How to Recover a Hacked Email Account Step by Step

The first sign is usually small. A friend texts to ask why you sent them a link to a "shared invoice". Or you open your inbox and find nothing in it, because someone set up a rule that forwards everything and deletes the original. By the time you notice, the attacker has often had access for days.

Knowing how to recover a hacked email account quickly matters more than for any other login, because your email is the reset button for almost everything else you own online. This guide covers the order that actually limits the damage: get back in, throw the attacker out, close the doors they left open, then check what else they touched. Work through it in one sitting if you can; the whole process takes about an hour.

Signs Your Email Account Was Hacked

Not every odd email means a breach. These signs, especially in combination, are the ones worth acting on:

Messages in your Sent folder that you did not write, often with short text and a link.
New filters or forwarding rules you never created.
Password reset emails from services you did not request.
A login alert from a city or country you have not been to.
Your recovery phone number or backup email has changed.
Contacts receiving spam that appears to come from you.

Spoofed spam is different. If people get junk that shows your address but nothing appears in your Sent folder and your settings are untouched, someone is faking the sender field. Annoying, but your account itself is probably fine.

Recover a Hacked Email Account in the First 15 Minutes

Speed matters here. Do these steps from a device you trust, ideally not the one you suspect was compromised.

Try to log in. If your password still works, change it immediately to a long, unique passphrase you have never used anywhere.
If you are locked out, use the official recovery form. Go directly to your provider's sign in page and choose "forgot password". The process asks for old passwords, when you created the account and recovery contacts. Answer from a device and network you have used before; providers trust familiar devices more.
Sign out every other session. Most providers have a "sign out of all devices" option in the security settings. Use it right after changing the password.
Turn on two step verification. Use an authenticator app or a hardware key rather than text messages if you can.

Ignore any email or text that offers to "help restore your account". Attackers watch for victims at exactly this moment and send fake recovery messages. Our guide on spotting phishing emails covers the patterns they use.

Close the Doors the Attacker Left Open

Changing the password is not enough. A careful attacker sets up quiet ways back in, and these survive a password change.

Forwarding and filters

Open the settings and check every filter and forwarding address. A common trick is a rule that sends any message containing "password", "bank" or "verify" to a hidden folder or an outside address. Delete anything you did not create.

Recovery details

Confirm the recovery phone number and backup email are yours. If the attacker replaced them, they can reset your new password tomorrow.

Connected apps and app passwords

Review third party apps with access to your mailbox and revoke anything unfamiliar. Older "app passwords" for mail clients also bypass two step verification, so remove any you do not actively use.

Signature and auto reply

Some attackers add a link to your signature or vacation reply. Check both.

Why Changing Only the Password Often Fails

The usual advice after a hack is "change your password". People do exactly that, feel relieved and get hit again a week later. Three reasons this happens:

The forwarding rule kept copying their mail to the attacker, who used it to reset the new password through another service.
The device used to log in was infected, so the new password was captured as soon as it was typed.
The same password was used on other sites, and the attacker simply logged back in through a linked account.

A password change is one step in a sequence, not the fix. If you skip the settings review, you have locked the front door while the back window stays open. And even with two step verification on, the setup has to be done right; we explain the common gaps in why two factor authentication fails for regular users.

Check Every Account Linked to That Email

Search your inbox for "password reset", "new sign in" and "verify your email" for the past 30 days. Each result points to a service the attacker may have tried. Prioritise in this order:

Priority	Account type	Why
1	Bank, payment apps, crypto	Direct money loss
2	Cloud storage and photo backups	Identity documents and private files
3	Social media	Used to scam your contacts
4	Shopping accounts with saved cards	Fraudulent orders
5	Everything else sharing that password	Credential reuse

Change passwords on each and turn on two step verification where it exists. A password manager makes this realistic; nobody remembers 40 unique passwords.

Clean the Device and Warn Your Contacts

Run a full scan with your operating system's built in security tool, update the system and browser, and remove browser extensions you do not recognise. If you entered your password on a page that turned out to be fake, the device may be clean and the leak was the phishing page itself. If you cannot explain how they got in, assume the device and scan it.

Then send a short note to your contacts: your account was compromised on a given date, ignore any links sent from it, and do not send money to anyone claiming to be you. Keep it plain. People take a two line warning more seriously than a long apology. If the breach came from a company leak, follow the steps in our guide on what to do after a data breach notice.

FAQ

What if the recovery form keeps rejecting me?

Try again from a device and location you have used often with that account, and answer with the oldest details you remember. Providers weigh familiar signals heavily. Some offer a human review after repeated failed attempts.

Should I delete the hacked email account?

Usually not. Deleting it can make the address available to others later and cuts off resets for linked accounts. Recover it, secure it and keep it, even if you move to a new address.

Can a VPN prevent my email from being hacked?

No. A VPN protects traffic on untrusted networks, but most email takeovers come from phishing, reused passwords or malware. Strong unique passwords and two step verification do far more.

Keep a Recovery Kit Ready

Once you are back in, spend five more minutes on the future: save the backup codes your provider offers, write down when you created the account, and make sure your recovery phone number is current. If it ever happens again, you will be through the first 15 minutes before the attacker has finished reading your inbox.