A hacked email account is urgent, because your inbox is the master key to your other accounts. Work fast and in this order. This guide is part of our section on data breaches and hacked accounts.

Getting a hacked account back
  1. STEP 01
    Get in

    Use the official recovery page, typed by hand.

  2. STEP 02
    Lock out

    Change the password and log out of all devices.

  3. STEP 03
    Clean up

    Remove strange rules, forwards and recovery details.

  4. STEP 04
    Warn

    Tell your contacts, and secure linked accounts.

Speed matters. Use a clean device if you think yours may be infected.

Step 1: Get back in

Use a device that you are sure is clean. If you think your computer is infected, use another one.

  • If your password still works: log in and change it right away.
  • If it does not: use the official recovery page. Type the provider's address yourself. Scammers buy search ads for "Gmail support" and similar terms.

Step 2: Lock the attacker out

  1. Set a new, long, unique password.
  2. Use "sign out of all other sessions" or a similar option.
  3. Remove devices that you do not recognize.

Step 3: Check what they changed

Attackers set up quiet ways to stay in. Look for:

  • Forwarding rules that copy your mail to another address.
  • Filters that hide or delete messages, especially those from your bank.
  • Delegates or app passwords that give someone else access.
  • Recovery email and phone number, which may have been changed.
  • Connected apps that you do not recognize.
  • Your signature and auto-reply, which can spread scams.

Do not skip this step. People regain their account, and the attacker keeps reading their mail through a rule.

Step 4: Turn on two-factor login

Use an authenticator app, passkey or security key, then save your backup codes. Our email security checklist covers this in more depth.

Step 5: Secure linked accounts

The attacker could have used your inbox to reset other passwords. Search your mail for "password reset" and "welcome", then change the passwords on accounts that matter. Start with banking, shopping and social media. If you have crypto accounts, check them first.

Step 6: Warn people

Tell your contacts that your account was hacked, and that they should ignore recent requests for money or links. Criminals often message friends and family from hacked accounts.

Step 7: Check your device

If you do not know how they got in, scan your computer and phone. See keyloggers and password-stealing malware. Also check whether your password has shown up in a known leak.