My Email Was Hacked: What to Do Now (Gmail, Outlook, Yahoo)

Think someone got into your email? Take a breath and act quickly, because whoever controls your inbox can request password reset links for your other accounts and lock you out of them, the FTC warns. Here’s what to do in Gmail, Outlook and Yahoo, whether you can still sign in or you’re locked out.

Hacked email: what to do first

1. Check your device. Update your security software, run a scan and delete anything it flags. Then follow your email provider’s recovery steps (FTC). Microsoft says to run a full scan before you change your password.
2. Change your password to a new one you don’t use anywhere else. If you make it up yourself, the FTC says to aim for at least 15 characters; your browser or a password manager can also create one for you.
3. Sign out of all devices, so anyone logged in elsewhere gets kicked out (FTC).
4. Undo the hacker’s changes: recovery email and phone, forwarding rules, filters and connected apps. Steps for each provider are below.
5. Turn on two-step verification, so a password alone isn’t enough to log in (FTC).
6. Protect your other accounts and warn your contacts.

Can’t sign in at all? Skip to “Locked out?” below.

Signs your email was hacked

The FTC lists these warning signs:

• You can’t log in.
• You get a notice about a password or username change you didn’t make.
• You get a notice about a sign-in from a device or place you don’t recognize.
• Friends or family get messages from you that you didn’t send, sometimes with links or pleas for money.

Google and Yahoo add others: you stop getting email, you find sent emails you didn’t write, or your mail settings changed without your knowledge. If Gmail shows a forwarding notice you never set up, Google says to change your password immediately.

Email hacked: what to do next if you can still sign in

Google and Yahoo both say to change your password right away (Google, Yahoo). Then follow your provider’s steps.

Gmail hacked: what to do

• Review activity. In your Google Account, open Security & sign-in. Under “Recent security events,” select Review security events. If something wasn’t you, select No, it wasn’t me and follow the steps (Google).
• Change your password under Security & sign-in > Password. Google then signs you out everywhere except a few devices and third-party apps you’ve given access.
• Remove unknown devices: Security & sign-in > Your devices > Manage all devices, then select the device and Sign out (Google).
• Fix changed settings: your recovery phone, recovery email and apps with access to your account.
• Check Gmail’s settings. On a computer, click Settings > See all settings. Check the Forwarding and POP/IMAP tab; Filters and Blocked Addresses, for filters that forward or delete mail; and Accounts and Import, for “Send mail as” and “Grant access to your account” (Google).
• Turn on 2-Step Verification under Security & sign-in > “How you sign in to Google” (Google).

Outlook email hacked: what to do

Scan your PC first, then change your password. Because someone else had access, Microsoft says it resets some settings, and it asks you to check connected accounts, forwarding and automatic replies.

• Forwarding: In Outlook.com, go to Settings > Mail > Forwarding, clear Enable forwarding and select Save (Microsoft).
• Rules: Settings > Mail > Rules. Delete any rule you didn’t create (Microsoft).
• Recent activity: The recent activity page shows when and where your account was accessed, including successful sign-ins (Microsoft).
• Sign out everywhere: On the Advanced security options page, find Sign out everywhere and select Sign out. It can take up to 24 hours (Microsoft).
• Security info: On the same page, remove phone numbers or emails that aren’t yours. Add your new info first: removing all of it puts the account in a 30-day restricted state (Microsoft).
• Two-step verification: At account.microsoft.com/security, select Manage how I sign in, then turn on two-step verification (Microsoft).

Yahoo email hacked: what to do

On the Yahoo Account Security page (Yahoo):

• Change your password under “Ways of signing in” (Yahoo).
• Current sign-ins: Click any device you don’t recognize and select Sign out.
• External connections: Delete app passwords you don’t recognize. They stay active even after you change your password.
• Recent account activity: Look for changes like an added phone number.
• Recovery info: Delete phone numbers and emails that aren’t yours (Yahoo).
• Two-step verification: Turn it on under “Ways of signing in” (Yahoo).

Then check the Yahoo Mail settings hackers often change: filters, auto-forwarding, reply-to and send-only addresses, and vacation responses.

Add a passkey if you can

A passkey signs you in with your face, fingerprint or screen lock. Google says passkeys protect your account from phishing, and Microsoft calls them phish-resistant. Yahoo says its passkey option may not be available to you yet.

Locked out? How to recover your hacked email account

Start only from the provider’s own pages:

Provider	Review sign-in activity	If you’re locked out
Gmail	Security & sign-in > Recent security events	Google account recovery
Outlook.com, Hotmail	Recent activity page	Reset your password, then the recovery form
Yahoo	Security page: current sign-ins and recent activity	Sign-in Helper

What to expect:

• Google: Answer every question, taking your best guess if unsure, and use a device and place where you usually sign in (Google). Recovery can be delayed from a few hours to a number of days.
• Microsoft: Its sign-in helper asks for your email or phone number, then shows self-help or offers to connect you with an agent. The recovery form asks things only you would know, like contacts and exact subject lines. Microsoft replies within 24 hours, and you can try up to twice a day. If two-step verification was on and you can’t reach any backup method, Microsoft says it can’t help.
• Yahoo: Enter your recovery email or phone number in the Sign-in Helper. If that info is wrong or out of reach, you may not be able to get back in.

