How to Recover a Hacked Email Account

If you think your email account has been hacked, the first thing to do is go to your email provider's website and search its help or support pages for the account recovery process¹. Get back in, change the password, and change it on every other account that used the same one². Then check your email filters and forwarding rules, because criminals often set up a rule that quietly sends them a copy of every email you receive, which lets them reset your other passwords even after you have changed them¹.

Your email is the key to much else. If a criminal can access it, they could reach private information about you, including your banking details, send messages pretending to be from you, and reset the passwords on all your other accounts³. That is why the recovery steps below put email first and everything else second.

The good news is that this is a well-trodden problem with a clear sequence of actions, and the National Cyber Security Centre (NCSC) publishes step-by-step guidance for households². Work through the steps in order, take your time, and do not skip the forwarding rules check: it is the step people most often miss.

Signs your email account has been hacked

Sometimes it is obvious: you cannot get back into your account at all. The NCSC says that if you are no longer able to access your accounts, somebody else may have gained access, though sometimes the signs are less clear⁴. Unrecognised activity is the other main signal, such as changes to security settings, or password reset messages you did not ask for⁴.

Look out for these signs of unauthorised activity²:

• changes to your security settings
• messages or notifications sent from your account that you do not recognise
• logins or attempted logins from strange locations or at unusual times
• unauthorised money transfers or purchases

A friend or relative may be the one who notices. Unexpected emails sent from your account advertising unlikely products, or asking for money, are a sign of infection⁵. If someone tells you they have had a strange message from you, take it seriously rather than assuming they are mistaken.

It also helps to know what you are dealing with in advance. The NCSC suggests reading its guidance about recovering a hacked account before anything happens, so you know what to do if you experience an incident⁴. A few minutes now saves a scrambled hour later.

Step 1: get back into your account and change the password

Start with the account provider. Go to their website and search their help or support pages to find the account recovery process, or use a search engine query to find it¹. Providers have their own routes for proving the account is yours, and following theirs is the quickest way back in.

Once you are in, change the password for the account that was hacked, and also for any accounts that use the same password². This second part matters as much as the first. If you have used the same password across different accounts, cyber criminals only need one password to access all your accounts⁶. The NCSC puts it plainly: if you have re-used your email password across other accounts, change your email password as soon as possible, and it should be strong and different to all your other accounts³.

A strong password does not have to be complicated to remember. The NCSC's advice is to combine three random words to create a password that is long enough and strong enough⁷. If remembering many different passwords is the obstacle, a password manager can store them safely⁷.

Then force a clean break. Force all devices and apps to log out, usually from the Settings menus of the app or website, so that anyone attempting to use the account is prompted to supply the new password². Without this, a criminal who is already signed in may stay signed in.

Check your email filters and forwarding rules

This is the step that decides whether the hack is really over. A common tactic used by cyber criminals is to set up a forwarding rule, which means they will automatically be sent a copy of all emails sent to your account, which could allow them to reset your passwords¹. Check there are no unwanted forwarding rules in your email account².

The same warning appears in local resilience advice: if your email address was hacked, check for any auto forwarding rules, which criminals add to retain access to your inbox even when you change passwords⁸. That is the point of the rule: it survives a password change, so the criminal keeps a window into your mail and can keep resetting other accounts.

In practice, look in your email settings for filters, rules and forwarding addresses, and remove anything you did not set up yourself. Our guide to how to check for forwarding rules set by hackers walks through where these settings usually sit.

Turn on 2-step verification so it cannot happen again

Once the account is back under your control, add the protection that makes a repeat much harder. Set up 2-step verification (2SV), also known as two-factor authentication or 2FA, which usually works by sending a PIN or code, often via SMS or email, to prove it is really you². Even if someone learns your password, they should not get in without that second step.

The NCSC calls turning on 2SV the first and most important step to help protect you if your password gets phished or otherwise compromised⁹. It recommends 2SV on important accounts like email and banking, even if those accounts are already protected by a strong password, and notes that it only takes a few minutes¹. Local resilience guidance for households makes the same recommendation¹⁰.

If you use a password manager, switch on 2SV on that account too, so that even if a cyber criminal knows the primary password they still cannot access it⁹. The same logic applies to cloud storage: anyone who is able to access your cloud account will also have access to your backups, so protect the account with a strong password and 2SV¹¹.

