Email account hacked: how to recover it and lock it down

Start by understanding what an attacker actually gains, because it determines the order of everything that follows. The NCSC's guidance on email passwords sets out three things a criminal with your inbox can do: access private information about you, including your banking details; post emails and messages pretending to be from you, and use that to trick other people; and reset all your other account passwords, which gives them access to all your other online accounts. The third of those is the one that matters. Your email address is not a communication channel to a criminal — it is a master key.

Work outwards from that and the scope becomes clear. Your bank, your energy supplier, your mobile network, your online shopping accounts, your social media, your cloud storage and the government services you use are all reachable through a password reset sent to that address. GOV.UK One Login, which the government says will over time replace every other way of signing in to services on GOV.UK including Government Gateway, is managed by signing in and changing your sign-in details — your email address, your password, or how you get security codes. HMRC's own guidance on unauthorised access describes the same pattern from the other end: access codes arriving on your phone when you have not tried to sign in, a password that no longer works, changes to tax records you did not make.

This is why an email compromise is so often the first step in something larger rather than the whole of the incident. A criminal rarely wants your emails. They want the accounts those emails unlock, and the credibility of messaging your contacts from an address they already trust — both time-limited advantages, which is why speed matters more here than in most consumer problems.

The other side of that is reassuring, and worth saying because people in the middle of this tend to catastrophise. Almost all consumer email compromise is opportunistic. The usual cause is a password reused on a site that suffered a data breach and then tried automatically against thousands of email providers — the NCSC's data breach guidance describes criminals doing exactly this. Nobody chose you, and the fix is mechanical rather than mysterious.

One practical implication follows immediately. If the password on your email account was one you had used anywhere else, every account sharing that password is compromised too, whether or not anything has happened on it yet. The NCSC and the government's Stop! Think Fraud service both say the same thing: change the password on the hacked account, and change it on every other account where you used the same one. Treat that as part of the incident, not as a later tidying-up job.

One last thing about how you use the mailbox from here on. Until you have completed the clean-up below, assume anything you send or receive may be visible to someone else — so do not email yourself passwords, document scans or recovery codes, and use a phone number or authenticator app rather than the inbox for the confirmations on accounts you are about to secure.

If you can still sign in, you are in a far stronger position than you feel, and you should use it before that changes. The single most useful thing you have is the ability to act without going through an identity check, so do the irreversible things first and the tidying afterwards.

Run a full antivirus scan before you change the password. This ordering is not fussiness — Microsoft's guidance on recovering a compromised account puts it as step one and explains why: if the device you are typing on is running credential-stealing software, a new password is captured the moment you set it. Open whatever antivirus you have, update it, and run a full scan rather than a quick one, letting it clean up what it finds. On Windows, Microsoft Defender is built in and does this without any additional purchase.

Then change the password, and change it to something you have never used anywhere. The NCSC recommends three random words as a way of producing something long enough to resist guessing and memorable enough to actually use, or a password manager to generate and store a genuinely random one. Do not recycle a variation of the old password — an attacker who had the old one will try the obvious variations first.

Next, sign out everywhere. Every major provider has a control that terminates all active sessions on every device and app, usually in the security or privacy settings. This matters because a password change does not always invalidate an existing logged-in session, and an attacker sitting in a browser session on their own machine can carry on regardless. Stop! Think Fraud lists this as a distinct step for exactly that reason: once you have changed the password and signed out everywhere, you and anyone else attempting to use the account will be prompted for the new password, and only you have it.

Turn on 2-step verification while you are in the settings, if it is not already on. The NCSC describes 2-step verification — also called two-factor authentication or multi-factor authentication — as one of the most effective ways to protect an account, because it keeps a criminal out even when they know the password. If your provider offers a choice, an authenticator app or a security key is stronger than a code sent by text message, because SIM-swap fraud defeats text codes. Whatever you choose, make sure the second factor is something the attacker does not already control.

Only now check the damage: your sent items, your deleted items, your recent security activity, and your account recovery settings. Google's guidance on securing a compromised account tells you to review recent security events and the list of devices signed in to the account, and to correct immediately any unfamiliar change to your recovery phone number, recovery email address, alternate or contact email address, or the name on the account. Attackers change those first, because it is what stops you taking the account back later.

