Email account hacked: how to take back control

Your inbox unlocks other accounts. Start by securing it.

The answer in 2 lines. Use a device you trust to open your email service directly. If you are locked out, follow its account recovery instructions. Once inside, remove unfamiliar forwarding rules, change the password, sign out other sessions and enable two-step verification. Check recovery details and connected applications too. Warn contacts through another channel, then secure accounts that shared the password. If money or financial details are involved, contact your bank immediately through a trusted route.

Start here

Recover access: open the service yourself and find its help or account recovery section. Do not follow a link from an unexpected security message.
Check forwarding and filters: remove rules you did not create, then replace the compromised password with a unique one.
Sign out other sessions: use the account's security settings to log out devices and applications, then enable two-step verification.

Stop: danger

Someone offers paid account recovery: do not give them passwords, verification codes or remote access. Keep recovery within the service's own process.
The suspected device was remotely controlled: use another trusted device for banking and password changes, and arrange a security check before using the affected device for sensitive tasks.
Unfamiliar payments: contact your bank immediately using its app or the details on your card or statement.

Is it definitely a hack?

A rejected password alone does not prove someone has broken in: typing mistakes and service problems happen. More worrying signs include messages you did not send, changed recovery details, unfamiliar security activity or purchases you cannot explain.

Ask a contact to describe the suspicious message without opening its attachments. Record what you discover. The National Cyber Security Centre's account recovery guide provides a checklist: work through its recovery, forwarding and session sections rather than stopping after a password change.

Inspect the settings the intruder could leave behind

Look for forwarding addresses, filters that hide security messages, unfamiliar recovery contact details and applications with account access. Remove entries you do not recognise after checking they are not yours. Menu names vary; use the help available inside your account for the precise controls.

Keep a short written record of suspicious changes before removing them. Do not include your new password or backup codes in that record. If this is a work or education account, tell the organisation's IT team through an established contact route.

What not to do

Reusing the replacement password on another account.
Assuming that an empty Sent folder proves no messages were sent.
Warning people only through the compromised inbox, which the intruder may still control.
Abandoning the address without changing the recovery email on your other accounts.

Protect the accounts connected to your inbox

Make a personal checklist covering banking, shopping, social accounts and public services. Prioritise accounts showing suspicious activity and those using the stolen password. Open each service independently.

For the new password, the NCSC's password guidance explains how to combine three unrelated words or use a password manager. Choose your own words rather than copying an example. Avoid names, birthdays and details visible on your public profile.

Reporting in England

Use Report Fraud's official reporting page and choose the cyber crime or fraud option for an account compromise. Prepare a factual account, screenshots and any payment evidence; retain the reference supplied. Wales and Northern Ireland use this reporting route too. Scotland has a separate police route, explained on that page.

If your bank's handling of associated losses remains disputed, first complain to the bank. Then consult the Financial Ombudsman Service's fraud complaints guidance for eligibility and the next steps. Reporting does not guarantee reimbursement.

Good to know

Warn contacts to disregard unexpected requests for money, links or attachments apparently sent by you.
If recovery fails, tell contacts you have abandoned the address and update important accounts with a secure replacement.
Keep checking financial activity after access is restored; securing the inbox does not reverse earlier misuse.

Illustrative example: Helen in Leeds hears that friends received a request for money from her address. Using a trusted device, she removes an unfamiliar forwarding rule, changes her password and signs out other sessions. She warns friends by phone, checks her financial accounts and records the incident before reporting it.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 5 November 2026, for England. Confidence: high for account recovery principles and reporting routes; medium for individual account menus, which vary by service. Recovery and reimbursement are not guaranteed.