Your email account is the key to most of your other accounts, so a takeover needs a calm, ordered response. Intruders often change settings quietly so they can keep watching even after you change your password. This guide takes you through regaining access, removing their foothold and checking the accounts linked to your inbox.
Step by step
Secure a clean device first
Use a device you believe is safe, ideally one with up-to-date software and a recent security scan. If you suspect the computer you normally use has malicious software on it, do not use it to change passwords until it has been checked, or the new password may be captured too.
Regain access through official recovery
If you can still sign in, change the password immediately to a new, unique one. If you are locked out, use the provider's own account recovery process from their genuine sign-in page, never a link sent in a message. Answer the recovery questions from a familiar device and location if you can, because providers use these signals to confirm it is you.
Sign out everywhere and turn on 2-step verification
Use the security settings to sign out of all other sessions and devices. Turn on 2-step verification with an authenticator app, passkey or security key if offered, and save the new recovery codes somewhere safe offline.
Undo hidden changes
Check the recovery phone number and email, forwarding addresses, filters that move or delete messages, auto-replies, the signature, connected third-party apps and any delegated access. Remove anything you did not set up, as intruders commonly use forwarding rules and filters to keep reading your mail or hide warning emails.
Check what was sent and warn contacts
Look in the sent and deleted folders for messages you did not write, such as requests for money or links. If anything went out, send a short message to affected contacts saying your account was compromised and asking them to ignore and delete it.
Protect linked accounts
Search your inbox for password reset emails and account notifications to see which services use this address. Change passwords for any that shared the old password, starting with banking, shopping and social media, and turn on 2-step verification for each. If money is involved, call your bank on the number on your card and report to Report Fraud, or to Police Scotland on 101 in Scotland.
Ready-to-use checklist
- Clean device used for recovery
- New unique password set
- All other sessions signed out
- 2-step verification on and recovery codes stored offline
- Recovery phone and email confirmed as yours
- Forwarding rules, filters and connected apps checked
- Contacts warned if messages were sent
- Linked accounts with reused passwords changed
Practical tips
- Keep a dated note of what you found and changed, in case you need to report it later.
- Add a second recovery route now, such as a trusted family member's email, if your provider allows it.
- Expect follow-up phishing that mentions the incident and treat it with extra suspicion.
Common problems
The recovery process keeps failing. What now?
Try again from a device and location you have used often, and give as much accurate history as you can, such as old passwords and when you opened the account. Some providers have a longer manual review route. Meanwhile, update linked accounts to use a different email address so you are not stuck.
The intruder changed my recovery phone number.
The provider's recovery process may still recognise your old details for a period, so try it promptly. Contact your mobile network too if you suspect your number has been moved to another SIM without your permission.
I think my computer itself is infected.
Stop using it for sign-ins, run a full scan with up-to-date security software and follow the maker's guidance. If problems continue, a reputable local repair service can check it, or you may need to back up personal files and reinstall the operating system.