What should I do first if my email account has been hacked?

Go to your provider's official recovery page by typing the address yourself, not by following a link in a message. Sign back in or use the forgot-password flow, then change the password immediately. Once you are in, sign out of all devices before doing anything else, because an attacker's session can survive a password change.

How do I know if a hacker set up email forwarding?

Open your provider's settings and look for forwarding addresses, filters, rules and auto-replies. Anything you did not create should be deleted. Attackers commonly forward copies of your mail to another address or hide password-reset messages in a folder. If your provider shows creation dates, note them to work out how long the attacker had access.

Should I change passwords on other accounts too?

Yes, starting with banking, payment services and anything that resets via your email. Your inbox is the master key to other accounts, so a hijacked mailbox puts them at risk. Set a unique password for each and enable two-factor authentication where offered. Any password you reused elsewhere should be treated as compromised.

Can a disposable email address protect me from account takeovers?

Partly. A disposable address used for one-off signups limits the fallout when that site leaks, because it is not tied to your bank or contacts. But it is not a recovery route for a real account and should never be used for banking, work or anything you need long-term. Use a real address with strong two-factor authentication for accounts that matter.

What if I cannot remove the recovery address the attacker added?

Some providers deliberately lock recovery changes for a period after they are made, to stop hijackers reversing a legitimate change. If the interface will not let you remove an unfamiliar address or phone number, contact the provider's support directly and explain what happened. Keep a note of the changes you made and when.

Email Account Hacked? The First Ten Minutes, Step by Step

If your email account has been hacked, the first steps are: regain access through the provider's official recovery flow, then immediately change the password, sign out every active session, and check forwarding rules, filters and recovery addresses for anything you did not set up. After that, rotate passwords on accounts that use that address and warn your contacts. Do these in order — a changed password alone leaves the attacker's hidden routes open.

Why order matters more than speed

Most people's instinct is to change the password and stop. That closes the front door but leaves the windows open. A typical account takeover involves several changes made quietly over hours or days: a forwarding rule that copies your mail elsewhere, a filter that hides password-reset emails from a bank, an added recovery phone number, an app password or a connected third-party application that keeps working after a password reset.

Work through the steps below in sequence. If you are reading this on the same device that may be compromised, borrow a different one — a phone on mobile data is fine. Avoid typing new passwords into a machine you do not trust.

Step 1: Regain access through the official route

Go directly to your provider's own recovery page by typing the address into the browser bar. Do not follow a link in an email or text saying your account has been compromised — that is a classic phishing lure, and it is worth reading how to spot a phishing email before you click anything.

Password still works? Sign in and move to Step 2 immediately.
Password changed by someone else? Use the provider's "forgot password" flow. If the recovery address or phone number has been altered, you will need the provider's account-recovery form, which usually asks for details only the real owner would know.
Locked out entirely? Contact the provider's support through its official help centre. Expect identity checks; that is normal and is there to stop the attacker doing the same thing.

If the account is protected by two-factor authentication and the attacker added their own device, you may need to use a backup code or the recovery process. This is exactly why backup codes matter — see our explainer on SMS vs apps vs passkeys for how each method behaves when things go wrong.

Step 2: Change the password and sign out everywhere

Once you are back in, change the password to something long and unique — a passphrase of several unrelated words is easier to remember and harder to crack than a short jumble. Do not reuse a password from anywhere else.

Then find the "sign out of all devices" or "active sessions" control. Every major provider has one, though the wording and location differ and change over time, so search the provider's help pages for the current name. Signing out everywhere invalidates session tokens the attacker may be holding, which a password change alone does not always do.

If you cannot find the session control, the provider's help centre search box is faster than guessing menus. Search for "sign out all devices" plus the provider name.

Step 3: Check forwarding, filters and auto-replies

This is the step most people skip and the one attackers rely on. Look for:

Forwarding addresses you did not create. Any mail arriving at your inbox could be copied to an address you have never seen.
Filters and rules that move messages from particular senders — banks, password resets, invoices — into an obscure folder or straight to trash.
Auto-reply or vacation messages set up to harvest information from people who write to you.
Linked or delegated accounts that grant someone else access to your mailbox.

