Guides Hacked email account
Guide
Compromised mailbox: check access, rules and recovery methods
Your mailbox is often the recovery key to all your other accounts. Changing the password is necessary, but it is not enough if a session, a forwarding rule, an authorised app or a recovery method has been added. Check these six areas before you consider the account secure.
Gmail · Outlook · Orange · Yahoo · iCloud
Three first reflexes
- From a safe device, change your email password to a long, unique one.
- Sign out of unknown sessions: computers, phones, browsers, apps or IMAP/POP access you don’t recognise.
- Turn on two-factor authentication and write down the backup codes somewhere safe.
Your mailbox receives the reset codes for your other accounts: as long as it is not secure, everything else can be taken over. Treat it as your most critical account.
Act fast, but in the right order
The right order stops the attacker from taking the account back, or using your email to recover your other services.
The 6 areas to check in your mailbox
Serious securing examines the settings that let someone read, forward or reset messages without it being obvious at first glance.
1. Active sessions
Close unknown devices, old browsers, connections from unusual countries and any session you don’t recognise.
2. Recovery
Check the secondary email address, the phone number, and the recovery questions or methods.
3. Two-factor authentication
Turn on a strong method: an authenticator app, a security key or approval on a device. Avoid relying on texts alone if possible.
4. Forwarding
Remove any unwanted automatic forwarding to an unknown address.
5. Filters and rules
Check for rules that archive, delete or hide emails from your bank, security services, social media or phone operator.
6. Authorised apps
Revoke unknown third-party apps, OAuth access, app passwords, POP, IMAP or delegations.
Checkpoints by provider
The labels change from one service to another, but the logic stays the same: sessions, security, recovery, forwarding, apps and activity traces.
Where to look, service by service
- Gmail / Google: security activity, connected devices, third-party apps, POP/IMAP forwarding, filters and recovery addresses.
- Outlook / Microsoft: recent activity, devices, aliases, inbox rules, sign-in methods and Microsoft Authenticator.
- Orange / phone operator: password, redirection, aliases, recovery number, webmail and any sorting rules.
- Yahoo / iCloud: connected devices, recovery, app passwords, forwarding, cloud access and syncing.
Also check
- Bank and mobile payment.
- Social media and messaging apps.
- Cloud, photos, documents and backups.
- Mobile operator and SIM card.
- Shopping sites with a saved card.
What to keep
Evidence lets you date the incident, identify the accounts affected and support certain steps with a platform, a bank or the authorities. Don’t delete anything: evidence is fragile.
- Security alerts: emails or notifications about sign-ins, password changes, a new MFA method or a new device.
- Suspicious messages: emails sent in your name, replies from contacts, sent items, drafts or the bin.
- Changed settings: screenshots of rules, forwarding, filters, authorised apps and recovery addresses.
- Third-party accounts: evidence of password resets, orders, payments or sign-ins on other services.
- Timeline: date of discovery, first alerts, measures taken and any exchanges with the provider’s support.
Should you warn your contacts?
Warn your contacts if emails or messages have been sent from your account, especially if they contain a link, an attachment, a request for money or a fake invoice. Keep the message short: account compromised, don’t open the links, delete the message, report anything already done. There is no need to write to everyone if nothing suspicious was sent.
Can’t get into the account any more?
Use the provider’s official recovery procedure, from a trusted device. Prepare in advance the information that proves you are the legitimate account holder.
The traps to avoid
This is often where everything is decided: an access left open, an invisible rule, a sign ignored.
Changing the password is not enough
An attacker can keep access even after the password has been changed if an authorised app, a forwarding rule or a fraudulent recovery number is still in place. Close every door.
Hidden email rules
Hackers create rules to hide alerts: bank, security, password resets, support or sign-in notifications. A rule can automatically archive or delete important emails.
The signs that should alert you
Messages sent without your consent, unusual sign-in alerts, emails deleted or moved, password resets on third-party accounts: all signs to take seriously.
Official resources to consult
These public links complete the checks and formal steps after an email account has been compromised.
Get support when it helps
If you have lost access, if money is involved, or if you are not sure you have closed everything, get support. A single point of contact secures and documents things with you, at your own pace.
We check, secure, document and advise, but we will never ask for your codes, your passwords or a code received by text. And we promise neither recovery of funds nor a guaranteed result. Commitments, not promises. Your data stays in France.
More guides and situations
Continue with the pointers that suit your case.
All our step-by-step guides
The right reflexes, guide by guide, so you can act without prior expertise.
See the guides →Hacked account: social media, cloud…
Recognise your situation: social media, cloud, email. Each case has its own traps and its own help.
See the situations →A doubt, an emergency?
Three steps right away, then we call you back Monday to Friday from 8 am to 7 pm and Saturday from 8 am to 12 noon, with no commitment.
Get help now →