How to Recover an Email Account After a Hack
If your email account was hacked, speed matters.
This guide explains how to recover email account after hack, restore access, and close the security gaps that attackers often exploit.
Email compromise is more than an inbox problem.
A taken-over account can expose password resets, banking alerts, identity data, and contacts across services like Gmail, Outlook, Yahoo Mail, and iCloud Mail.
First signs your email account was compromised
Hackers often leave subtle clues before you are locked out completely.
Recognizing the warning signs early can help you act before the damage spreads.
- Unexpected password reset emails or security alerts
- Messages in the sent folder that you did not send
- Inbox rules or filters you did not create
- Login attempts from unfamiliar devices or locations
- Recovery phone numbers or alternate emails changed without your approval
- Contacts receiving spam or phishing messages from your address
Some attacks are caused by credential theft from phishing, reused passwords, malware, or data breaches.
Others involve SIM swapping, session hijacking, or access through a compromised recovery email.
What to do immediately after you suspect a hack
Act quickly and use a separate trusted device if possible.
The goal is to cut off the attacker’s access before they can change recovery details or use your email to compromise other accounts.
- Try to sign in and use the provider’s account recovery flow right away.
- Reset the password if you still have access.
- Sign out of all sessions and devices.
- Check recovery email addresses, phone numbers, and security questions.
- Review mailbox rules, forwarding settings, and app passwords.
- Scan your device for malware and browser extensions you do not recognize.
If you cannot log in, do not keep guessing passwords repeatedly.
Too many failed attempts can slow recovery or trigger additional security checks.
Use the official recovery process from your email provider instead.
How to recover email account after hack?
The exact process depends on the provider, but the core steps are similar across Google, Microsoft, Apple, Yahoo, and business platforms such as Microsoft 365 or Google Workspace.
Start with the provider’s account recovery page and follow the identity verification prompts carefully.
1. Use the official recovery tools
Look for options such as Forgot password, Can’t access your account, or Account recovery.
Providers may ask for an alternate email, phone verification, device confirmation, or a previous password you remember.
When answering recovery questions, be as accurate as possible.
Even approximate details such as the month you created the account or the name of a saved contact can help establish ownership.
2. Check for compromised recovery methods
Attackers frequently change the recovery email and phone number first.
If your recovery options were altered, report that during the recovery process and verify whether your phone number itself may have been affected by SIM swap activity.
3. Review account activity
Once you regain access, open the security or recent activity page.
Look for unfamiliar sign-ins, IP addresses, locations, devices, and app access.
On Google, Microsoft, and Apple accounts, this history can reveal when the breach started and whether persistence mechanisms were added.
4. Remove attacker access
Change the password immediately from a trusted device.
Then sign out of all sessions, revoke third-party app permissions, remove suspicious recovery options, and delete any unauthorized forwarding rules.
If the provider supports security keys or passkeys, enable them during this step.
Secure the inbox after recovery
Regaining access is only the first phase.
A hacked mailbox often contains hidden changes that let the attacker return later unless you remove them all.
Change your password the right way
Choose a unique password that has never been used anywhere else.
Use a long passphrase rather than a short complex password, and store it in a reputable password manager such as 1Password, Bitwarden, or LastPass.
Enable multi-factor authentication
Turn on multi-factor authentication, preferably with an authenticator app or a hardware security key such as YubiKey.
SMS-based codes are better than no protection, but they are more vulnerable to SIM swap attacks and phone number compromise.
Inspect forwarding and filtering rules
Hackers often create rules that automatically forward messages, archive security alerts, or hide password reset emails.
Check all mail rules, filters, delegate access settings, and connected devices.
Remove anything you did not create.
Audit connected apps and devices
Review third-party apps that have permission to read, send, or manage mail.
Revoke access for tools you no longer use or do not recognize.
Also remove old devices from the trusted list, especially shared computers, public kiosks, and outdated phones.
Protect other accounts tied to your email
Your email is usually the recovery hub for your online identity.
If it was hacked, assume attackers may have tried password resets on other services.
- Change passwords for banking, shopping, cloud storage, and social media accounts
- Review recent login activity on financial and payment apps
- Update recovery email addresses and phone numbers where needed
- Watch for phishing messages that use stolen personal information
- Enable MFA on critical accounts, especially financial services
If the attacker accessed email confirmations from services like PayPal, Amazon, Stripe, or Coinbase, contact those providers immediately.
For business users, notify IT or the security team so they can check for lateral movement or mailbox-based phishing campaigns.
Scan your devices and browser for malware
Email takeovers can begin with keyloggers, malicious browser extensions, or infected attachments.
A clean account can be re-compromised if the device remains infected.
Run a full antivirus and anti-malware scan on every device used to access the mailbox.
Remove unknown browser extensions, clear saved sessions, and update your operating system, browser, and email app.
If you suspect advanced malware or persistent compromise, consider a professional security review or a full device reset.
Document the incident and report abuse
Save screenshots of suspicious logins, password reset notices, forwarding rules, and fraudulent messages.
Documentation helps if you need to prove account ownership or report identity theft.
Notify your contacts that your account was compromised so they do not trust suspicious links or attachment requests.
If the attacker sent spam or scams from your address, ask recipients to mark the messages as phishing.
You may also need to report the incident to the email provider, your workplace IT department, or local authorities if financial fraud, identity theft, or extortion occurred.
In the United States, consider filing an identity theft report with the FTC through IdentityTheft.gov.
How to prevent another email hack
Long-term protection depends on reducing the number of ways attackers can get in.
Strong passwords are important, but layered security is more reliable.
- Use a password manager to generate unique passwords for every account
- Turn on MFA with an authenticator app or security key
- Avoid clicking login links in unsolicited emails
- Verify website addresses before entering credentials
- Keep recovery phone numbers and alternate emails current
- Regularly review mailbox rules, app permissions, and login history
- Keep devices patched and remove untrusted software
Email providers have improved security features such as passkeys, suspicious login detection, and advanced phishing protection.
Take advantage of them, especially if your inbox is tied to work, finance, or cloud backups.
When to seek extra help
If you cannot recover the account, if the attacker changed recovery details, or if financial or identity theft is involved, move beyond self-service recovery.
Contact the provider’s support team, your employer’s security staff, your bank, and, when needed, a qualified cybersecurity professional.
For high-value accounts, it may be worth conducting a complete security reset: new passwords, fresh recovery methods, device cleanup, and a review of every important account linked to the inbox.
That extra work can prevent repeated compromise and help restore control faster.