Finding out someone is in your email account is stomach-dropping. Friends start getting strange messages “from you,” password reset emails you never requested appear, and you cannot log in. Take a breath. It is fixable, and doing things in the right order makes it much easier.
Step 1: Get back in if you can
Try logging in normally first. If your password still works, change it immediately to something completely new. If the scammer already changed it, use the “Forgot password” link and follow the recovery process. For Gmail, go to accounts.google.com/signin/recovery. For Outlook or Hotmail, account.live.com/password/reset.
Having your recovery phone number or backup email already set up makes this much easier, which is worth remembering for the future.
Step 2: Kick them out and lock the door
Once you are back in, find the option to sign out of all other sessions or devices. In Google it is under Security > Your devices. This disconnects the scammer even if they are still logged in somewhere.
Then turn on two-factor authentication if you have not already. This is the single most important step. It means even if they somehow get your new password, they still cannot get in without your phone.
Step 3: Check what they left behind
Clever scammers set traps so they can keep reading your mail after you change the password. Check for:
- Forwarding rules: in your email settings, look for any address your mail is being forwarded to and remove it
- Filters or rules: rules that auto-delete messages (scammers use these to hide their tracks, like deleting your bank’s warning emails)
- Recovery info: check the recovery phone and email listed on the account are still yours
- Automatic replies: some set a fake “out of office” message pushing a scam
Step 4: Assume other accounts are exposed
Your email is the key to everything else. Anyone in your inbox can request password resets for your bank, Facebook, myGov, and shopping accounts. Change passwords on anything important, starting with banking and government services. If you reused your email password anywhere else, change those too.
Step 5: Warn your contacts
Send a quick message to close friends and family: “My email was hacked, please ignore any strange messages from me.” Scammers often use your account to email your contacts, and because it really is your address, people trust it. A quick warning stops the scam spreading through your family.
Step 5b: Scan your devices
n
While you are at it, run a full malware scan on the computer and phone you use for email. If a malicious link or attachment helped them in, you want it gone. For home users we supply Bitdefender, which is excellent at catching exactly this sort of thing.
n
Step 6: Watch for the follow-up
For the next few weeks, keep an eye on bank statements and be extra suspicious of calls or texts claiming to be your bank. Scammers who had your email often try phone follow-ups while the trail is fresh.
Step 7: Report it
In Australia, report the incident to Scamwatch (scamwatch.gov.au) and if money was lost, to your bank immediately and to ReportCyber (cyber.gov.au). If it is a work account, tell your IT support straight away.
