My Email Was Hacked. What's the First Thing I Should Do?

The quick answer

From a trusted device, secure the email account first: change its password, review sign-in activity, enable multifactor authentication, and remove unauthorized recovery methods or forwarding rules. If you can't sign in, use the provider's official account-recovery process.

How to recognize a real compromise

Unexpected sent messages, password-change notices, unknown devices in sign-in history, and new inbox rules are warning signs. Spoofed email can also make messages appear to come from your address without someone signing into your account. Check account activity before assuming every forged message proves access.

Steps if you can still sign in

1. Go directly to your provider's official website or app.
2. Change the password to a unique one and review recent login sessions.
3. Enable or strengthen multifactor authentication and sign out sessions you don't recognize.
4. Check recovery phone numbers, backup email addresses, app passwords, and connected applications.
5. Inspect forwarding settings, filters, and inbox rules that could silently divert messages.

Warn people without spreading malicious links

Tell contacts to ignore unusual messages from your account, especially requests for money, credentials, or clicking unexpected attachments. Don't forward the suspicious email to everyone. Notify your workplace's IT administrator if the compromised mailbox is used for work.

Protect other accounts next

Your email address may be the reset method for shopping, social media, and financial accounts. Change passwords on important accounts that reused the same credentials and review recent transactions. Contact your bank directly if you see suspicious financial activity.

Locked out completely?

Use the provider's official recovery flow and follow its identity checks. Avoid search-result 'recovery agents' who demand remote access or upfront payment. A real recovery may take time and may not always succeed if recovery details have been changed.

Afterward, keep an eye on it

Review sign-in activity and forwarding rules again over the next few days. Document what happened and make sure other devices accessing the account are updated and trustworthy.