It usually starts with a text from a friend: “Hey — why did you just email me a link about crypto?” You did not. But your account did, at 3 a.m., while you were asleep. That moment — other people seeing your account do things you never did — is how most email hacks are discovered, and it raises a stack of questions in a hurry. Here are the ones that matter, answered in the order you will actually ask them.
What are the warning signs my email has been hacked?
There are seven that matter, and any two together should be treated as a fire alarm. One: friends or colleagues report strange emails from you that you never sent — spam, phishing links, invoices. Two: there are messages in your Sent folder you do not recognize, or — sneakier — messages that should be in your inbox keep disappearing. Three: you receive password-reset emails for services you own, for resets you never requested; someone is testing doors. Four: your password suddenly stops working on an account you have not changed. Five: your provider shows you a login alert — new device, new country, impossible hour — that is not you. Six: your signature, display name, or profile details have been edited. Seven: money-adjacent accounts (banking, shopping, PayPal) start sending you alerts that trace back to email confirmations you never saw. That last pattern is the most dangerous, because email is the master key: whoever holds your inbox can reset everything else.
My friends got spam “from me.” Is that always a hack?
Not always — and the distinction saves you a panic. Email addresses can be spoofed: a spammer forges your address as the “from” line without ever touching your account, the way a prankster writes a false return address on an envelope. Spoofing is annoying but harmless to you, and it stops on its own. The tells are where the replies land (your friends’ replies to the spam come to you, because the address is real) and, decisively, your own account: if your Sent folder is clean, your password works, your login history shows only you, and no settings have changed, it was almost certainly spoofing. If any of those checks fail, it is not spoofing. It is a guest.
What do I do in the first ten minutes?
Move fast, in this order. First, try to log in. If you can, change the password immediately to something long, unique, and never used anywhere else — this single act locks most intruders out mid-session. Second, sign out all other sessions: every major provider (Gmail, Outlook, Yahoo, Apple) has a “sign out of all devices” or a devices list in its security settings; use it, because a changed password does not always kill an existing session. Third, turn on two-factor authentication right there, before you investigate anything else — our step-by-step for setting up two-factor authentication walks through it account by account. Fourth, check the recovery email and phone number on the account: attackers change these first so they can come back, and a recovery address you do not recognize means the account is not yet yours again.
While those locks are landing, do one quiet check on your phone: open your banking and shopping apps and confirm the sessions there still recognize you and show no new activity. The email account is the battlefield, but the money accounts are the prize, and five minutes of checking now is what turns a bad morning into a bad week — or doesn’t. If anything financial looks touched, call the bank’s fraud line before you finish the email recovery; banks can freeze first and ask questions later, and that order matters.
I am locked out completely. Now what?
Use the provider’s account recovery flow, from a device and network the provider has seen you use before — recovery systems trust familiar devices and home connections, and attempts from a brand-new laptop on café Wi-Fi fail at a frustrating rate. Have ID and any old passwords ready; old passwords genuinely help prove ownership. If recovery fails, use the provider’s hacked-account path specifically (all the major ones have one), rather than the generic forgot-password loop, because the hacked-account path triggers a human-review process built for exactly this. Work quickly: every hour the account is theirs, it is being used — to spam your contacts, to reset your other accounts, or simply sold onward.
They are out. How do I check what they changed while inside?
This is the step everyone skips, and it is the one that lets hackers stay. Attackers set traps so access survives a password change, and you must sweep for all four. Filters and rules: look for a rule that auto-forwards your mail to an outside address, or auto-deletes incoming mail matching words like “bank,” “invoice,” or “password reset” — that is how they hide their activity from you. Forwarding: check the plain forwarding setting itself, separate from filters. App passwords and connected apps: revoke any you do not recognize; an app password is a side door that ignores your shiny new main password. Your other accounts: assume the inbox was read — change passwords (unique ones) on banking, shopping, and social accounts, starting with anything financial, and check those accounts’ recent activity for the same period. Google’s Security Checkup consolidates several of these sweeps for Google accounts into one guided pass.
How do I find out how they got in?
Usually one of three doors. Your email address and password leaked in some other service’s breach and were tried here automatically — check your address at Have I Been Pwned, which tracks known breaches, and if your email password was reused anywhere, that is almost certainly the story. Or you were phished: a convincing “your account will be closed” email with a login page that was not the real one. Or malware on a computer did it. Knowing the door matters because it tells you what else to fix — a reused password means every account sharing it is open, and a phished password means the same trick will be tried again next month.
Should I warn my contacts — and how?
Yes, quickly, and from a channel that is not the compromised account — a text, a call, or a post on a social account you have already secured. Keep it plain: “My email was hacked this morning. Ignore any strange messages from it, especially anything asking for money, gift cards, or links. I have it back now.” Three things that warning accomplishes: it stops your friends paying the fake invoice your account sent at 3 a.m.; it explains the weirdness before someone else defines it for you; and it recruits your contacts as sensors — if the account misbehaves again, they will tell you within the hour. The one exception to speed is a work account, covered next, where your employer’s IT team should hear first so their response and yours do not collide.
What if it was my work email?
Then the first call changes: IT or your manager hears about it before you change anything, because a business inbox is evidence as well as an account, and the company may have legal duties — to clients whose data sat in that inbox, for a start — that your good-intentioned cleanup could complicate. Follow their instructions even where they differ from this guide, and expect them to force resets on connected systems you forgot existed. Do not quietly fix a work breach on your own and mention it later; in every post-incident review ever written, the concealment causes more damage than the hack.
If my email is secure again, are my other accounts safe?
Only the ones with different passwords. The industrial version of this attack is called credential stuffing: software takes the email-and-password pair from one breach and tries it — automatically, in bulk — at banks, shops, and social networks. It works because people reuse passwords, and it means a breach you fixed on Tuesday can open a shopping account on Friday without your inbox being involved at all. The sweep in the earlier answer is therefore not optional housekeeping: every account that ever shared the email’s password needs a new, unique one, financial accounts first. It is an hour of tedium that closes the entire category of attack rather than this one instance of it.
How do I make sure this does not happen twice?
Three habits close nearly every door used above. Unique passwords for every account, stored in a password manager so “unique” does not depend on your memory. Two-factor authentication on the email account above all others, because it is the reset point for your entire digital life. And a permanent suspicion of urgency: real providers do not email that your account closes in two hours, and the login page you reach from an email link should always be treated as guilty until proven innocent — navigate to the service yourself instead. Do those three, and the 3 a.m. crypto email becomes a story about somebody else.
