Quick answer
If your email account has been hacked, first try to log in and change your password, then enable two-factor authentication and check your recovery settings. Notify your contacts and review active sessions and email forwarding rules to stop abuse.
How to recognize the problem
- You cannot log in to your email account because the password does not work
- Recipients receive strange messages from your address
- Messages are missing or unknown folders appear
- Account settings have been changed without your knowledge
- You receive notifications about logins from unknown devices
Most common causes
Phishing
Scammers tricked you into entering your password on a fake page that looks like your email provider's page.
Weak or reused password
You used the same password on multiple services, so it leaked from one of them and was used to access your email.
Malware on the device
Malicious software stole your login credentials or session from the browser.
Lack of 2FA
You did not have two-factor authentication enabled, so the attacker only needed your password.
Compromised recovery
The attacker changed the phone number or backup email for recovery, making it harder for you to regain access to your account.
Step-by-step fix
- 1
Try to log in and change your password
If you can still access your account, change your password immediately. Go to account settings and select the option to change your password. If you cannot log in, use the "Forgot password" option and follow the recovery instructions.
- 2
Enable two-factor authentication
After changing your password, enable 2FA. In security settings, find the two-factor authentication option and choose an app to generate codes or SMS. If you already have 2FA, check that your devices and numbers are still correct.
- 3
Check your account recovery settings
In account settings, check that your phone number and backup email are correct. Remove any unknown numbers or addresses that the attacker may have added. If you cannot access these settings, contact your provider's support.
- 4
Review active sessions and devices
In security settings, find the list of devices or sessions where the account is logged in. Log out of all devices you do not recognize. This prevents the attacker from continuing to use your account.
- 5
Remove forwarding rules and signatures
Attackers often set up rules to forward all messages to themselves or to hide them. In mail settings, find forwarding, filter, and signature options and remove anything you did not set up.
- 6
Notify your contacts
Send a message to people in your address book that your account has been hacked and that they should ignore suspicious messages. Advise them not to open links or attachments from those messages. This reduces the risk of them also becoming victims.
- 7
Scan your computer for malware
Run a scan on your computer with antivirus software. If you suspect an infection, also use a malware removal tool. Before cleaning, make a backup of important data, then clean your browser of unknown extensions.
- 8
Change passwords on other services
If you used the same password elsewhere, change it everywhere. Prioritize banking accounts, social media, and shopping services. Use unique passwords for each service.
If you cannot restore access
If you cannot restore access on your own or the account remains locked, contact your provider's support with as much proof of ownership as possible (invoices, old messages, payment information). In the meantime, notify business contacts and change passwords on connected services. If it is a business account, the administrator can reset the password and remove suspicious sessions. For additional protection, consider using a password manager and regularly backing up important messages.
How to prevent it
- Use unique and strong passwords for each account
- Enable two-factor authentication wherever possible
- Do not enter your password via links in messages; open the website directly
- Regularly check active sessions and recovery settings
When to call a professional
If you cannot restore access or the account is a business account with sensitive data, contact IT support or your system administrator. They can reset the account faster and prevent further abuse.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How do I know my email has been hacked?
Signs include being unable to log in, messages your contacts receive from your address, unknown devices in the session list, and changes in account settings. Contact only the provider's official support.
Is changing the password enough?
No, you need to remove the attacker from active sessions, check recovery settings and forwarding rules. Also enable 2FA and scan your device for malware.
What if the attacker changed my recovery phone number?
Contact your provider's support with proof of account ownership. They can reset the recovery information and restore your access.