Finally, warn your contacts. Both the NCSC and Stop! Think Fraud list this as a formal step rather than a courtesy. Messages sent from your address in the past few days may have carried malicious links, and the people most likely to click them are the ones who know you. A short, unembarrassed message saying the account was compromised and that anything unusual from it should be ignored does more good than any amount of individual apology later.

If the password has already been changed, you are into account recovery, and there is one hard truth to absorb before you start. There is no UK regulator, ombudsman or government body that can compel a private email provider to give you your account back. The NCSC's guidance is explicit that recovery runs through the provider: go to the account provider's website, find their help or support pages, and follow the recovery process they publish. Report Fraud, Police Scotland, the ICO and your bank all have roles in this incident, but none of them is the route back into the mailbox.

The recovery process is an identity test dressed up as a form, and it is scored rather than passed. Google's own advice on completing account recovery is unusually candid about this: answer every question rather than skipping ones you are unsure about, because wrong guesses do not end the process; use a device, browser and location you normally sign in from, because familiarity is itself evidence; and if you are asked for the last password you remember, give the most recent one you can recall, or your best guess if you cannot. Each of those is a signal the provider weighs. Attempting recovery from a borrowed laptop in an unfamiliar country is the single most common reason a genuine owner fails.

Microsoft runs the equivalent process through a sign-in helper that asks for the email address or phone number and then either offers self-help or routes you to an agent, with a separate account recovery form where the usual verification is not possible. Apple, Yahoo and the smaller UK providers each run their own version. The mechanics differ; the logic does not.

The hardest case is the one this page exists for: the attacker has already changed the recovery phone number and the recovery email address, so every code the provider offers to send goes to them. Do not treat that as the end of the road. Providers keep a history of the settings on an account and can see that a recovery address was added days ago rather than years ago. Work through the recovery flow anyway, use the option to try another way when a challenge routes to an address you no longer control, and supply everything you can evidence — the approximate creation date of the account, the recovery details as they used to be, the names of frequent correspondents, the labels and folders you created, and the subscriptions or purchases tied to the address.

Expect delay, and do not read it as refusal. Providers deliberately slow down requests that look risky, because an instant recovery process is itself an attack route — the same form that gets you back in would get a criminal in. If a request is refused, submit again from a device and location you use routinely, with more supporting detail.

If recovery genuinely fails, both the NCSC and Google say the same thing: open a new account. It feels like defeat and it is not. Choose a new address, tell your contacts it has changed, and then work methodically through the accounts in the next two sections, changing the registered email address on each one. The old inbox stays in the attacker's hands, which is precisely why the sweep matters — every account still pointing at it remains reachable by them indefinitely.

One thing to avoid entirely: paid account recovery services. There is no privileged channel into a provider's recovery process, and approaching people who claim otherwise usually produces a second fraud on top of the first.

This is the section most guidance skips and the one that decides whether the compromise is over. A password change closes the front door. It does nothing to the arrangements an attacker made while they were inside, and several of those keep working indefinitely.

Start with forwarding. The NCSC names this as the specific tactic to look for, describing how criminals set up a forwarding rule so that they will automatically be sent a copy of all emails sent to your account, which lets them go on resetting passwords long after you have locked them out. Stop! Think Fraud gives the same instruction and puts it before the password change: check and switch off any unwanted forwarding rules in your email account settings, then change your passwords. Look in the settings under forwarding, and check for forwarding configured at the level of an individual filter as well as the account-wide setting.

Then the filters and rules. A rule that files anything containing the word 'bank', 'invoice' or 'security alert' straight into the archive or the deleted items folder is invisible in normal use and is what allows fraud to run in your name without you seeing a single warning email. Google's guidance tells you to remove any labels, filters or forwarding rules you did not set up; Microsoft's tells you to check connected accounts, forwarding and automatic replies, and notes that it resets some account settings itself after a compromise. Go through the list line by line and delete anything you do not positively recognise.

Automatic replies deserve their own look. An out-of-office message telling every correspondent to send future mail to a different address is a slow redirection of your entire correspondence, and most people never open that settings page from one year to the next.

Now the permissions layer, which is where the longest-lived access hides. Look for third-party apps and services you have granted access to the mailbox, application-specific passwords issued to mail clients, connected or linked accounts, and any delegated access or shared mailbox permissions. Each of these authenticates without your password and therefore ignores the fact you have changed it. Revoke everything you cannot identify, and re-authorise the handful you actually use afterwards.

