Email account hacked: how to get it back and lock it down

Breach / exposure. Updated 2026-09-13. About 5 minutes to read.

Get back into your email first, then sign out every other session and delete any forwarding rule or filter you did not create, because attackers use them to keep reading your mail after you change the password.

Recover your email before anything else. Your email is the reset button for your bank, shopping, social media and password manager, so while an attacker controls it, every password you change elsewhere can be reset again.

This guide gives the official recovery route for Gmail, Outlook, Yahoo and Apple, then the clean-up that people skip: hidden forwarding rules, other signed-in sessions, recovery details the attacker added, and connected apps.

Rule one: secure your email before anything else

Work from a device you trust, ideally not the one you think was infected. If you still have access, change the password now. If you do not, go straight to the provider's recovery flow below. Leave bank and social media passwords until your email is back under your control.

Signs someone else is in your mailbox: sent messages you did not write, friends receiving strange links or payment requests from you, password reset emails you did not request, missing emails, or a security alert about a new sign-in.
Signs of a quieter compromise: a forwarding address you do not recognise, filters that move mail to trash or archive, or a new recovery phone number.

Official recovery routes by provider

Gmail: go to the account recovery page at accounts.google.com/signin/recovery. Google advises answering as many questions as possible, using a device and location where you usually sign in, and entering the most recent password you remember.
Outlook, Hotmail and Microsoft accounts: try a password reset first. If that fails, use the recovery form at account.live.com/acsr and give a contact email that is different from the hacked one. The form cannot be used if two-step verification was turned on.
Yahoo Mail: use the Sign-in Helper from the Yahoo login page. Once in, open Account security to review Current sign-ins, External connections and Recent account activity.
Apple iCloud Mail and Apple Account: if you cannot reset the password, start account recovery at iforgot.apple.com or from Settings on your iPhone. Apple emails a confirmation within 72 hours with the date you can regain access, and Apple Support cannot shorten the waiting period.

During Apple account recovery, turn off other devices signed in with your Apple Account. Apple says a recovery request is cancelled automatically if the account is used during the waiting period.

Once you are back in: the 15-minute clean-up

Change the password to a long, unique one generated by a password manager.
Sign out of every other session. In Google, open Security & sign-in, then Your devices. In Yahoo, use Current sign-ins. For Microsoft, use the security page at account.microsoft.com.
Check the recovery email, recovery phone and any trusted phone numbers, and remove anything that is not yours.
Turn on two-step verification with a passkey or authenticator app rather than text messages where you can.
Delete forwarding rules and filters. In Gmail, open Settings, See all settings, then check Forwarding and POP/IMAP, Filters and Blocked Addresses, and Accounts for mail delegation. In Outlook.com, check Settings, Mail, then Forwarding and Rules.
Check the automatic reply, signature, and the address on outgoing mail for changes.
Remove connected apps you do not recognise, such as Google linked apps, Microsoft apps with access, or Yahoo External connections.

Find out what the attacker could reach from your inbox

Search the inbox, archive and trash for 'password reset', 'verify', 'sign-in' and 'security alert' from the days around the hack.
Look in Sent and Deleted for messages the attacker sent or tried to hide.
Change the password for every account that sent a reset email, starting with banking, then shopping sites with saved cards, then social media.
If your password manager's recovery used this email, change the password manager's master password and check its recovery settings.
Run your address through a breach check to see whether an old password from another site was the way in.

Warn your contacts the right way

Attackers often use a hacked mailbox to send invoices with changed bank details, fake document links, or requests for gift cards. Send a short, plain message from the secured account: 'My email was hacked on [date]. Please ignore any messages from me that ask for money, payment changes or logins, and delete any links I appeared to send.'

Call anyone who may act on a payment request, such as your accountant, a client, or an elderly relative, rather than relying on email alone.

If recovery does not work

Try again later from the device, network and location you normally use. Repeated attempts from new places can look like the attacker.
Consumer Google and Microsoft accounts do not offer phone support for recovery, so be wary of any phone number claiming to be Google or Microsoft account recovery.
If you cannot recover it, create a new address, move each important account to it, and tell contacts and your bank the old address is no longer yours.
Report impersonation or fraud sent from your account to the provider, and to your bank if any payment details were changed.

Frequently asked questions

Why do I have to recover my email before my other accounts?

Almost every service sends password resets to your email. If the attacker still controls it, they can reset any password you change, so securing email first stops the cycle.

I changed my password. Can the hacker still read my email?

Yes, if they set up a forwarding rule, a filter, mail delegation, or a connected app. Remove those and sign out of all other sessions after changing the password.

Can I call Google or Microsoft to recover my account?

Not for personal accounts. Recovery runs through their online forms. Anyone offering phone recovery for a fee is almost certainly a scammer.

How long does Apple account recovery take?

It varies. Apple emails a confirmation within 72 hours with the date and time you can expect to regain access, and says it may be several days or longer. Contacting Apple Support cannot shorten it.

Should I just delete the hacked email account?

Not straight away. Recover it, move your accounts to a secure address, and keep the old one locked down. Deleting it early can let someone register the address later and receive your resets.