How to recover a hacked email account
2 min read · Updated October 15, 2026
Use your provider’s official account-recovery page, verify identity through a recovery email, phone or backup code, set a new unique password, sign out all sessions, remove forwarding rules and connected apps, and enable two-factor authentication. Then change passwords on accounts that depend on this email.
If you can still log in
Act quickly. Change the password, sign out of all other sessions and review security settings, including recovery details, forwarding rules and connected apps. Attackers often add their own recovery details so they can return.
If you are locked out
Go to your email provider’s official recovery page and follow the prompts. Use a device and location you have signed in from before, if possible, because providers use that to confirm it is really you. Have your recovery email, phone and any backup codes ready.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Clean up after you regain access
- ✓Remove unfamiliar recovery emails and phone numbers.
- ✓Delete unknown forwarding rules and filters.
- ✓Revoke connected apps and authorised devices.
- ✓Check sent, deleted and archived folders for signs of what the attacker did.
- ✓Look for password reset emails that reveal which other accounts they tried to reach.
Protect the accounts connected to the email
If the attacker had access to your inbox, they may have seen password reset links or saved information. Change the passwords on banking, shopping and social media accounts, and watch for fraud.
Recovery checklist
- 1Use the provider’s official recovery page to regain access.
- 2Set a new, unique, long password.
- 3Sign out of all sessions and devices.
- 4Remove rogue forwarding rules, filters, recovery details and apps.
- 5Turn on two-factor authentication with an authenticator app or passkey.
- 6Change passwords on connected accounts, starting with banking.
- 7Notify contacts that they may have received scam messages.
Frequently asked questions
What if I have no recovery options left?+
Use the provider’s support recovery form and provide as many details as you can: past passwords, creation date, contacts and folders. Success depends on the provider.
Can I see what the hacker did?+
Check account activity logs, the sent and deleted folders and connected apps. Providers show recent sign-ins and devices.
Should I report it?+
Report the incident to your provider, and to your bank or local cybercrime reporting service if money or identity fraud is involved.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.