Delete anything you do not recognise. If your provider shows a creation date, note it — it helps you work out how long the attacker had access.

Step 4: Audit recovery details and connected apps

Your recovery address and phone number are the keys to the account. If an attacker changed them, they can take the account back after you reset the password. Confirm they point to you and nothing else.

Then review connected applications and app passwords. Older protocols and third-party tools sometimes use a separate password that survives a main password change. Revoke anything unfamiliar. If you use an email client with stored credentials, re-enter the new password there yourself rather than letting a stale one linger.

What if the attacker set up a new recovery address you cannot remove?

Some providers lock recovery changes for a period after they are made, precisely to stop hijackers. If the interface refuses to let you remove an unfamiliar address, contact support and explain the situation. Keep a record of what you changed and when.

Step 5: Rotate passwords on linked accounts

Your email address is the master key to almost everything else, because password resets go there. Work through the accounts that matter most, in this order:

Banking and payment services
Government and tax portals
Your main social and messaging accounts
Shopping accounts with saved cards
Cloud storage and work tools

For each, set a new unique password and check the recovery details there too. Where two-factor authentication is offered, turn it on — an authenticator app or a passkey is generally stronger than SMS, though SMS is far better than nothing.

If the same password protected several sites, treat all of them as compromised. Reuse is what turns one leaked password into a cascade of break-ins.

Step 6: Warn your contacts — carefully

Attackers often use a hijacked mailbox to send convincing requests to your contacts: a short message asking for a favour, an invoice, a link. Warn people before they act on one.

Use a channel other than the compromised mailbox — a phone call, a message in another app, or a post where appropriate.
Say plainly what happened and that any message from your address in the affected window should be treated as suspect.
Do not forward the suspicious message itself; describe it instead.

Also check your sent folder and trash for messages you did not write. They tell you what the attacker was doing and give you evidence if you need to report the incident.

Was this a breach somewhere else?

Many account takeovers start with a password leaked from an unrelated service. If you learn that a company holding your data was breached, our guide on what to do after a data breach exposes your email walks through the follow-up. A password manager helps here: it makes unique passwords per site practical, so one leak stays contained.

Where disposable addresses fit — and where they do not

A throwaway address used for a one-off download or a trial signup limits the damage when that site leaks, because the address is not tied to your bank or your main contacts. That is a sensible habit, and it is the reasoning behind our guide to what a disposable email actually is.

But be honest about the limits. A disposable inbox is not a recovery route for a real account, and it should never be the address on your bank, your employer's systems or anything you would need to recover years later. For accounts that matter, use a real address with strong two-factor authentication. For throwaway signups, a temporary inbox keeps the noise out of your main mail.

What to do differently next time

Recovery is stressful; prevention is mostly boring admin. A short checklist:

Use a password manager and let it generate unique passwords.
Turn on two-factor authentication everywhere it is offered, and store the backup codes offline.
Keep your recovery email and phone number current — and check them occasionally.
Review active sessions and connected apps a few times a year.
Separate identities: a real address for people and finance, alias or disposable addresses for signups.

If you are unsure which tool suits which job, temp mail vs VPN vs alias sets out the differences without the marketing.

Sources

NIST Digital Identity Guidelines, SP 800-63B — authentication and password guidance: pages.nist.gov/800-63-4/sp800-63b.html
NIST SP 800-63B, section on memorised secrets and verifier requirements: pages.nist.gov/800-63-4/sp800-63b.html#password
Google Account Help — official recovery and security-check documentation: support.google.com/accounts
Microsoft Support — account recovery and security info: support.microsoft.com

In short

Regain access through the official route, change the password, sign out every session, then hunt for forwarding rules, filters, recovery addresses and connected apps before you touch anything else. Rotate passwords on linked accounts, warn contacts through a different channel, and check your sent folder for messages you did not send. The password is only the first lock; the hidden settings are the rest.