Your friends receive strange messages from you asking for money. Your password suddenly does not work. Clients tell you they got an invoice from you with new bank details. These are classic signs that your email has been compromised. Email is the key to most of your other accounts, so acting fast is critical. This guide explains how to recover a hacked email account, whether it is a personal Gmail or Outlook address or a business mailbox on your company domain, and how to make sure it does not happen again.
Signs your email account has been hacked
- You cannot log in, or you get a "password changed" notice you did not request.
- Contacts receive emails or messages you did not send.
- Your Sent folder contains emails you do not recognise, or it has been emptied.
- New forwarding rules or filters appear in your settings.
- You get security alerts about logins from unfamiliar locations or devices.
- Password reset emails arrive for other accounts you did not try to access.
First, use a clean device
If your computer or phone has malware, the attacker may capture your new password the moment you type it. Before you begin recovery, use a device you trust. If you suspect your own device is infected, scan it with reputable security software or use another device until it is cleaned.
How to recover a hacked email account: step by step
Step 1: Try to sign in and change the password
If you can still log in, change your password immediately to a long, unique one you have never used before. A good approach is a passphrase of four or more random words. Do not reuse the old password or a small variation of it.
Step 2: Use the official recovery process if you are locked out
If the password no longer works, use the provider's official account recovery page:
- Gmail: go to the Google Account recovery page and follow the prompts. Google may ask for a previous password, a code sent to your recovery phone or email, or questions about your account.
- Outlook or Hotmail: use Microsoft's account recovery form and provide as much accurate detail as you can.
- Yahoo and others: look for "Forgot password" or "Trouble signing in" on the official login page.
Answer recovery questions from a device and location you have used before; this helps the provider recognise you. Be patient, as some recovery forms take time to review.
Step 3: For business email, contact your administrator or host
If the account is on your company domain, such as [email protected], your IT administrator or hosting provider can reset the password from the control panel, check login logs and help secure the mailbox. Call them directly. Do not rely on email, because the attacker may be reading it.
Step 4: Sign out all other sessions
Most providers let you sign out of all devices from the security settings. Do this so any device the attacker used is logged out. For business mail hosted in cPanel, changing the password usually disconnects existing sessions, but ask your host to confirm.
Step 5: Check recovery options
Attackers often change the recovery phone number and email so they can take the account back later. Check these carefully and remove anything you do not recognise. Make sure your recovery phone is your current MTN or Airtel number and your recovery email is one only you control.
Step 6: Look for hidden rules and forwarding
This step is often missed. Attackers create rules that silently forward copies of your mail to them, or move certain messages to hidden folders so you do not see replies from contacts. Check:
- Forwarding settings.
- Filters and rules.
- Auto replies and signatures.
- Connected apps and devices with access to your account.
- Delegated access, where another account can read your mail.
Delete anything you did not set up.
Step 7: Turn on two factor authentication
Two factor authentication (2FA) means that even if someone steals your password, they also need a code from your phone or an authenticator app. Authenticator apps are generally safer than SMS codes. Save the backup codes somewhere secure, offline.
Step 8: Warn your contacts
Send a short message to your contacts explaining that your account was compromised and asking them to ignore any unusual requests sent from it, especially requests for money or changes to payment details. For a business, inform key clients and suppliers by phone as well.
Step 9: Secure linked accounts
Your email is used to reset passwords for social media, banking, Mobile Money apps, your website and more. Change passwords on any account that shares your old password, and check those accounts for suspicious activity. If financial information may have been exposed, contact your bank or mobile network immediately.
Step 10: Find out how it happened
Think back. Did you enter your password on a link from an email or SMS? Did you reuse the same password on another site that may have been breached? Did you log in on a public computer? Understanding the cause helps you avoid repeating it.
If you cannot recover the account
Sometimes recovery fails, particularly with free accounts that had no recovery phone or email set. If that happens:
- Keep trying the official recovery form with as much detail as possible.
- Create a new account and inform your contacts of the change.
- Update the email address on all your other accounts.
- Report impersonation to the provider so they can disable the hijacked account.
For businesses, this is one reason to use email on your own domain. If a mailbox is compromised, you or your host can always reset it, because you control the domain and the hosting account.
How to prevent future email hacks
- Use a unique, strong password for your email that you use nowhere else.
- Use a password manager to store passwords safely.
- Turn on 2FA and keep backup codes safe.
- Be suspicious of any message asking you to log in through a link.
- Keep your phone and computer updated.
- Review your account's security settings every few months.
Baasa Cloud business email gives you full control over mailboxes on your own domain, with spam filtering and a local support team that can help reset and secure accounts quickly if something goes wrong.
Frequently asked questions
Can a hacker still access my email after I change the password?
They can if you leave forwarding rules, connected apps or active sessions in place. Sign out of all sessions and remove anything you did not set up.
Should I delete a hacked email account?
Usually not. Recover and secure it, because deleting it can make you lose access to linked accounts and allow the address to be misused.
How do I know if my password was in a data breach?
Reputable breach checking services and some password managers can tell you if your email appears in known breaches. If it does, change that password everywhere it was used.
Is SMS two factor authentication enough?
It is much better than no 2FA. An authenticator app or security key offers stronger protection where available.
Conclusion
Learning how to recover a hacked email account gives you a clear plan when panic sets in. Work from a clean device, regain access through official channels, sign out other sessions, fix recovery options, remove hidden rules, turn on 2FA, warn contacts and secure linked accounts. Then build strong habits so your inbox stays yours.