An unexpected sign-in alert, a password that no longer works, messages you did not send, or recovery details you do not recognize can mean an email account needs immediate attention. One unusual message does not prove what happened, but you can protect the account without using links or phone numbers from that message.
Start from a device and website you trust
If the computer or phone may also have been accessed by someone else, use a different trusted device for account-security steps. Open the email provider's official app or type its known website address yourself instead of following a link in an unexpected alert.
Use the provider's official recovery process if you cannot sign in. For a work or school account, contact the organization that manages it. Enter your own passwords and one-time security codes, and do not send or read a code to someone who contacted you. Only the provider or managing organization can approve its identity checks.
- A password or recovery detail changed without your permission
- A sign-in or device you do not recognize
- Messages, replies, or deletions you did not make
- Forwarding rules, filters, or automatic replies you did not create
Change access and review account settings
After you regain access, create a strong password that you do not use for another account. Use the provider's option to sign out other sessions when it is available, then review recent activity, connected devices, recovery phone numbers, recovery email addresses, and apps with account access.
Check the sent, deleted, and forwarding or filter settings for changes you did not make. Turn on two-step verification if the provider offers it, and save recovery information somewhere you control. Provider menus differ, so follow the current instructions on its official support site.
Protect other accounts and warn affected contacts
Email is often used to reset passwords for banking, shopping, social media, and other services. Change any other account that reused the exposed password, beginning with important financial, identity, and primary account services.
If messages were sent from your account without permission, tell contacts through another method not to open unexpected attachments, follow links, send money, or reply with private information. Contact a bank or payment provider through its official app, statement, or card number if financial information or purchases may be involved.
Know when the problem needs another specialist
A device check can look for common unwanted software and help you follow official account steps, but it cannot prove that every account is secure or bypass a provider's recovery rules. Identity theft, stolen money, or a highly sensitive personal account may also need the relevant provider, financial institution, or official recovery resource.
For a work or school account, contact the organization that manages it before changing business rules or removing evidence. A business email compromise, regulated information, or a larger security incident may require the organization's administrator or a security specialist.