What to Do If Your Email Account Gets Hacked

Hacked email account? Act fast with these steps to regain control, secure your data, and prevent more damage.

3 min read · 7 steps · Checked April 2026

1. Step 1. Try to sign in to your email account right now

   Go to your email provider's website (gmail.com, outlook.com, yahoo.com) and try your regular password. If it works, the hacker may not have changed your password yet. Move quickly through the next steps before they do.

   Quick Tip

   If you can still sign in, scroll through your Sent folder. Hackers often use hacked email accounts to send spam or scam messages to your contacts. Your contacts may have already received suspicious emails from you.

2. Step 2. Change your password immediately

   If you can sign in: look for Settings > Security > Change Password and create a new, strong password. Make it at least 12 characters with a mix of letters, numbers, and symbols. If you cannot sign in because the hacker changed your password, click "Forgot Password" or "Recover Account" to start the account recovery process.

   Quick Tip

   For Gmail recovery, visit myaccount.google.com/security. For Outlook/Hotmail, visit account.live.com/acsr. For Yahoo, visit login.yahoo.com/account/challenge/forgot-password.

3. Step 3. Turn on two-step verification

   Once you regain access, turn on two-step verification (also called two-factor authentication). This means even if a hacker gets your password, they still cannot get in without a code sent to your phone. In Gmail: Settings > Security > 2-Step Verification. In Outlook: account.microsoft.com > Security > Advanced Security Options.

   Warning

   Two-step verification is the single most important thing you can do to prevent future hacking. Turn it on today — it only takes 5 minutes to set up.

4. Step 4. Check what the hacker may have done

   Look through your account for: emails sent from your account that you did not write, your email recovery phone number or backup email changed to an unfamiliar address, apps or services connected to your email that you don't recognize, and your mail forwarding settings (sometimes hackers forward copies of your emails to themselves).

5. Step 5. Change passwords on your other accounts

   Your email is the master key to your other accounts — password reset emails go to your inbox. Change the password on any important account that uses your email to sign in: your bank, Amazon, PayPal, Social Security portal, health insurance, and any other financial accounts.

   Warning

   If you use the same password on multiple sites, change all of them. A hacker who gets one password will try it on your bank, Amazon, and every major service.

6. Step 6. Tell your contacts what happened

   Send a message to your contacts letting them know your email was hacked and they should delete any unexpected messages they received from you recently. This protects them from falling for any scam emails the hacker may have sent from your account.

7. Step 7. Report the hack to the FTC

   Report the incident to the FTC at IdentityTheft.gov — this gives you a personalized recovery plan and formal documentation of the event. If you believe your identity was stolen (Social Security number, bank account), IdentityTheft.gov will walk you through every step of recovery.

   Quick Tip

   The FTC's identity theft recovery website is free and gives you a step-by-step checklist tailored to your situation. Visit IdentityTheft.gov.