After you’re back in: protect your other accounts

1. Change passwords the hacker could use. Google lists sites where you use the same password, sites that contact you at that address and sites where you sign in with it (Google). Start with accounts that hold money, and look for charges or changes you don’t recognize, like a new address.
2. See what the hacker did. Check your Sent folder for emails they sent, and your Deleted folder for emails they read and then deleted (FTC).
3. Tell your contacts not to click links in emails from you and to ignore pleas for help or money (FTC).
4. Check your devices. Emails you didn’t write can also be a sign of malware. Stop logging into accounts on a device you suspect until you’ve updated its security software and run a scan (FTC).
5. Think about what your inbox held. If it had bank, tax or passport information, Google says to make sure no one gave your bank or government instructions, like opening an account or moving money.

Did it start with a link you clicked? See I clicked a phishing link.

Hacked email address vs. hacked email account

They’re different problems:

• Spoofed address. Bounce messages for emails you didn’t send, or replies to messages you never sent, can mean someone spoofed your address. They forged it as the sender on emails created outside Gmail, which Gmail can’t stop. Report those emails as spam. If friends say you sent them spam, Google says to follow its Gmail security tips.
• Password in a data breach. If a company says it lost your password, change it right away, plus anywhere you reused it. See what a data breach notice means and the data breach checklist.
• Only your address got out? Here’s what a scammer can do with it.

Someone is using my email to sign up for things

Sign-up or verification emails you didn’t request don’t always mean a hack. A verification email you got in error likely means someone typed your address by mistake, Google says. Microsoft says an unrequested code can mean a typo too, or someone trying to get into your account.

• Don’t click links or share codes. Without the code, your account is safe, Microsoft says. To check an account, go to the company’s website yourself, not through the email (FTC).
• Get fewer of them. Mark them as spam, block the sender or use your provider’s unsubscribe feature (FTC).
• Account opened in your name? If someone used your information to open an account, make a purchase or apply for a loan, report it at IdentityTheft.gov.

Could a hacked email lead to identity theft?

It can. Some hackers want your bank account numbers or Social Security number to commit identity theft. If you’re not sure whether your information was used, IdentityTheft.gov’s first step is to check, freeze and monitor your credit.

A credit freeze is free, doesn’t affect your credit score, and means nobody can open new credit in your name while it’s in place (FTC). Here’s how to freeze your credit. If the hacker could see your Social Security number, follow these steps.

How to report a hacked email account

• Money missing or bank accounts touched: Call your bank, using a number you trust, like the one on your statement (FTC). Then file a complaint with the FBI’s Internet Crime Complaint Center, using the words “account takeover” in your description (IC3).
• Someone used your identity: Report it at IdentityTheft.gov to get a recovery plan.
• A scam led to the hack, like a phishing email or a fake support call: tell the FTC at ReportFraud.ftc.gov (IdentityTheft.gov). The FTC can’t resolve individual reports, but uses them to build cases.

The report-a-scam tool lists more official channels, and the scam recovery checklist helps you track each step.

Watch for the follow-up scam

Scammers target people who are trying to fix a hacked account:

• Fake support numbers. Tech support scammers try to get their websites into search results and run their own ads. Real security pop-ups never ask you to call a number (FTC). Yahoo warns that searching online for its contact info can lead to support scams. The FBI’s IC3 suggests using bookmarks to reach login pages instead of search results or ads.
• Requests for codes or passwords. Google never asks for your password or verification codes by email, phone or message. Yahoo never asks for your password in emails or phone calls. The FTC’s rule: anyone who asks for your verification code is a scammer.
• Calls you didn’t ask for. Microsoft won’t call to offer support unless you asked, and its support agents can’t send password reset links or change your account details.
• Paid “recovery” help. Legitimate organizations never ask for money to help you get a refund, the FTC says.

Let someone into your computer? See I let a scammer into my computer. Got a call about your bank? See is this call really from my bank?

What varies

• Work or school email. Some steps may not work on these accounts. Google and Microsoft point you to your administrator or your organization’s IT admin.
• Menus. Setting names change over time and differ between apps and computers.
• Recovery isn’t guaranteed. Yahoo may not be able to restore access if your recovery info is wrong or out of reach. Neither can Microsoft if two-step verification was on and you can’t reach a backup method.
• Yahoo forwarding is a Yahoo Mail Plus feature and isn’t available everywhere.