Your email got hacked: the first-hour checklist

Why email comes first

For many of your accounts, the "forgot password" link goes to your email address. The FTC's guide to recovering a hacked account explains what that means: someone who has your email "could request a password reset link for any of your other accounts", change the password, and lock you out. Google's help page makes the same point from the other direction: after a takeover it says to change the password for apps and sites that use the same password, that contact you through that address, and where you sign in with it. An AARP article on hacked email quotes a McAfee executive calling email "the backstop security mechanism for almost all apps".

That's why the first hour matters, and why the order below puts the email account ahead of your bank. Most of the steps cost nothing and take a few minutes each. You don't need to do them perfectly; do the first few now, and come back to the rest.

How you might find out

Google's page for Gmail lists signs that fit any mailbox: friends tell you they got spam or unusual emails from you, you find sent emails you didn't write, messages were deleted from your inbox and aren't in the trash, or your username or settings changed. Yahoo adds sign-in locations you don't recognize. If a message tells you your account was hacked and gives a link to fix it, don't use the link: that is the pattern on our "your account is locked" page. Go to your email provider yourself, by typing its address or using the app you already have.

The checklist

1. Use a device you trust. If you can, work from a phone, tablet or computer that the person couldn't have reached, and make sure its security software is up to date. The FTC says to update your security software and run a scan, and if the scan finds suspicious software, delete it and restart your computer before you follow your provider's recovery steps; Microsoft says to run a full scan of your PC before you change your password. If someone had remote access to your computer, start with our computer section first.
2. Change the password. Make it strong, and one you have never used anywhere else. We cover this on "I typed a password"; the FTC also says to sign out of all devices once it's changed, so anyone still signed in is removed. Write the new password down somewhere safe at home first, because your own phone and tablet will ask for it. If you can't sign in because the password was changed, go straight to your provider's account-recovery page (see the list below) rather than a search result.
3. Turn on two-step verification. Also called two-factor or multi-factor authentication, it asks for a second proof (a code or an app prompt) when you sign in. Before you turn it on, choose a second step you will still have next month, save any backup codes your provider offers (print them, or keep them somewhere safe at home), and keep the phone number on the account current, or you could lock yourself out later. CISA's guide says to look in your account's security settings, and the options include a code by text or email (not by email, if email is the account that was hacked), an authenticator app, or a fingerprint or face. It helps, with limits: the FBI warns that "MFA will not protect you if you land on a fraudulent login page," and never read a code to anyone who contacts you. If it was already on, check that the phone numbers and devices listed are yours: an expert quoted by AARP says thieves have been "setting up multi-factor authentication with their own contact information."
4. Check the recovery email address and phone number. Attackers add their own so they can get back in. The FTC says: "Make sure the recovery email addresses and phone numbers listed are ones you entered and have access to." Apple adds that you should check with your email provider and phone carrier that you control every address and number tied to your account, for example that text-message forwarding hasn't been set up on your number.
5. Look for forwarding and filter rules. Attackers set these up to get copies of your mail or to hide replies and security alerts from you. The FTC says: "Check your email settings to see if there are rules set up to forward emails." Gmail's help page lists the settings to review: mail delegation, automatic forwarding, scheduled emails, automatic replies, the address on outgoing mail, blocked addresses, remote access (IMAP or POP), filters and labels. Yahoo's help lists new filters, a changed sending name, added send-only addresses, unfamiliar automatic replies, and forwarding to an address you don't know. Microsoft's says to review connected accounts, forwarding and automatic replies. Delete or turn off any you didn't set up.
6. Read your sent and deleted folders. The FTC says: "Check your sent folder for emails the hacker sent from your account." It tells you who they wrote to, and what they said in your name. Look in trash or deleted mail too, because they may delete what they've read or sent. This is also how you learn whom to warn.
7. Warn your contacts. We'd use a different way to reach them if you can, such as a call or a text, in case the attacker can still see your mail. The FTC's wording to pass on: "Tell them not to click on links in emails from you and to ignore pleas for help or money." The example at the top of this page is one way to say it.
8. Secure the accounts that depend on this email. Start with any that use the same password, then the ones that would let a thief move money or open credit: banks, cards, investment, payment apps, your phone company and shopping accounts. Google's page lists accounts that use the same password, those that contact you at this address and those where you sign in with it; a security expert quoted in the AARP article suggests an order of email, finances, medical, social media, then everything else. Change each password from your trusted device.
9. Check your bank and credit accounts. Read the last few weeks of statements and alerts for anything you didn't do. If you see something, or if your mailbox held bank, tax or identity details, call your bank or card company at the number on the back of your card. Google's page says to tell your bank or government agency if someone could have given them instructions in your name, such as opening an account or moving money, which matters when your account held banking, tax or passport details. Our card and bank steps cover disputes and their time limits. If your Social Security or Medicare number was in your mail, see that section for a free credit freeze and an IRS Identity Protection PIN.

Where each provider keeps the settings

The names of the buttons differ and change. These are the providers' own help pages, each opened on the date in the source list below:

• Gmail and Google accounts: Secure a hacked or compromised Google Account, and Turn on 2-Step Verification.
• Outlook.com, Hotmail and other Microsoft accounts: How to recover a hacked or compromised Microsoft account.
• Yahoo Mail: Recognize a hacked Yahoo Mail account. Yahoo's page says it was written for an older version of Yahoo Mail on the desktop, so some names may differ.
• iCloud Mail and Apple accounts: If you think your Apple Account has been compromised.
• AOL, Comcast, AT&T, Spectrum and others: use your provider's own help site, reached by typing its address or through its app. We didn't open those providers' pages, so we don't link them. The FTC warns that scammers sometimes use paid search results, so a number or page that comes up in a search may not be your provider's.

If you can't sign in at all

Use the provider's account-recovery page from the list above. Expect questions meant to show the account is yours; Google's page says to answer them as best you can. The FTC's page links recovery guides for several providers. While you wait, treat every other account that uses that email as exposed and start on step 8 from a trusted device.

After the first hour

• Report it. The FBI's Internet Crime Complaint Center takes complaints about crimes online. If someone used your details to open accounts or file for credit, report it at IdentityTheft.gov. AARP's article also points to the Identity Theft Resource Center, and AARP lists a free Fraud Watch Network helpline on its scams and fraud page.
• Keep watching. Check the recovery details and rules again in a week, and keep an eye on statements for the next few weeks.
• Don't pay for "recovery." Don't pay anyone who offers to fix your account or recover lost money for a fee. See our "if you clicked" page.

More on the larger picture: I typed a password and Report it.

Related patterns

• “Your account is locked” and other account warningsA problem with your account, and a link to sign in and fix it.
• Calls and texts from “your bank’s fraud department”A fraud alert, a code to read back, and a push to move money.
• Pop-ups and calls about a problem with your computerA warning that won't close, and a number to call.