Email hacked? What to do in the first hour, step by step

Your email is the master key to most of your other accounts: every "forgot password" link lands there. Someone in your inbox can reset your bank, shopping and social logins, read old receipts and statements for personal details, and email your contacts as you to ask for money or gift cards. So work through this in order, and do it from a device you trust. If you think your computer itself is infected, use your phone or another computer, and see how to remove malware afterward.

Signs your email has been taken over:

• Your password no longer works, or the recovery phone or email has changed.
• Contacts say they received strange messages from you.
• Sent mail you did not write, or emails missing from your inbox.
• Security alerts about sign-ins from a new device or location.
• Password reset emails for other accounts that you did not request.

Search results and emails offering "account recovery services" are a common scam. Type these addresses yourself:

• Gmail and Google: accounts.google.com/signin/recovery. Answer as many questions as you can from the device and location you usually use.
• Outlook.com, Hotmail and Microsoft: try the password reset at account.live.com/password/reset; if the security info was changed, use the recovery form at account.live.com/acsr from a different working email address, with as much account history as you can remember.
• Yahoo: use the Sign-in Helper linked from Yahoo's help pages.
• iCloud and Apple Account: reset at iforgot.apple.com, or change the password from a trusted Apple device in Settings. Apple says account recovery has a waiting period that can last days (Apple's compromised account guide).

1. Change the password to a new, long one you have never used anywhere (see how to create a strong password).
2. Sign out everywhere else. Google lists your devices under Security, where you can remove any you do not recognize; Apple lists them at account.apple.com; Microsoft and Yahoo show recent activity and signed-in sessions in their security pages.
3. Turn on two-factor authentication, ideally with a passkey or security key rather than text messages. Our 2FA guide shows how.
4. Review security events and mark anything you did not do. Google asks you to answer "No, it wasn't me" for events you do not recognize.

Many attackers do not just read your mail once. They set up quiet ways to keep reading it after you change the password. Google's secure a hacked account page tells you to remove any mail delegation, automatic forwarding, IMAP or POP access and filters you did not set up, and to check the address on outgoing mail. The same checks apply to every provider:

• Forwarding: a rule sending copies of your mail to an unknown address.
• Filters and rules: rules that delete, archive or mark as read messages from your bank, or that move security alerts out of sight.
• Reply-to and "send mail as": an altered reply-to address sends your contacts' answers to the attacker.
• Delegates and connected apps: other accounts or third-party apps granted access to your mailbox.
• Recovery phone and email: confirm they are yours. Apple adds a step worth copying: check with your phone carrier that no SMS forwarding has been set up on your number.
• Signature and auto-reply: occasionally changed to include a scam link.

Search your inbox for "password reset", "verify your email" and "new sign-in" to see what the attacker may have touched. Then change passwords, in this order:

1. Banks, credit cards, payment apps and investment accounts. Call the bank if you see anything unusual.
2. Your Apple, Google or Microsoft account if it is different from the hacked email.
3. Amazon and other shops that store a card.
4. Social media, which is often used next to scam your friends.
5. Cloud storage, which may hold scans of IDs and tax returns.
6. Every account where you used the same password as the hacked email.

A password manager makes this a one-evening job instead of a week. If you reused a password widely, this is the moment to start one; see the password manager comparison.

• Warn your contacts that messages from you in the last few days may be fake, especially any asking for money, gift cards or a code.
• Report fraud to the FTC at ReportFraud.ftc.gov.
• If personal details were used to open accounts or file taxes in your name, follow the recovery plan at IdentityTheft.gov and consider freezing your credit at Equifax, Experian and TransUnion. Our identity theft guide walks through it.
• If it was a work account, tell your IT team immediately; attackers use a compromised work inbox for payment fraud. See business email compromise.

How did it happen? Most email takeovers start with a reused password from another site's breach or a phishing page. Check your addresses in a breach checker, and read how to spot phishing emails. Then take the five-minute self-check.