Something feels off — a friend mentions a weird email “from you,” or you get a password reset notice you never requested. A hacked email account is one of the most common tech emergencies, and the speed of your response matters. Most inboxes hold years of personal history, linked accounts, and password reset access to your bank, your social media, and everything else — which is exactly why attackers target it first. Here’s how to tell if you’ve been compromised and exactly what to do, in order, right now.
The Warning Signs You Shouldn’t Ignore
Any one of these on its own is worth investigating. More than one is a strong signal your account has been accessed by someone else:
- Contacts report emails you never sent — often spam, a “stuck abroad” scam, or a link asking them to click something.
- Password reset emails you didn’t request — from your bank, social media, or other linked accounts. This usually means someone is using your email to try to take over other accounts.
- A login alert from an unfamiliar device or location — most providers email or text you when a new device signs in.
- You’re suddenly locked out — your password stops working and you didn’t change it.
- Missing emails, folders, or a suddenly empty inbox — attackers sometimes delete evidence of their activity, including security alerts.
- Your recovery phone number or backup email has changed — and you didn’t change it.
- Unusual “Sent” folder activity — messages you don’t recognize sitting in Sent, especially spam or phishing links.
If any of these apply, don’t wait to “see if it happens again.” Move through the steps below now.
Step 1: Change Your Password Immediately
If you can still log in, this is your first move. Choose a password you haven’t used anywhere else — reused passwords are the single biggest reason one hacked account turns into five. Aim for at least 12 characters mixing letters, numbers, and symbols, or better, use a random password generated by a password manager.
Changing your password logs out most active sessions on major providers (Gmail, Outlook, Yahoo), which immediately cuts off whoever is inside your account.
Step 2: Check Your Account Recovery Settings
Before doing anything else, open your account’s security settings and check:
- Recovery email — is it still yours?
- Recovery phone number — same question.
- Security questions — has anyone changed the answers?
Attackers often update these first, so that even after you change your password, they can still recover access. If anything looks unfamiliar, fix it before moving on.
Step 3: Review Recent Login Activity
Gmail, Outlook, and Yahoo all let you view a login history showing device type, approximate location, and time. Look for:
- Logins from a country or city you’ve never been to
- Logins at times you weren’t using your device
- Unfamiliar device types (e.g., an Android login when you only use iPhone and a laptop)
If you find suspicious activity, most providers have a one-click option to sign that session out and secure the account — use it, then change your password again if you haven’t already.
Step 4: Check for Mail Forwarding and Filter Rules
This is the step people miss most often, and it’s how attackers keep reading your email even after you’ve locked them out of logging in directly. Hackers frequently set up a silent rule that auto-forwards your incoming mail to an address you’ll never see, or that auto-deletes security alerts before you notice them.
Check your Filters (Gmail) or Rules and Alerts / Forwarding (Outlook, Yahoo) settings for anything you didn’t create — especially rules that forward mail elsewhere or automatically archive/delete messages from your bank, PayPal, or other financial accounts. Delete anything unfamiliar immediately.
Step 5: Turn On Two-Factor Authentication (2FA)
Two-factor authentication requires a second code — usually from your phone — in addition to your password. It’s the single most effective thing you can do to prevent this from happening again, because even a stolen password isn’t enough to get in.
Most providers offer this under Security settings, and it takes about two minutes to set up. Use an authenticator app (like Google Authenticator or Microsoft Authenticator) rather than SMS text codes where possible — SMS can be intercepted through a SIM swap, while an app-based code cannot.
Step 6: Scan Your Devices for Malware
If you didn’t reuse a password and your email was still compromised, the more likely cause is a keylogger, infostealer, or phishing page that captured your credentials directly from your device. Run a full scan with your antivirus software, and consider using a second reputable scanner (like Malwarebytes) for a second opinion, since no single tool catches everything.
If the scan finds something — or if you’re not confident it caught everything — treat that device as compromised until it’s been properly cleaned, and change your passwords again afterward from a different, trusted device.
Step 7: Warn Your Contacts
If the attacker sent spam or phishing emails from your account, a quick heads-up to your contacts prevents them from becoming the next victim. A short message — “my email was compromised, please ignore anything strange you received from me and don’t click any links” — is enough.
What If You Can’t Log In At All?
If your password no longer works and you don’t recognize the recovery info, you’ll need to go through your provider’s account recovery flow:
- Gmail: g.co/recover
- Outlook / Microsoft: account.live.com/acsr
- Yahoo: Yahoo’s sign-in help flow at the login screen
These flows ask you questions to verify you’re the real owner — old passwords you remember, account creation date, contacts you email frequently. Answer as many as accurately as you can; partial answers still help your case. This process can take anywhere from a few minutes to a few days depending on the provider.
How to Prevent This From Happening Again
- Use a unique password for every account, managed with a password manager (Bitwarden, 1Password, or your browser’s built-in manager) so you’re not reusing credentials across sites.
- Enable 2FA everywhere it’s offered, not just email.
- Be skeptical of urgent-sounding emails, especially ones asking you to “verify your account” or “confirm your password” — these are the most common phishing bait.
- Check the sender’s actual email address, not just the display name, before clicking any link.
- Keep your devices updated — security patches close the holes malware relies on.
When to Call a Pro
If you’ve worked through these steps and you’re still locked out, still seeing suspicious activity, or you’re not confident you’ve fully removed whatever compromised your account in the first place, it’s worth getting a second set of eyes on it. A hacked email often means other accounts are at risk too, and getting the full picture — device, account, and connected services — right the first time matters.
Rexxers can help you recover access, lock the account down properly, and make sure nothing was left behind. Submit a support ticket or reach us at [email protected] or (818) 305-5806.
Frequently Asked Questions
How do I know if my email was actually hacked and not just glitching?
Check your account’s login activity page first. A genuine glitch won’t show unfamiliar devices or locations signing in. If you see activity you don’t recognize, treat it as a real compromise and work through the steps above.
Can someone hack my email without knowing my password?
Yes, in rare cases — through a browser session that stayed logged in on a shared or stolen device, a malicious app you granted access to, or a security flaw the provider later patched. This is uncommon, but it’s why checking connected apps and active sessions matters, not just changing your password.
Should I delete my email account and start over?
Almost never. Your email account is usually recoverable and tied to years of history and other linked accounts. Securing and reclaiming it is nearly always faster and safer than starting fresh.
Will changing my password fix everything?
It’s a critical first step, but not the whole fix. If you skip checking forwarding rules, recovery info, and connected apps, an attacker can regain access even after you change your password.
How long does it take to fully secure a hacked email account?
If you can still log in, working through the steps above usually takes 15-20 minutes. If you’re locked out and need to go through account recovery, it can take anywhere from a few minutes to a few days depending on the provider’s verification process.