Email Hacked? How to Take It Back and Lock It Down

Takes 20 to 30 minutes. Free. Do the steps in order.

1. Check the signs

Your email is probably hacked if:

• Friends get emails or spam from you that you didn't send.
• You get alerts about a password, phone number or login change you didn't make.
• You see sign-ins from devices or places you don't recognize.
• Emails stop arriving, or settings changed on their own.
• Your password suddenly doesn't work.

Your password doesn't work and you can't get back in at all? Use our locked-out account recovery guide for Gmail, iCloud or Outlook.com. For Yahoo Mail, use Yahoo's Sign-in Helper, from Yahoo's own sign-in page typed in yourself. Then come back here for steps 4 to 7.

2. Use a clean device

If malware stole your password, it can steal the new one too. Microsoft's advice is to run a virus scan first.

• Windows: open the Windows Security app, go to virus and threat protection, then Scan options > Full scan > Scan now. Remove anything it finds.
• Not sure your computer is clean? Our read: do steps 3 to 7 from your phone instead.

3. Change your password

Make it long and new. Never reuse an old one.

• Gmail: open your Google Account, go to Security & sign-in and change your password there.
• Outlook.com: go to account.microsoft.com/security and change your password there.
• Yahoo Mail: open your Yahoo account's security page and change your password.
• iCloud Mail: on iPhone, open Settings, tap your name, then the sign-in and security section, and change your password. On a computer, sign in at account.apple.com.

Reused that password on other sites? Give each of them a new one too.

Spotted a recovery phone or email that isn't yours? Remove it now (see step 7) before you carry on.

4. Sign out everywhere

This kicks the hacker off any device still signed in.

• Gmail: Google Account > Security & sign-in > Your devices > Manage all devices. Sign out of any device you don't recognize.
• Outlook.com: on account.microsoft.com/security, open the advanced security settings, find Sign out everywhere and confirm with Sign out. Allow up to a day for it to finish. Microsoft says this doesn't include an Xbox console, which has its own sign-out steps.
• Yahoo Mail: on your account's security page, open Current sign-ins, pick any device that isn't yours and sign it out. Then, under External connections > App passwords, delete any you didn't create.
• iCloud Mail: at account.apple.com, open Devices and remove anything that isn't yours.

5. Turn on two-step verification

Then a stolen password alone won't get anyone in.

• Gmail: Google Account > Security & sign-in > Turn on 2-Step Verification.
• Outlook.com: on account.microsoft.com/security, find the two-step verification setting and turn it on. Microsoft's pages name the menu that holds it differently, so look for it among the sign-in options.
• Yahoo Mail: on your account's security page, look under Ways of signing in for 2-step verification.
• iCloud Mail: Apple says most Apple Accounts use two-factor authentication by default. To check, open Settings on your iPhone, tap your name, then the sign-in and security section, and look for two-factor authentication.

6. Remove sneaky forwarding and filters

A common trick: the hacker sets your inbox to pass every new email on to them, or to tuck replies out of sight. A new password doesn't undo it.

• Gmail: on a computer, Settings (gear) > See all settings > the forwarding tab > Disable forwarding > Save Changes. Then open Filters and Blocked Addresses and delete any filter you didn't make.
• Outlook.com: Settings > Mail > Forwarding, untick Enable forwarding, then Save. Next, Settings > Mail > Rules: for any rule you didn't create, use More actions (⋯) > Delete rule.
• Yahoo Mail: go through your mail settings and look at forwarding, filters, the reply-to address, your name and signature, the vacation reply and blocked addresses. Undo anything you didn't set yourself.
• iCloud Mail: on a computer, go to icloud.com/mail, click the settings button above your mailbox list and choose Settings. Open the forwarding section in the sidebar and untick Forward my email to. Then open Rules, select any rule you didn't make and delete it. Rule changes can take up to 15 minutes to apply.

7. Fix your recovery phone and email

A hacker may have swapped in their own, so they can reset your password again later.

• Gmail: in your Google Account, under Security & sign-in, make sure the recovery phone and recovery email are yours.
• Outlook.com: in the advanced security settings at account.microsoft.com/security, go through every phone number and email used to verify it's you. Remove any that aren't yours.
• Yahoo Mail: on the Account Security page, make sure your recovery phone and email are yours and up to date.
• iCloud Mail: at account.apple.com, correct any personal or security details you don't recognize, including phone numbers.

Last, warn your contacts that recent emails from you may be fake, and that they shouldn't click links or send money.