First Steps After an Email Account Is Hacked
Email compromise can enable password resets across many services, so recovery should include rules, sessions, forwarding, and connected apps.
Who this guide is for
People who see unfamiliar sent mail, login alerts, password changes, or recovery settings.
Practical checklist
- Use the provider’s official recovery process and change the password from a trusted device.
- Sign out other sessions and remove unknown devices, passkeys, app passwords, and connected applications.
- Inspect forwarding, filters, delegates, signatures, and recovery phone or email settings.
- Secure accounts that use the mailbox for password reset, beginning with financial and cloud services.
- Warn affected contacts and preserve evidence of fraud or impersonation.
Common mistake to avoid
Changing the password without removing attacker-created forwarding rules and active sessions.
A safer way to proceed
Recover email from a clean device, close persistence paths, then secure dependent accounts.
Product features, prices, eligibility, and policies can change. Confirm important details on the provider’s official website before purchasing, renewing, changing account settings, or acting on a security alert. If an incident may involve financial loss, sensitive personal data, or a business network, consider qualified professional help and the appropriate official reporting channel.