Living Well at Home UKClear, practical guidance for later life
Online safety

By Does Your Duck Quack

Recovering a hacked email account: a practical security plan

Recover a hacked email account: secure access, remove hidden forwarding, warn contacts, protect linked services and report any financial loss.

Checked: 5 October 2026 · Next review: 5 April 2027 · Applies to: UK, with nation notes
How this guide was prepared

Purpose: how to guidance · Level: detailed

Checked by: Does Your Duck Quack. Sources are linked below; seek professional advice for individual circumstances.

The short answer

What to do first

Recover a hacked email account: secure access, remove hidden forwarding, warn contacts, protect linked services and report any financial loss.

Start here: Open the provider’s official app or type its known address; avoid links in suspicious messages or adverts. If you can sign in, change the password from a trusted device. If blocked, use the provider’s recovery process and follow its identity checks. Report the compromise if recovery fails.

Visual guides

See the decision at a glance

Recover the email account safely
  1. 1. Use the known serviceOpen the official app or type its known address; avoid suspicious recovery links.
  2. 2. Reset and secureChange the password from a trusted device or follow the provider’s recovery checks.
  3. 3. End other sessionsSign out unknown devices and review recovery details, filters and forwarding rules.
  4. 4. Warn your contactsAsk contacts not to trust unexpected links, payment requests or security-code requests.
Protect linked accounts
  1. Email recoverySecure the mailbox used for password resets before changing other accounts.
  2. Banking accountsCall the bank on a trusted number if financial details or transactions may be exposed.
  3. Shared work accountTell the organisation’s IT or security team promptly.
  4. Report and preventReport suspected crime to the police service for your nation; secure recovery codes separately.

Scope of this guide

This guide helps you understand the options and questions to ask. It is not personal medical, legal or financial advice. Check the official sources for your nation and seek qualified help for high-stakes decisions.

Who this guide is for

People who have lost access to email or noticed suspicious activity, and helpers supporting recovery from a safe device.

A hacked email account can expose private messages and let someone reset passwords for other services. Signs include unfamiliar sent mail, missing messages, changed recovery details or friends receiving odd requests. Do not pay an unsolicited caller promising recovery. Start with the provider’s official route from a trusted device and check connected accounts.

Practical steps

1. Use the provider’s recovery process

Open the provider’s official app or type its known address; avoid links in suspicious messages or adverts. If you can sign in, change the password from a trusted device. If blocked, use the provider’s recovery process and follow its identity checks. Report the compromise if recovery fails.

2. End access and remove hidden changes

After access is restored, sign out other sessions. Review recovery phone numbers, email addresses, trusted devices and connected apps. Check filters, forwarding rules and automatic replies; criminals may forward messages to capture password resets. Remove changes you did not make and review sent and deleted folders.

3. Protect important accounts next

Secure the email account used for password recovery first, then banking and other important accounts. Change reused passwords, enable two-step verification and remove unknown sessions. If financial details may be exposed, call the bank using a trusted number and review recent transactions.

4. Warn contacts and preserve evidence

Tell contacts and organisations that messages from the account may not be genuine. Ask them not to open links, send money or share codes. Preserve suspicious messages and transaction details safely. If a work or shared account is involved, notify the organisation’s IT or security team promptly.

5. Report the incident and reduce the chance of a repeat

Report suspected fraud or crime to the police service for your nation; Scotland uses Police Scotland. Keep devices updated, use a separate strong email password and secure recovery details. Store recovery codes safely, not in the same mailbox. Do not grant remote access to someone who contacts you unexpectedly.

Questions and checks

Common questions

How can I tell if my email account has been hacked?

Look for reset alerts you did not request, unfamiliar devices, sent messages, missing emails, changed recovery details or forwarding rules. Check directly through the provider’s official service. If you cannot sign in or see changes you did not make, start recovery promptly.

What should I do first if my email has been hacked?

Use the provider’s official recovery process on a trusted device. If you can sign in, change the password, sign out other sessions and enable two-step verification. Check recovery details and forwarding rules, then secure banking and other accounts that rely on this email. Call your bank if financial details may be exposed.

Can someone steal money through a hacked email account?

A criminal may use email to reset passwords, impersonate you or intercept financial messages. Review accounts that use the address and contact your bank about unfamiliar transactions or exposed details. Warn contacts against payment requests and report suspected fraud to the police service for your nation.

Should I pay an email recovery service?

Treat unsolicited recovery callers or messages asking for money, passwords, codes or remote access as suspicious. Use the provider’s official recovery route and NCSC guidance. If money has been lost or the account is used for fraud, contact your bank and the relevant police service.

Differences across the UK

Account-security steps apply across the UK. For suspected fraud, use Report Fraud in England, Wales and Northern Ireland, and Police Scotland in Scotland. If an employer or public service provides the account, contact its security team as well as the provider.

Primary sources

The publisher checked this guide against the 5 official sources below. This is an editorial source check, not approval by a clinician, lawyer or benefits adviser.

Editorial note: By Does Your Duck Quack.