Our guide to how to turn on 2-step verification covers the settings, and if you do not use a mobile phone there is advice on setting up 2SV without a phone.

If you cannot get back in: reporting and help

Sometimes the online recovery service will not work. In some cases it may not be possible to recover your account with the online service; in such cases you will have to create a new account, give your contacts the new details, tell them you have abandoned the old account, and update any bank, utility or shopping websites with your new details². It is a chore, but it closes the door on the old account properly.

Before you give up on recovery, check you are using the genuine route. If you cannot access one of your accounts or have noticed other unusual activity, the NCSC points you to its actions to take to recover a hacked account¹². If you think your account has already been hacked, its phishing guidance sends you the same way¹².

Report suspicious messages as you go. Forward suspicious emails to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service¹³. If you are suspicious about an email you have received, forward it to report@phishing.gov.uk¹³. Reporting helps the authorities take down scam infrastructure, and it costs you a minute.

If money has gone missing or you have given out bank details, contact your bank directly using details you already hold, not from the message. Our guide to what to do if you gave your bank details to a scammer sets out the next steps.

Accounts that share your password, and other accounts to check

The password you used for email is the one to worry about everywhere else. If a criminal can access your email account, they could access private information about you, post emails and messages pretending to be from you, and reset all your other account passwords³. That is why the recovery steps include changing the password on any account that used the same one².

Work through the accounts that matter: banking, shopping, social media, cloud storage and any utility or council accounts you log into. Where an account offers 2SV, turn it on. Our checklist on which accounts to protect with 2-step verification helps you order the work.

If you use a password manager, it can generate and store a different password for each account, so one stolen password no longer opens several doors⁹. If you have been writing passwords down, there is guidance on whether it is safe to write your passwords down.

Warning your contacts, and what to say

Tell people. The NCSC's recovery steps include notifying your contacts that you were hacked and suggesting they treat any recent messages sent from your account with suspicion². A short message to family, friends and colleagues is enough: your account was hacked, ignore anything odd sent recently, and check with you before acting on any request for money.

This matters because criminals use a hacked mailbox to send convincing messages in your name. A warning from you, sent from your recovered account or by another route, takes the sting out of anything already sitting in their inboxes.

If your phone or computer may be infected

Sometimes the email account is not the whole story. If someone you know tells you they have received unexpected emails from you advertising unlikely products, or perhaps asking for money, that is a sign of infection⁵. The device itself may need attention.

• PC or laptop: update your device and programs, open your antivirus product and run a scan, then follow its advice⁵.
• Phone or tablet: the safest solution to an infection is a factory reset, usually found in the Settings⁵.
• While you are at it: set up 2SV on accounts where possible¹⁴.

Our guides to malware on a computer or phone and whether to factory reset an infected phone go further, and the after fixing an infected device checklist covers the tidy-up.

Sextortion emails that quote your password

A particularly unsettling message after a hack quotes a password you recognise and claims to have video of you. A sextortion scam is when a criminal attempts to blackmail someone, usually by email, claiming they have login details or a video of the victim visiting an adult website and threatening to disclose this unless the victim pays a ransom¹⁵. It is an example of a phishing attack, where victims receive emails that try to trick them into doing the wrong thing¹⁵.

Do not worry if the message includes your password, as it is probably from an old breach of personal data, but change your account password immediately and anywhere else you use the same password¹⁶. You can check whether your details appear in a known breach at haveibeenpwned.com¹⁵. Criminals send millions of these emails in the hope that someone will pay¹⁵.

The advice is not to engage with the sender, to forward the email to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk, and then to delete it¹⁷. Our guide to sextortion emails that quote your password explains why the password in the message is not proof of anything.

Data breach notifications and follow-up scams

If your details were caught up in a breach, you may get a notification. Treat it as a prompt to act, and treat follow-up messages with care. The NCSC warns to look out for official-sounding emails about resetting passwords, receiving compensation or confirming identity, emails full of technical speak, and being urged to act immediately¹⁸. Those are the hallmarks of a scam riding on a real breach.

If you suspect an account of yours has been accessed, refer to the NCSC guidance on recovering a hacked account¹⁹. Change the password on the affected account and anywhere it was reused, and turn on 2SV. Our guide to your details in a data breach and the guide to how to spot scam messages after a data breach cover the pattern in more detail.