Email Account Hacked? What to Do Right Now (Gmail, Outlook, iCloud)

The first sign is often a message from a friend: "Did you just email me?" Or you try to sign in and your password no longer works. A hacked email account is worrying because it's the key to so much else: password resets for your bank, shopping and social media accounts all go to your email.

Step 1: Get Back Into the Account

If you can still sign in, change the password immediately. If you can't, use the provider's official recovery page, typed directly into your browser rather than from a link in an email:

• Gmail: accounts.google.com/signin/recovery
• Outlook and Hotmail: account.live.com/acsr
• iCloud: iforgot.apple.com

Answer as accurately as you can. Using a device and location you've signed in from before helps prove it's you.

Step 2: Lock the Attacker Out

1. Change the password to a long one you've never used before.
2. Sign out of all other sessions. Gmail, Outlook and iCloud all let you see where the account is signed in and sign out everywhere else.
3. Check the recovery email and phone number. Attackers often change these so they can get back in.
4. Look for forwarding rules and filters. A hidden rule can quietly forward your emails to the attacker or delete replies.
5. Turn on two-step verification, ideally with an authenticator app.

Step 3: Check What Else Is at Risk

• Other accounts with the same password: change them all, starting with banking and shopping.
• Your sent folder: see what was sent in your name.
• Your bank: if you see anything unusual, or bank details were in your emails, call your bank straight away.
• Your devices: run a security scan in case a password was stolen by malware.

Step 4: Warn Your Contacts

Let friends and family know your account was hacked, so they ignore any strange messages, especially requests for money or gift cards.

How It Usually Happens

• A password reused on a website that was later breached
• A fake sign-in page from a convincing email or text
• No two-step verification on the account

A password manager and two-step verification prevent almost all of these. Our guide to spotting scam calls, texts and emails shows what fake messages look like.

How We Handle It

We can help you recover the account, remove anything the attacker set up, secure your other accounts, set up a password manager and two-step verification, and check your devices, at home or remotely. See computer and device help or remote tech support.

Related Reading

• WhatsApp Hacked? Verification Code Scams Explained
• Fake Virus Warning Pop-Up? Don't Call the Number
• Why Every Small Business Needs a Password Manager