What to do if your email account is hacked

Your email is the master key to your digital life. Everything else — banking, shopping, social media — resets through it, which is why it's the account attackers want most.

If you think yours has been taken over, order matters. Do these in sequence.

Signs it's actually been compromised

Not every oddity means a break-in, but these do.

Contacts receiving messages you didn't send, especially odd links or invoices
Sign-in alerts from places you've never been
Password reset emails you didn't request, for other services
Messages disappearing from your inbox, or replies to conversations you've never seen
Your password suddenly not working

Step one: get control back

Use a device you trust. If your own computer might be infected, use a phone or another machine.

Change the password to something long and unique you've never used elsewhere
Turn on two-factor authentication immediately, before anything else
In the account's security settings, sign out all other devices and sessions
Check and correct the recovery phone number and recovery email address

Step two: the hidden rules nearly everyone misses

Attackers routinely leave a quiet way back in, and changing the password doesn't remove it. Check all of these in your mail settings:

Forwarding — is a copy of everything being sent to an address you don't recognise?
Rules or filters — anything that deletes, archives or moves messages containing words like invoice, bank or password
App passwords and connected apps — remove anything unfamiliar
Aliases or send-as addresses that you didn't add
The auto-reply, which is sometimes altered to redirect people

Step three: contain the damage

Assume anything sitting in the mailbox has been read.

Change the password on any account that uses this email address, starting with banking and anywhere a card is saved
Tell your contacts — briefly and without embarrassment — so they ignore anything odd they received
Check your sent items and deleted items to see what was actually sent
If you run a business and invoices go through this mailbox, warn customers to verify bank details by phone before paying
If financial data was exposed, contact your bank and report it to Action Fraud

Stopping the repeat

Almost every compromised mailbox we see comes down to one of two things: a password reused from a site that was breached, or a convincing phishing page that harvested the login.

A unique password plus two-factor authentication removes both. If the break-in also involved software on the computer, get the machine checked — a password change means nothing if something on the device is still capturing what you type.