Email account hacked: how to take back control

Start with your inbox. It holds the reset links to the rest of your accounts.

The answer in 2 lines. From a device you trust, change your email password, sign out other sessions and enable multifactor authentication. Locked out? Open the provider's official sign-in page yourself and follow its recovery instructions. Then inspect forwarding, mailbox rules, recovery details and connected applications. Warn your contacts through another channel. If money or identity information was stolen, contact the affected financial institution and use the official US reporting resources below.

Start here

Use a trusted device. If you suspect malicious software on your usual device, update its security software and run a scan before using it for sensitive accounts.
Recover access and change the password. Choose a unique password. The FTC account-recovery guide explains the process and provides links to providers' recovery instructions.
Sign out other sessions through account security settings, then inspect recovery addresses, phone numbers and authentication methods.
Enable multifactor authentication. Use the CISA setup sheet to locate the setting and finish enrollment.

Stop: danger

Someone asks for a recovery code: stop the conversation. Enter codes only in the legitimate recovery process you opened yourself.
Money is moving: contact your bank through its established app or the number on your card. Explain that your email may be compromised and identify suspicious transactions.
A stranger promises account recovery: do not send money, passwords or identity documents. Return to the provider's own recovery process.

Check what actually happened

An unfamiliar sign-in, changed recovery details or messages you did not send warrant attention. A rejected password alone can also result from a typing error or an account restriction. Open the account directly rather than following an alarming email's link.

Keep a short incident record: what you noticed, which settings changed and what you did to secure the account. Save relevant alerts and screenshots somewhere the compromised inbox cannot control. Do not delay account protection while collecting evidence.

Look beyond the password

Inspect automatic forwarding and rules that redirect, hide or delete mail. Review sent and deleted messages, signatures and automatic replies. Remove unfamiliar access permissions for connected applications. For background on how attackers use forwarding, consult the U.S. Secret Service email-compromise guide; its business examples explain a risk that also matters for personal inboxes.

What not to do

Assuming that changing the password automatically removes forwarding rules, connected applications or every active session.
Sending password-reset links to an inbox the attacker still controls.
Reusing the replacement password on shopping, financial or social accounts.
Abandoning the address before updating important accounts that still use it for recovery.

Protect the accounts connected to your inbox

Make a private checklist of financial, tax, shopping and social accounts using this address. Open each account independently, inspect recent activity and verify its recovery details. Replace any password shared with the compromised account. Prioritize accounts holding money or sensitive documents.

Warn contacts through a separate, trusted channel: explain that recent messages may be fraudulent and ask them to verify payment requests with you directly. If a contact already paid, encourage that person to contact their payment provider promptly. For a work or school mailbox, notify the organization's IT team through a known contact method.

Where to report in the United States

FTC fraud reporting: follow the reporting prompts and describe any scam messages, payment requests or losses connected to the takeover.
FBI Internet Crime Complaint Center: select the complaint option for suspected internet crime. Gather relevant account details, messages and transaction records first.
Federal identity-theft recovery portal: if someone used your personal information, describe the misuse to obtain recovery steps tailored to your situation.

A report does not replace the provider's recovery process or a dispute with your bank. Keep copies of submissions.

Good to know

An email takeover does not by itself establish which other accounts were accessed. Check them individually.
Account menus and recovery requirements vary by provider; there is no universal recovery form.
Financial remedies depend on the transaction and applicable rules. Ask your institution what action and documentation it requires.

Illustrative example: Jordan's sister receives an urgent money request from Jordan's address. Using a trusted device, Jordan secures the account, removes unfamiliar forwarding and warns family by phone. Jordan then checks financial accounts and records the suspicious messages for a report.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on November 5, 2026, for the United States. Confidence: high for account-security and reporting guidance; medium for provider-specific recovery steps, which vary. Recovery and reimbursement are not guaranteed.