Email hacked? What to do in the first hour to lock it back down

Friends are getting weird messages from you. You see a "new sign-in" alert you didn't trigger. Or your password suddenly doesn't work.

Your email has been hacked. By the end of this guide, you'll have the account back, the intruder locked out, and the back doors they left behind shut.

The short answer

Change your password from a device you trust, then sign out every other session. Turn on two-step verification. After that, check for forwarding rules and recovery info the hacker may have changed. Most people stop there, and that's the mistake. Those hidden settings are how hackers get back in.

Before you start

• Use a different device if you think your computer or phone is infected. Otherwise it can capture your new password too.
• Have your phone nearby for verification codes.
• Set aside 30–60 minutes.
• Don't delete anything yet. Strange sent messages and alerts are evidence of what the hacker touched.

Step 1: Get back in

If your password still works:

1. Sign in on your provider's website (Gmail, Outlook.com, iCloud, Yahoo) and go straight to Step 2.

If you're locked out:

1. Search for your provider's account recovery page, for example "Google account recovery" or "Microsoft account recovery." Type it into the search yourself. Don't click recovery links in emails.
2. Use a device and Wi-Fi network you've signed in from before, like your home computer on your home network. Providers trust familiar devices and locations more.
3. Answer what you can. Give an old password if you remember one. Partial answers still help.

If it works, you'll be asked to set a new password.

Step 2: Change the password and kick them out

1. Set a new password that's long, unique, and never used anywhere else. A short phrase of four or five random words works well.
2. Sign out every other session:
   • Gmail: Google Account → Security → Your devices → Manage all devices. Sign out of anything you don't recognize.
   • Outlook.com: Go to your Microsoft account → Security and review sign-in activity. The option to sign out everywhere is in the advanced security settings.
   • iCloud: On iPhone, open Settings → [your name] and scroll to your devices. Tap any you don't own and choose Remove from Account.

Changing the password alone doesn't always end sessions that are already open. Signing out forces the hacker to log in again, and now they can't.

Step 3: Fix your recovery info

Hackers often swap in their own phone number or backup email. That lets them reset your password whenever they want.

1. Gmail: Google Account → Security → How you sign in to Google. Check your recovery phone and recovery email.
2. Outlook.com: Microsoft account → Security → Manage how I sign in (on some versions it's labeled Advanced security options). Remove any phone, email, or authenticator app that isn't yours.
3. Apple Account: Settings → [your name] → Sign-In & Security. Check the trusted phone numbers and email addresses.

When you're done, every phone number and address listed should be one you control.

Step 4: Turn on two-step verification

Two-step verification (2FA) means a stolen password isn't enough. The hacker also needs a code from your phone.

1. Gmail: Security → 2-Step Verification → follow the prompts. Add a passkey if it's offered. A passkey lets you sign in with your phone's face, fingerprint, or PIN instead of a password, and it can't be phished.
2. Outlook.com: Security → Manage how I sign in → turn on Two-step verification.
3. Apple Account: This is on for most accounts already. Confirm it under Sign-In & Security.
4. Save the backup codes it gives you somewhere offline.

Step 5: Hunt for forwarding rules and filters

This is the step people skip. A hacker can set your mail to quietly forward a copy of every message to them, or to auto-delete replies like "Did you really send me this?"

Gmail (on a computer, not the app):

1. Click the gear → See all settings.
2. Open Forwarding and POP/IMAP. Remove any forwarding address you didn't add.
3. Open Filters and Blocked Addresses. Delete any filter that forwards, archives, or deletes mail you didn't set up.
4. Open Accounts and Import. Under Grant access to your account, remove anyone you don't know.
5. On the General tab, check your signature and vacation responder for anything you didn't write.

Outlook.com:

1. Click the gear → Mail → Forwarding. Turn off anything you didn't set.
2. Open Rules and delete any rule you don't recognize.

Also check your Sent, Trash, and Archive folders for messages you didn't send.

Step 6: Remove connected apps

Hackers sometimes connect an app to your account. That app keeps its access even after a password change.

1. Gmail: Security → Your connections to third-party apps & services. Remove anything unfamiliar.
2. Outlook.com: Check the Privacy section of your Microsoft account for apps with access, and remove any you don't recognize.

Step 7: Warn your contacts

1. Send one short email from your fixed account. Put everyone in BCC so their addresses stay private.
2. Keep it simple: "My email was hacked on [date]. Ignore any messages from me asking for money, gift cards, or to open a link."
3. Call or text anyone who may have actually acted on a fake message, especially if money was mentioned.

Step 8: Secure everything linked to that email

Your email is the master key. Anyone who controls it can reset passwords on everything else.

1. Search your inbox for "password reset," "verify," "new sign-in," and "order." This shows what the hacker tried.
2. Change passwords first on your bank, Apple or Google account, Amazon, PayPal, and social media.
3. Change every account that used the same password as your email.
4. Check your bank and card statements for charges you don't recognize.
5. Run a security scan on your computer. On Windows 11, go to Start → Windows Security → Virus & threat protection → Quick scan. If a pop-up pushed you to "call support," read our guide to fake virus pop-ups.

Still not working? Try these

• Recovery keeps failing. Wait a day and try again from the same familiar device and network. Repeated attempts from new places look suspicious to the provider.
• Work or school email. Don't try to recover it yourself. Call your IT admin. They can reset it and check the logs. Small businesses in New York may also have legal notice duties. Our NY SHIELD Act checklist explains them.
• It got hacked again. Something is still leaking your password. The usual causes are malware on a device or a reused password on another site. Go back through Steps 3, 5, and 8.
• Money or identity stolen. Report it at identitytheft.gov and ic3.gov, and call your bank.
• You got here from a text link. Work through our checklist for clicked scam links as well.

Avoid anyone online who offers to "recover" your account for a fee. Real providers don't charge for recovery.

Keep it from happening again

• Use a password manager so every account gets its own password.
• Switch to passkeys or 2FA on email, banking, and shopping accounts.
• Check your forwarding and filter settings every few months.
• Never enter your email password on a page you reached from a link. Type the address yourself.

Quick answers

How did they get my password? Most often it's a phishing email or a password reused from a site that was breached. Malware on a device is less common but possible.

Should I just make a new email address? Usually not. If you get the account back and lock it down, keep it. Your accounts and contacts are tied to it.

Can hackers still read my old emails? Not once you've signed them out, removed forwarding, and turned on 2FA. Assume anything already in the inbox may have been seen, though.

Rather have us fix it?

If you're locked out or just want it done right, an ITGoNYC tech can connect through secure remote support. We'll recover the account, remove the hidden rules and connected apps, and lock down your linked accounts while you watch. Call or text 347-549-9059 for same-day help, or open a ticket.