How to Recover a Hacked or Locked Email Account
Few tech moments are as gut-wrenching as realising you've lost access to your email — or that someone else has gained it. Your inbox is the master key to almost everything else: shopping, banking, social media, and the password resets for all of them. The instinct is to panic, but the right response is to move quickly and methodically. Do that, and you can usually get back in and lock the account down for good. Here's the plan, step by step.
How to tell your email's been compromised
Sometimes it's obvious — you simply can't log in. Other times the signs are subtler: friends mention spam "from you", you spot sent messages you didn't write, password-reset emails arrive for accounts you didn't touch, or your security settings have quietly changed. Any of these means it's time to act. The faster you do, the less damage an attacker can cause.
1. Act fast from a trusted device
Use a device you know is clean — your own phone or computer, not a public or shared one — and don't click any links in suspicious emails while you do it. Speed genuinely matters: the sooner you regain control, the less an attacker can reset, read or send in your name.
2. Use account recovery
Go to your email provider's "forgot password" or account-recovery page and follow the steps. You may be asked to verify via a recovery phone number, a backup email, or security questions. If the attacker has changed those recovery details, look for the provider's dedicated "my account was hacked" or "I can't access my recovery options" flow — all the major providers have one, and it's designed for exactly this situation.
3. Reset to a strong password
Once you're back in, immediately set a long, unique password you've never used anywhere else — a passphrase of a few random words works well. Crucially, if you reused that old password on other sites (most people do), change it on those too, because attackers try stolen passwords everywhere. Our guide to strong passwords and MFA covers how to do this painlessly with a password manager.
4. Lock it down
Now slam the door shut. Turn on two-factor authentication so a stolen password alone can never get anyone in again. Then hunt for the things attackers leave behind: unknown recovery phone numbers or backup emails they added, and — the sneaky one — mail-forwarding rules or filters that quietly send copies of your incoming mail to them. These let an attacker keep reading your email long after you've changed the password, so check and remove anything you don't recognise.
5. Check the damage and warn others
Review your sent items to see what went out, and your account's list of connected or third-party apps — revoke anything unfamiliar. If spam was sent from your address, a quick heads-up to your contacts ("if you got an odd message from me, ignore it") stops the scam spreading. In the UK you can report it via Action Fraud, and your bank if any financial details were exposed.
What the attacker was probably after
Understanding the motive helps you check the right things. Most email compromises aren't personal — they're after money or more accounts. Common goals are sending convincing phishing from your trusted address, resetting your other accounts, or hunting your inbox for bank details and invoices to enable payment fraud. Knowing this, pay particular attention to anything financial: check no invoices were tampered with and that your banking and shopping accounts are still secure.
How they got in — and how to stop it next time
Email accounts are usually breached one of three ways: a reused password that leaked in another site's breach, a phishing page that tricked you into typing your login, or malware on a device. The defences are simple and the same in every case — a unique password, 2FA on, and caution with links. Set those up properly once and a repeat is extremely unlikely.
Worried your device is compromised too?
If you think malware is behind it — rather than a leaked password — your device itself needs checking, because resetting your email won't help if something on your computer is capturing it. Our computer repair and cyber security teams will check your devices, remove anything unwanted, and help you secure your accounts properly. And if a tech-support scam was involved, we can advise on that too.
Official guidance: The NCSC has a step-by-step guide to recovering a hacked account, and any fraud should be reported to Action Fraud.