My Email Account Was Hacked — What to Do Right Now
TL;DR: A hacked email account is a different problem from a leaked email address — someone has active access to your inbox right now, not just a record of your address sitting in a data dump. Here's the exact sequence to lock them out, assess the damage, and secure everything that account touches.
There's an important distinction worth making up front: an email address showing up in a data breach means your address was exposed as a piece of data — it doesn't mean anyone has access to your inbox. A hacked email account is different and more urgent: someone else can actually log in, read your messages, and use the account as if it were theirs. If that's what's happening — password reset emails you didn't request, sent messages you don't recognize, contacts telling you they got strange emails from you — the priority order below is what actually matters, in order.
Step 1: Try to regain access immediately
If you can still log in, do these three things in the same sitting, before anything else:
- Change your password to something you haven't used anywhere else, and enable two-factor authentication if it isn't already on.
- Check "recent activity" or "sign-in history" in your account security settings — most major providers show device and location logs, which tells you if the intruder still has an active session.
- Sign out of all other sessions/devices — this is usually a single button in security settings, and it immediately kicks out anyone else logged in.
If you can't log in because the password's already been changed, use your provider's account recovery flow immediately — the longer this waits, the more time an intruder has to change recovery details and lock you out permanently.
Step 2: Check what they could have accessed
Once you're back in, don't assume the damage is limited to the inbox itself. Review:
- Forwarding rules — attackers often set up silent auto-forwarding to keep reading your mail even after you've regained access. Check and remove any forwarding rule you didn't set up yourself.
- Recovery email and phone number — confirm these still point to details you control, not something the intruder added.
- Connected apps and third-party access — check your account's "connected apps" or "security" page for anything unfamiliar with access to your account.
- Sent folder and drafts — for signs of what was actually done with the access, including messages sent to your contacts.
Step 3: Secure everything the email touches
Your email is usually the recovery method for most of your other accounts — which means a compromised inbox is a skeleton key, not a single lock. Prioritize:
- Banking and financial apps — change passwords and check recent transactions.
- Any account where "forgot password" would send a reset link to this email.
- Social media accounts linked to this email for login or recovery.
Change these passwords to something unique per account, not the same new password reused everywhere — that just recreates the original vulnerability under a different name.
Step 4: Report it, if warranted
Unauthorized access to an email account is a cognizable offence in India, and if the intruder used your account to send messages to your contacts, attempted financial fraud, or if you suspect the access ties into a broader identity theft attempt, it's worth filing a complaint through India's National Cybercrime Reporting Portal. Keep screenshots of the suspicious sign-in activity and any messages sent without your knowledge as supporting evidence.
Step 5: Figure out how they got in
Understanding the entry point matters for preventing a repeat. The most common causes, roughly in order of likelihood:
- Password reuse — the same password used on another service that was separately breached.
- Phishing — a fake login page that captured your credentials directly.
- No two-factor authentication — a password alone was sufficient, with nothing else standing in the way.
If you're not sure which applies, checking whether your email has appeared in a known breach is a reasonable starting point — it won't confirm the exact cause, but it narrows the possibilities.
Once your account is secure, it's worth checking the wider picture too — a hacked email is often one symptom of broader identity exposure, not an isolated event. Scan My Shadow checks your email and phone number across 1,500+ sources so you can see what else might need attention.
Sources
Related Reading
- How to Check If Your Email Has Been Leaked — the passive-exposure version of this problem.
- What Should I Do If My Email Appears in a Data Breach? — the breach-specific response plan.
- Credential Stuffing Explained — how password reuse enables exactly this kind of takeover.
- How to File a Cybercrime Complaint in India — the filing process if you decide to report it.
- Recovering a Hacked WhatsApp or Social Account — the same playbook applied to other platforms.
After securing your accounts, check how much of your personal information is already exposed: Run a free digital footprint check.
FAQs
How do I know if my email was actually hacked versus just spoofed?
Check your sent folder and sign-in activity log. If messages genuinely appear in your Sent folder and there's unfamiliar sign-in activity, it's a real account takeover. If contacts received emails that don't appear in your Sent folder, it's more likely spoofing — where the sender address was faked without actual account access.
Should I delete my email account and start over?
Almost never — your email is tied to years of account recovery, contacts, and history. Regaining control and securing it is nearly always better than abandoning it, except in extreme cases where recovery genuinely isn't possible.
Can they still read my email after I change the password?
Not through the login itself, but check for forwarding rules and connected app access — these can let someone keep reading your mail even after a password change, which is why Step 2 above matters as much as the password reset.
Is unauthorized email access actually illegal in India?
Yes — accessing someone's email account without authorization is a cognizable offence under India's IT Act, and can be reported through the National Cybercrime Reporting Portal.
What should I do if my mail was hacked?
Change the password from a clean device, turn on two-factor authentication, check forwarding rules and recovery details, sign out other sessions and warn your contacts. Then check whether the address appears in known breaches.
How do I know if my email account was compromised?
Warning signs include password reset emails you did not request, sent messages you did not write, logins from unfamiliar devices or places, and changed recovery details. Review your account's recent activity page.
How can I check if my email was hacked?
Run the address through a breach checker such as the free Scan My Shadow digital footprint checker or Have I Been Pwned. A hit means data from a service leaked, not necessarily that your mailbox was taken over.
I received an email saying "you have been hacked". Is it real?
Usually not. These are often extortion scams that quote an old password from a past breach. Do not pay or reply; check whether you still use that password and change it.
Choose the new password using strong password examples and confirm nothing else leaked with a password leak check.
Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.
See if your email has already leaked
Check my email free →- Checks your email against known data breaches
- Shows which sites leaked it, and when
- Shows what leaked: passwords, phone, address
- Result on screen in about 30 seconds
- We don't store the email you check