Finally, put the recovery details back the way they should be. Check the recovery phone number, the recovery email address, any alternate or contact address, the account name and the security questions, and remove anything you did not add. Google flags exactly these as the settings to correct immediately after a compromise. An attacker who leaves a recovery address in place has left themselves a door they can use whenever they choose.

Do all of this before you consider the incident closed, and do it in a session where you are logged in on a device you trust. If the account has a security or activity log, read it afterwards: a second unfamiliar sign-in appearing days later is the signal that something in this list was missed.

With the mailbox itself clean, the question becomes what was done with it, and the honest answer is that you will not know until you look. Work in order of how much damage each account can do rather than alphabetically, and check the account itself rather than relying on the email confirmations — an attacker who set up a deletion filter has already made sure you never saw them.

Money first. Check bank and card statements line by line, including very small transactions, because a test payment of a pound or two commonly precedes a large one. Both the NCSC and Stop! Think Fraud list watching bank statements and shopping accounts as a formal recovery step. If you find anything you did not authorise, call your bank — dialling 159 connects you securely to your own bank's fraud team and cannot be spoofed. The existing guide on reporting a scam covers what happens next, including the reimbursement rules for bank transfer fraud, and there is no point repeating that here.

Then the shopping and delivery accounts, which are where email compromise most often turns into loss. Look for changed delivery addresses, new saved cards, gift card purchases and stored balances spent down. These accounts rarely have 2-step verification turned on by default, and they are the easiest to monetise quickly.

Then tax and government. HMRC publishes a dedicated route for exactly this: if you still have access, you can sign in to HMRC online services and report suspicious activity from the security console; if you cannot, there is an online reporting form that asks for an email address, a contact number with preferred times, and details of the suspicious activity. HMRC says it aims to phone or email you within 10 working days of a report. The signs it tells you to look for are access codes arriving when you have not tried to sign in, a password that no longer works, changes to tax records you did not make, and letters or payments from HMRC you were not expecting.

Then GOV.UK One Login, which is now the sign-in for a growing list of services and which the government says will in time replace Government Gateway. It is managed by signing in and changing your sign-in details — the email address, the password, or how you get security codes — so if your email was compromised, treat the One Login as compromised too and change all three. Note that it does not yet cover every government service; Universal Credit, for instance, still has its own sign-in.

Then everything that holds documents or identity data: cloud storage, photo libraries, and any account where you have ever emailed yourself a passport scan or a payslip. Google specifically flags this, telling people to contact their bank or the authorities if personal information such as tax or passport details was stored in the account. If identity documents were exposed, the separate guide on identity theft covers protective registration and the credit reference agencies, which is the right next move and is not repeated here.

Finally, the social and messaging accounts registered to the address, and any account belonging to someone else that you administer — a club, a business page, a shared subscription. Compromise spreads sideways through shared admin rights more often than people expect.

Unauthorised access to your email account is a criminal offence, and it is worth knowing that before you decide whether reporting is proportionate. Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform any function with intent to secure unauthorised access to any program or data, knowing that the access is unauthorised. It carries up to two years' imprisonment on conviction on indictment. No financial loss is required for the offence to have been committed.

Where you report depends on where you live, and this is the point most pages get wrong. In England, Wales and Northern Ireland, fraud and cybercrime go to Report Fraud — the national reporting centre run by City of London Police and formerly branded Action Fraud — online or on 0300 123 2040. In Scotland the position is different: Report Fraud's own site directs Scottish residents to report via 101, and Police Scotland publishes its own hacked accounts advice with an online reporting form alongside the phone and in-person routes. Reporting a Scottish incident to Report Fraud does not put it in front of Police Scotland.

Be realistic about what a report achieves. Report Fraud collates reports for intelligence purposes and does not investigate every case; its most immediate practical value to you is the reference number, which banks, insurers and credit reference agencies routinely ask for before they will act on a claim. If money has been taken, or if identity documents were held in the mailbox, get the reference early rather than at the point someone demands it.

Separately from any crime report, forward the message that started it. If the compromise followed a phishing email, forward that email to [email protected], the NCSC's free reporting address; suspicious texts go to 7726, and to report a scam call you text 7726 with the word 'Call' followed by the caller's number. Stop! Think Fraud sets out all three routes. These feed takedown work rather than an investigation into your case, but they are free, take a minute, and reduce the number of people who receive the same message next week.

