Something felt off the morning a friend texted me asking why I’d “sent” her a link to a sketchy crypto site. I never wrote that message — and that single odd report is one of the clearest signals that an email account has been hacked. The faster you act on a signal like that, the better your odds of getting full control back. The first hour after you notice something wrong decides whether this is a minor scare or a lasting breach.
Email is the master key to your digital life. A hacker who controls your inbox can reset passwords on your banking, social media, and cloud storage in minutes. Knowing the warning signs and having a clear recovery order makes all the difference.
Quick Answer
If your email account is hacked, change your password immediately, sign out of all active sessions, and turn on two-factor authentication. Then check your security log for unfamiliar devices and remove any forwarding rules the attacker added. Acting within the first hour gives you the best chance to reverse the damage before you’re locked out.
What Are the Warning Signs of a Hacked Email Account?
The signals fall into two groups: things you can see in your own inbox, and alerts the provider sends you. I treat any one of them as a reason to start the recovery steps below, because waiting to “be sure” is exactly what attackers count on.
Signs Inside Your Inbox
- Your password stops working. If you’re suddenly locked out of an account you didn’t change, an attacker may have reset the password to cut you off.
- Sent messages you never wrote. Open your Sent folder now. Links or money requests you didn’t write mean someone else is using your account. A suspiciously empty Sent folder is also a red flag, since attackers often delete their tracks.
- Contacts report spam from you. When someone asks “Did you send this?” about a message you never wrote, that’s a firm indicator. Hijacked accounts are valuable precisely because recipients trust a familiar address.
- Altered inbox or new filters. Folders you didn’t create, missing emails, or filters silently forwarding mail elsewhere mean the attacker is actively monitoring you.
Signs From Your Provider
- Unexpected login or security alerts. Any notice about a password change, new recovery address, or new device sign-in you didn’t start is an emergency.
- Unfamiliar locations in your sign-in log. Gmail, Outlook, and Yahoo all log sign-ins by location and device. A login from a city you’ve never visited is a strong sign of compromise.
- Recovery options you don’t recognize. If your backup phone or recovery email was changed, an attacker is already working to block your way back in.
Any single one of these signs is enough to start the recovery steps below right away.
How Do I Recover a Hacked Email Account?
Act in this exact order. When my own account was probed last year, doing these in sequence — rather than panicking and resetting one random password — is what got me back in clean. Speed matters, but order matters more.
- Change your password now. Use a unique password of at least 12 characters mixing letters, numbers, and symbols. Never reuse one from another account.
- Sign out of all active sessions. In Gmail, click Details at the bottom of your inbox, then Sign out of all other sessions. In Outlook, go to Security > Where you’re signed in and select Sign out everywhere. My walkthrough on how to find and remove unknown logins on Google, Microsoft, and Apple shows every screen.
- Verify and restore your recovery info. Check that your backup phone number and recovery email are yours. Remove anything you don’t recognize.
- Enable two-factor authentication. This one step blocks the vast majority of future takeovers. My guide on setting up two-factor authentication on your most important accounts covers Gmail, Microsoft, and more.
- Delete unauthorized forwarding rules. In Gmail: Settings > See all settings > Forwarding and POP/IMAP. In Outlook: Settings > Mail > Forwarding. Remove any address you didn’t add.
- Scan for malware. If a keylogger captured your password, changing it won’t help while the malware runs. A free scan takes about 10 minutes — see my steps to remove malware from Windows 11.
- Secure every linked account. Change passwords on every service that uses your compromised email for login or password resets — especially banking, shopping, and social media.
Working top to bottom locks the attacker out first, then closes every door they could come back through.
Which Recovery Page Should I Use for My Provider?
Each provider has its own recovery path and a different first step. Bookmark the right one before you need it — when I was helping my dad recover his Outlook account, hunting for the correct URL wasted ten stressful minutes we didn’t have.
| Provider | Recovery Page | Key First Step |
|---|---|---|
| Gmail | accounts.google.com/signin/recovery | Verify backup phone or recovery email |
| Outlook / Microsoft | account.live.com/acsr | Identity verification form |
| Yahoo Mail | login.yahoo.com/forgot | SMS code or recovery email |
| Apple iCloud | iforgot.apple.com | Trusted device or recovery key |
| ProtonMail | proton.me/support | Recovery phrase (set up in advance) |
If recovery fails and you’re fully locked out, both Google and Microsoft offer identity verification using a government-issued ID — look for “More options” or “Verify your identity” on the recovery page. That process typically takes one to three business days.
Knowing your provider’s exact recovery URL and first step saves the minutes that decide whether you get back in.
How Did the Attacker Get In?
Figuring out the entry point stops the breach from repeating. Most hacks I’ve helped friends untangle trace back to a reused password exposed in an old data breach, not some movie-style hacking feat.
Check your address at Have I Been Pwned, a free service that shows whether your credentials appeared in a known breach. It takes under 30 seconds and often reveals exactly how you were exposed. From there, my guide on what to do when your password may already be stolen walks through closing those gaps.
Most takeovers start with a leaked, reused password — find the leak and you find the door to lock.
Common Mistakes to Avoid
- Waiting to act. Every hour you delay lets the attacker lock you out or pivot to linked accounts. Fix: treat any warning sign as urgent — you can always undo a change if it was a false alarm.
- Reusing the new password elsewhere. If your credentials leaked, every account sharing that password is at equal risk. Fix: set a unique password per service, ideally with a password manager.
- Skipping the forwarding-rules check. A silent forwarding rule keeps feeding the attacker your mail even after a password change. Fix: inspect Settings > Forwarding right after any breach.
- Clicking links inside the alert email. The “alert” itself may be phishing built to steal your new password. Fix: type your security settings URL directly instead of clicking.
- Forgetting linked accounts. Your inbox is the reset address for banking, shopping, and social media. Fix: audit and update those passwords the same day.
Frequently Asked Questions
How fast do I need to act after spotting a sign?
Within the first hour if you can. The sooner you change the password and sign out other sessions, the less time the attacker has to grab your recovery options. When my friend’s account was hit, she reacted within 20 minutes and lost nothing; a coworker who waited a day found his recovery email already swapped out.
Will changing my password kick the hacker out instantly?
Usually yes, but only if you also sign out all other active sessions. A changed password alone can leave an existing logged-in session alive on the attacker’s device. I always do both back to back — change the password, then force “sign out everywhere.”
Should I tell my contacts the account was hacked?
Yes, briefly. A short heads-up stops them from clicking spam sent in your name. After I cleaned up my account, I sent one line — “ignore any odd links from me today, I’ve fixed it” — and that ended the confusion immediately.
Do I need to factory reset my computer after an email hack?
No, a full reset is rarely necessary. Start with a free malware scan to rule out a keylogger; only consider a reset if scans keep flagging active infections. In most cases I’ve seen, the breach was a stolen password, not malware on the device.
Conclusion
Catch a hacked email account early and most people recover full access in under an hour. Change your password, end all sessions, restore recovery info, enable two-factor authentication, and clear forwarding rules — in that order. For your next layer of defense, learn to check if a website is actually safe before you ever type a password into it.