
- Messages in your Sent folder that you did not write.
- Your password stopped working and you did not change it.
- Your recovery phone number or backup email address changed.
- Mail you expected never arrived, or replies vanish.
- The account’s recent activity page shows sign-ins from places or devices that are not yours.
The First Hour, In Order
Use a different device if you can
If you think your computer itself might be infected, or you recently let a stranger connect to it, do this from your phone or another computer. A new password typed on an infected machine can be stolen again in minutes. If that is your situation, read A Scammer Had Remote Access to Your Computer too.
Get back in and change the password
If you can still sign in, change the password now to something new and long that you have never used anywhere else. If you are locked out, go straight to the provider’s own recovery page, listed in the next section, and nowhere else.
Sign out every other session
Changing the password does not always throw out someone who is already signed in. Google, Microsoft, Apple and Yahoo all list signed-in devices on the account’s security page, with a way to sign them out. Remove every device you do not recognize, or sign out of everything and sign back in on your own devices.
Fix the recovery phone and backup email
Attackers often swap in their own number or address so they can take the account back after you change the password. Check both, and correct anything that is not yours.
Hunt for forwarding rules and filters
This is the step people skip, and it is the one that matters most. A rule that quietly forwards your mail to an outside address, or files bank and password reset emails straight into the trash, lets the attacker keep reading even after you lock them out. The next section shows where to look.
Turn on a second factor
A passkey or an authenticator app, so a stolen password on its own is no longer enough. Our two-factor guide explains the options, and Passkeys, Explained covers the strongest one.
Warn the people they wrote to
Send a short note, or a text, to anyone in your Sent folder from the time it happened. Tell them to ignore anything that asked for money, gift cards, a payment change or a click, and to delete it. Most hijacked mailboxes are used to scam the owner’s own contacts, because a message from you is one they trust.
Check what this email unlocks
Look through the inbox, Sent and Trash for password reset emails, new account notices and purchase confirmations you did not expect. Then change the passwords on your bank, your phone carrier, Amazon, PayPal and anything else that uses this address, starting with the ones that hold money. Your Password Was in a Breach has the order to do them in.
Find out how they got in
Usually it is a password reused from another site, or one typed into a fake sign-in page. If the password was unique and you never entered it anywhere strange, have the computer checked for malware before you trust it again.
Where the Hidden Settings Are
The names move around a little when providers redesign their settings, but these are the places to look. Check every one, even if the account looks normal.
| Provider | What to check |
|---|---|
| Gmail | On a computer, open the gear icon, then “See all settings.” Check the “Forwarding and POP/IMAP” tab for a forwarding address, “Filters and Blocked Addresses” for any filter you did not make, and “Accounts and Import” for anyone granted access to your account. Then run Google’s Security Checkup from your Google Account. |
| Outlook.com and Hotmail | In Settings, under Mail, check “Forwarding” and “Rules.” Then open your Microsoft account’s security page and review recent activity. |
| iCloud Mail | At iCloud.com, open Mail settings and check forwarding and rules. On your iPhone, Settings, then your name, shows every device signed in to your Apple Account. |
| Yahoo Mail | In Settings, under More Settings, check Mailboxes for forwarding and Filters for rules. Recent activity is in your Yahoo account’s security settings. |
| Everywhere | Look at your signature and automatic reply. Attackers sometimes add a link to them so every message you send carries it. |
If You Are Locked Out
Use the provider’s own recovery page, typed in by hand. Answer as many questions as you can, from a device and location you have used before, since that helps the provider recognize you.
| Provider | Recovery page |
|---|---|
| Google and Gmail | g.co/recover |
| Microsoft: Outlook.com, Hotmail, Live | account.live.com/acsr |
| Apple and iCloud | iforgot.apple.com |
| Yahoo | Yahoo’s Sign-in Helper, linked from the Yahoo sign-in page |
Do not search for a phone number to call. Google and Microsoft do not offer phone support to get a free personal account back, and the “account recovery” numbers that come up in search results are a well-worn scam. The same goes for anyone who contacts you offering to recover the account for a fee.
What Not To Do
- Click the link in a “suspicious activity” email. Go to the site yourself.
- Abandon the account and start a new one. Every service tied to the old address can still be reset through it. Take it back first, then move things over slowly if you want to.
- Delete the account in a panic. You lose the ability to see what was sent and to reset the accounts linked to it.
- Pay a stranger to “recover” it.
- Reuse the new password anywhere else.
If It’s a Work Email
Tell whoever handles your IT the same hour, and do not quietly fix it yourself. A hijacked business mailbox is how most fake invoice and wire fraud cases start: the attacker reads along for a while, then sends a customer or vendor new payment instructions from your real address, in a real conversation. On Microsoft 365 and Google Workspace, an administrator can end every session, check for rules and connected apps across the whole mailbox, and see what was read. Anyone you invoice, or who invoices you, should hear from you by phone that any payment change needs a call to confirm. Our email services page covers how we handle compromised business accounts.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Has the password been changed, from a device you trust? | Do that first |
| Are other sessions signed out? | Next, from the security page |
| Have you checked forwarding, filters and rules? | This is the one they rely on |
| Are the recovery phone and backup email yours? | Fix them before you stop |
| Does the account have a passkey or authenticator app? | Add one today |
Want Someone To Go Through It With You?
We’ll check the account’s rules, sessions, recovery details and connected apps, set up a second factor properly, and tell you whether the computer needs a closer look. Usually done remotely in about an hour, at $125 an hour for home accounts, billed in 15-minute increments. If you’re locked out, we can walk you through the provider’s recovery process, though only the provider can hand the account back.
Frequently Asked Questions
I changed my password. Am I safe now?
Not yet. A new password does not always sign out someone already in, and it does nothing about a forwarding rule or a changed recovery phone number. Sign out every other session, check forwarding, filters and rules, confirm the recovery details are yours, then add a second factor.
My friends got an email from me asking for gift cards. Was I hacked?
Check your Sent folder. If the message is there, someone was in your account, so follow the steps above. If it is not, your address was probably forged, or a lookalike address was used, and your account itself may be fine. Either way, tell those friends not to send anything.
Can I call Google or Microsoft to get my account back?
For a free personal account, no. Recovery happens through their online forms: g.co/recover for Google, account.live.com/acsr for Microsoft. Phone numbers in search results claiming to be their account support are a common scam. Business accounts are different: your Microsoft 365 or Google Workspace administrator can reset access directly.
Should I just delete the account and start over?
Not right away. Your bank, phone carrier and shopping accounts still send password resets to the old address, so whoever controls it can take those over. Take the account back first. If you still want a fresh address afterward, move each service to it one at a time, then keep the old account secured rather than deleting it.
Related guides
Cut the connection, call the bank from another device, and what to check before that computer goes back online.
The first hour after a breach notice: what to change, in what order, and what to check.
Lock it, protect the accounts on it, and suspend the line, in the right order.
Getting the fake Microsoft alert off your screen without calling the number.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service