Usually you find out from someone else. A friend calls: "Did you send me an email asking for gift cards?" Or your contacts start getting strange links from your address. Sometimes you just can’t sign in anymore.
It’s unsettling, but it’s fixable. The key is to do things in the right order.
Signs your email has been hacked
- Friends receive messages you didn’t send
- Your password suddenly stops working
- You see emails in your Sent folder that you didn’t write
- You get alerts about sign-ins from places you’ve never been
- Emails you expect never arrive (they may be forwarded or deleted)
Step 1: Change your password, from a safe device
If you suspect your computer has a virus, use your phone or another device for this.
- Gmail: go to myaccount.google.com, tap Security, then Password.
- Outlook, Hotmail or Live: go to account.microsoft.com, then Security, then Change password.
- Yahoo or AOL: open the account’s settings, go to Account Security, and change your password.
Make the new password long and unique. Three or four random words work well, like "maple-river-tuesday-lamp." Don’t reuse a password from any other account. A password manager makes this much easier.
Step 2: If you can’t sign in, use account recovery
Go to the email provider’s sign-in page and click Forgot password. You’ll be asked to confirm your identity with a backup phone number or email. Use the official page, typed in yourself:
- Google: g.co/recover
- Microsoft: account.live.com/acsr
- Yahoo and AOL: the "Trouble signing in?" link on their sign-in page
Never pay anyone who claims they can "recover" your email. Google, Microsoft, Yahoo and AOL don’t charge for this and don’t offer recovery by phone call.
Step 3: Check for sneaky changes
Hackers often change settings so they keep access even after you change your password. Check these:
- Recovery phone and email. Make sure they’re yours. Remove anything you don’t recognize.
- Forwarding. In Gmail on a computer, click the gear, then See all settings, then Forwarding and POP/IMAP. In Outlook.com, go to Settings > Mail > Forwarding. Turn off any forwarding you didn’t set up.
- Filters and rules. Hackers sometimes create rules that delete or hide replies. In Gmail, check Filters and Blocked Addresses. In Outlook, check Rules.
- Signature and reply-to address. Make sure nothing was added.
- Signed-in devices. In Google, go to Security > Your devices and sign out of any you don’t recognize. Microsoft and Yahoo have similar lists under their security settings.
Step 4: Turn on two-step verification
This is the single most effective thing you can do. With two-step verification, even someone who has your password can’t get in without a code from your phone.
- Google: myaccount.google.com > Security > 2-Step Verification
- Microsoft: account.microsoft.com > Security > Two-step verification
- Yahoo and AOL: Account Security > Two-step verification
Using a phone prompt or an authenticator app is stronger than text-message codes, but any two-step option is far better than none.
Step 5: Warn your contacts
Send a short note from your recovered account: "My email was hacked on [date]. If you got a strange message or link from me, please delete it. I never asked anyone for money." This protects friends from falling for the follow-up scams.
Step 6: Check other accounts that use the same email
Your email is the key to everything else, because "forgot password" links go there. Change passwords for:
- Your bank and credit cards
- Amazon and other shopping sites
- Social media
- Any account that used the same password as your email
Watch your bank and credit card statements for the next few weeks.
Step 7: Scan your computer
If you clicked a link or opened an attachment before this happened, run a security scan. On Windows, open Windows Security and run a full scan. On a Mac, keep macOS updated, since its built-in protection updates with it.
Why it happened, and how to prevent it
Most email accounts are broken into for one of these reasons:
- A reused password that leaked from another website
- A fake sign-in page from a phishing email
- A weak password that’s easy to guess
To check if your email address appeared in a known data leak, you can look it up at haveibeenpwned.com. It’s a well-known free service. If it shows up, change any password you’ve reused.
Going forward:
- Use a different password for your email than for anything else
- Keep two-step verification on
- Keep your recovery phone number up to date, especially if you change numbers
- Be suspicious of emails asking you to "verify your account"
If you clicked a link that may have started all this, see clicked a scam link? what to do right now.
When to get help
Recovering a locked account, checking for hidden forwarding rules and setting up two-step verification can be fiddly, especially on an older AOL or Yahoo account. We help older adults with this regularly, and we can make sure you and a family member both know how to get back in next time. We work across DC, Maryland and Northern Virginia, at home or by video. Book a free 15-minute call.