What to Check After Your Email Account Is Hacked

Discovering your email account has been hacked can be a distressing experience, but immediate and systematic action is crucial. Your email often serves as the central hub for your digital life, linking to social media, banking, shopping, and other critical online services. A compromised email account can quickly lead to widespread identity theft, financial fraud, and privacy breaches. This guide outlines the essential checks you need to perform to secure your account, assess the damage, and protect your broader online presence.

Secure Your Account Immediately

The very first step is to regain control of your email account. Time is of the essence, as hackers may be actively using your account to cause further damage.

Change Passwords

If you can still access your account, change your password immediately. Create a strong, unique password that you haven't used before and that combines uppercase and lowercase letters, numbers, and symbols. If you are locked out, use the "Forgot password" or "Account recovery" option provided by your email service provider. Follow their specific steps, which may involve verifying your identity through a recovery email, phone number, or security questions. Ensure you are on the legitimate email provider's website to avoid further phishing attempts.

Review Security Settings

After changing your password, delve into your email account's security settings. Look for any changes the hacker might have made. This includes checking for new recovery email addresses or phone numbers that aren't yours, as well as any unknown devices logged into your account. Remove any unrecognized devices or recovery options. Enable two-factor authentication (2FA) if it wasn't already active; this adds an extra layer of security by requiring a second verification step, like a code from your phone, in addition to your password.

Assess the Damage and Unauthorized Activity

Once your account is secured, you need to investigate what the hacker did while they had access. This assessment will inform your next steps in protecting your information.

Check Sent Items and Drafts

Scrutinize your "Sent Items" folder for any emails you didn't send. Hackers often use compromised accounts to send spam, phishing links, or malware to your contacts, leveraging the trust associated with your address. Also, check your "Drafts" folder; sometimes, hackers compose malicious emails there before sending them. Note the content and recipients of any suspicious messages.

Review Account Activity Logs

Most major email providers offer an activity log or security activity page. This log details login times, IP addresses, and device types used to access your account. Look for any suspicious logins from unfamiliar locations, times, or devices. This information can help you understand the extent and duration of the unauthorized access.

Look for Forwarding Rules and Filters

Hackers frequently set up email forwarding rules or filters to redirect your incoming emails to their own accounts, even after you've changed your password. This allows them to continue monitoring your communications, especially password reset emails from other services. Check your email settings for any unknown forwarding addresses or filters that automatically delete or move incoming messages. Remove any that you didn't create.

Examine Contact Lists and Account Information

A hacker might export your contact list to use for future spam campaigns or phishing attacks. While it may not be immediately obvious if your contacts were stolen, be aware that your friends and colleagues might receive suspicious emails from your address. Also, check your profile information within your email account settings for any unauthorized changes to your name, birthday, or other personal details.

Protect Your Other Online Accounts

A compromised email account is a gateway to your entire digital life. It's crucial to assume that if your email was hacked, other accounts linked to it are also at risk.

Identify Linked Services

Think about all the online services where you used your hacked email address for registration or as a recovery email. This includes social media platforms, online banking, e-commerce sites, cloud storage, streaming services, and professional accounts. Make a list of these critical services.

Change Passwords on Critical Accounts

For every service identified in the previous step, immediately change the password. Start with your most critical accounts, such as banking, financial services, and primary social media. Do not use the same password you used for your email account, and create strong, unique passwords for each service. If available, enable 2FA on these accounts as well. If any of these services sent password reset links to your compromised email, the hacker could have intercepted them.

Inform Your Contacts and Monitor for Abuse

Your responsibility doesn't end with securing your own accounts. You also need to protect your contacts and monitor for potential identity theft.

Warn Friends and Family

Send a message to your contacts (from a secure, alternative email account if possible, or via phone/text) informing them that your email was hacked. Advise them not to open any suspicious emails from your address and to be wary of any unusual requests or links. This helps prevent the hacker from further exploiting your network.

Monitor for Identity Theft

Be vigilant for signs of identity theft. This includes unexpected bills, unauthorized credit card charges, new accounts opened in your name, or calls from debt collectors for debts you don't owe. Regularly check your bank and credit card statements. Consider placing a fraud alert with credit bureaus if you suspect sensitive personal information was accessed. For specific advice on identity theft, it is advisable to consult with a qualified professional or relevant government agencies.

Enhance Future Security

A hack is a painful lesson, but it's also an opportunity to significantly boost your overall cybersecurity posture.

Implement Two-Factor Authentication (2FA)

Activate 2FA on every online account that offers it, especially your email, banking, and social media. This adds a critical layer of defense, making it much harder for unauthorized users to access your accounts even if they have your password.

Use Unique, Strong Passwords

Never reuse passwords across different accounts. Use a password manager to generate and store complex, unique passwords for all your online services. This way, if one account is compromised, the others remain secure.

Stay Vigilant Against Phishing

Phishing is a primary method for account compromise. Be extremely cautious about clicking links or opening attachments in emails, even if they appear to come from a trusted source. Always verify the sender's email address and hover over links to see their true destination before clicking. Be suspicious of urgent requests for personal information.

Key Takeaways

If your email account is hacked, act quickly to change your password and review all security settings, including recovery options and forwarding rules. Thoroughly check for unauthorized activity in your sent folder and activity logs. Immediately update passwords on all linked online accounts, prioritizing financial and social media services. Inform your contacts about the breach and monitor your financial records for signs of identity theft. Finally, strengthen your overall security by enabling two-factor authentication everywhere and adopting unique, strong passwords for all your online services.