If the account belongs to a business, charity or other organisation and the attack is live, the escalation differs again: Report Fraud asks organisations under cyber attack to call 0300 123 2040 immediately rather than wait on an online form.

Finally, get support if you need it. The Cyber Helpline is a free UK service staffed by volunteer cybersecurity professionals that handles hacked email accounts specifically, and Police Scotland links to it alongside Get Safe Online, the National Crime Agency and the Cyber and Fraud Centre Scotland. Being hacked is a crime committed against you, and treating it as a personal failing is both wrong and a reliable way of delaying the steps that limit the damage.

A hacked work mailbox is not the same problem as a hacked personal one, and the difference is that other people's personal data is usually sitting in it. That converts a security incident into a data protection incident with statutory timescales attached, and those timescales run from the moment the organisation becomes aware.

Tell your IT team or data protection lead immediately, and do it by a channel other than the compromised mailbox. The NCSC's phishing guidance says the same in one line: if you received the message on a work laptop or phone, contact your IT department and let them know. Delay is the thing that turns a manageable incident into a reportable failure, and organisations know that the person who reports quickly is the one who limited the damage.

What happens next is the organisation's obligation, not yours, but it helps to know the shape of it. Where a personal data breach is likely to result in a risk to people's rights and freedoms, the organisation must notify the Information Commissioner's Office as soon as possible and, where feasible, within 72 hours. The ICO is explicit that the 72-hour requirement is a legal one even when the picture is still incomplete, and that the correct response is to report what you have and supply further detail afterwards without undue delay. Where the risk to people is high, the organisation must also tell those people directly, without undue delay.

The ICO's report is made through an online form which it says takes around 30 minutes and cannot be saved partway through, and which asks what happened, when and how it was discovered, who has been or may be affected, what is being done, and who else has been told. If your organisation is small enough not to have a data protection team, the ICO publishes a short guide aimed at small companies and sole traders on responding in the first 72 hours.

The position is different if you are on the other side of it — if an organisation's breach is the reason your details were exposed in the first place. The ICO's advice to individuals is to contact the organisation first and give it the chance to explain, and it publishes a template complaint letter for the purpose. The organisation should reply within one month. If you are unhappy with the response or receive none, you can complain to the ICO, and its helpline for members of the public is 0303 123 1113.

One caution specific to breaches. The NCSC warns that criminals exploit high-profile breaches while they are fresh, sending messages that appear to come from the breached organisation and ask you to log in and verify your account because fraudulent activity has taken place. They arrive some time after the breach becomes public, and are convincing precisely because you are already worried. Contact the organisation through its official website, never a link you were sent.

Once the account is yours again, the useful question is not how to be more careful but which structural change removes the failure mode entirely. There are four, and they are worth doing in this order.

Give the email account a password used nowhere else. The NCSC's position is unambiguous: always use a strong and separate password for your email — one you do not use for any other account, at home or at work — because if a criminal gets one shared password they get everything. If you have reused your email password elsewhere, the NCSC says to change it as soon as possible. This single change breaks credential stuffing, which is the mechanism behind most consumer email compromise.

Turn on 2-step verification and choose the strongest second factor the provider supports. An authenticator app or a hardware security key beats a code sent by text, because text codes fall to SIM-swap fraud, which defeats every service relying on them at once. Where your provider supports passkeys, they remove the password from the sign-in altogether and are worth adopting on the email account before anywhere else.

Use a password manager. The NCSC actively encourages them, on the grounds that they create strong passwords and remember them, which is the only realistic way to hold a unique password for every account. The alternative most people reach for — a memorable pattern varied slightly per site — is exactly what an attacker with one of your passwords will try next.

Keep devices updated and turn on automatic updates. Stop! Think Fraud calls applying updates one of the most important and quickest things you can do to prevent an account being hacked, and the NCSC lists it among its core actions. It is unglamorous and it closes the route that no amount of password hygiene protects against.

Two smaller habits shorten the next incident. Set the recovery address to a second mailbox you control and use for nothing else, rather than a partner's address or an old work account you may lose access to. And read the new sign-in alerts your provider sends instead of dismissing them — for most people that message is the earliest warning they will get, and acting on it within the hour is the difference between an annoyance and the whole of this page.