Recover a Hacked or Locked-Out Email Account

Signs Your Email Was Hacked

Sometimes it is obvious; sometimes it is subtle. Here are the signs that someone else may have gotten into your account.

If you notice any of these, act soon but calmly. The faster you secure the account, the less a hacker can do with it.

• Friends say they got strange email or messages from you.
• Your password suddenly no longer works, though you did not change it.
• Mail you never read is already marked as read.
• Sent messages you did not write appear in your Sent folder.
• You get security alerts about a sign-in from a place you have never been.
• Your account settings, name, or picture changed on their own.

The First Calm Moves

Before you do anything else, these first steps put you in the best position to recover the account and limit the damage.

If you are still signed in on your phone but locked out on your computer, use the phone to change the password. That single change can push the hacker back out.

• Find a device you trust: a computer or phone you already use.
• If you are still signed in anywhere, do not sign out yet.
• From that device, change your password right away.
• If you are locked out, go to the official recovery page for your provider.
• Have your recovery phone number or backup email nearby.

Recovering a Google or Gmail Account

Google has a step-by-step recovery process. It asks questions only you should be able to answer, then helps you back in.

Answer from a device and location you normally use if you can. Google trusts a familiar device, which makes it more likely to let you back in.

• Open a web browser and go to the official Google Account recovery page.
• Type your Gmail address and click Next.
• Click Forgot password, or Try another way if needed.
• Google may text a code to your recovery phone; enter it.
• Or it may email a code to your backup address; enter that.
• Answer the questions as best you can, then set a new password.

Recovering a Microsoft or Outlook Account

If your address ends in outlook.com, hotmail.com, or live.com, you have a Microsoft account. Microsoft has its own recovery process.

The recovery form asks about old passwords, contacts you email, and subject lines you have used. Answer as many as you can; more answers improve your chances.

• Go to the official Microsoft account recovery page in a web browser.
• Enter your email address and click Next.
• Choose to receive a code by text or by your backup email.
• Enter the code Microsoft sends you.
• If that does not work, fill out the recovery form with your details.
• Once in, set a new password.

Recovering a Yahoo Account

Yahoo Mail has a recovery process much like the others. It leans on your recovery phone number or a backup email address.

If you no longer have access to the recovery phone or backup email, Yahoo may offer additional questions. Answer honestly and from a device you normally use.

• Go to the official Yahoo sign-in helper page in a web browser.
• Enter your Yahoo email address and continue.
• Choose to get a verification code by text or backup email.
• Enter the code Yahoo sends you.
• Follow the prompts to set a new password.

Recovery Phone and Backup Email

These two things are the keys that get you back into a locked account. It is worth understanding them, because they make all the difference.

When you are locked out, the provider sends a code to your recovery phone or backup email. If you can receive that code, you can prove you are the real owner and reset your password.

Set a Strong New Password

Once you are back in, the very first job is a brand-new password. Do not reuse an old one, and do not use anything easy to guess.

A good trick is to string together three or four random words with a number, like BlueKettleRiver7. It is long, hard to guess, and easy to remember.

• Long is strong: aim for a phrase of several words you can remember.
• Mix in a number and a capital letter to make it tougher.
• Do not use your name, birthday, or a pet's name.
• Never reuse the password from another account.
• Write it down on paper kept somewhere safe at home.

Turn On 2-Step Verification

This is the single best thing you can do to keep a hacker out for good. It adds a second check beyond your password.

You turn it on in your account's Security settings. It is sometimes called 2-step verification, two-factor, or 2FA. They all mean the same second check.

• After your password, the account asks for a one-time code.
• The code is texted to your phone or shown in an app.
• Even if a hacker steals your password, they cannot get the code.

Check for Hidden Forwarding Rules

A clever hacker often sets up a hidden rule so a copy of your mail is secretly sent to them, even after you change your password. You must remove these.

In Gmail, look under Settings, then Forwarding and POP/IMAP, and Filters and Blocked Addresses. In Outlook, check Rules and Forwarding under Mail settings.

• Open your email settings and find Forwarding.
• Make sure your mail is not being forwarded to an address you do not know.
• Open Filters or Rules and delete any you did not create.
• Check that your reply-to address and signature were not changed.
• Look at recently added recovery phones or emails; remove strange ones.

Tell Your Contacts

If the hacker sent mail in your name, your friends and family may have received scam messages that look like they came from you. A quick heads-up protects them.

A common scam sends your contacts a note saying you are stranded and need money wired urgently. Warning people means no one falls for it.

• Let people know your email was hacked and is now secured.
• Tell them to ignore and delete any odd message from you recently.
• Warn them not to click links or send money based on those messages.
• Ask them to let you know if they got anything strange.

What a Hacker Can Reach

It helps to understand why email matters so much. Your email is often the master key to many other accounts.

This is why recovering email quickly matters, and why turning on 2-step verification is so important. Protecting your email protects much of your online life.

• Password resets for other sites are sent to your email.
• Old messages may hold personal details, statements, or documents.
• Your contact list can be used to scam your friends.
• Shopping and banking accounts may be linked to your email.

Beware Fake Recovery Help

This page may be the most important in the guide. When people are locked out and worried, scammers are waiting to take advantage. Know the trap.

• You search online for a help number and call one you find.
• The number belongs to a scammer, not the real company.
• They ask for your password, a code, or remote access to your computer.
• They may demand a payment or a gift card to fix your account.

Finding the Real Recovery Page

Since so many fake pages exist, it is worth knowing how to reach the genuine recovery page for each provider.

If a page asks for a payment to recover a free account, it is fake. Close it. The real providers never charge you to get back into your own email.

• Type the address yourself; do not click a link from an email or ad.
• Google recovery lives under accounts.google.com.
• Microsoft recovery lives under account.microsoft.com.
• Yahoo recovery lives under login.yahoo.com.
• Ignore search ads at the top; scroll to the official site itself.

After You Are Back In

Once you have recovered the account and it is secure, a short checklist makes sure nothing was left behind by the hacker.

Most email services have a Recent activity or Security page showing where and when your account was used. Sign out of any device or place you do not recognize.

• Confirm your new password works and no one else is signed in.
• Check for and remove any strange forwarding rules or filters.
• Review recovery phone and backup email; remove anything you did not add.
• Turn on 2-step verification if you have not already.
• Look through Sent and Trash for messages the hacker sent or deleted.
• Update your name, picture, and signature if they were changed.

Keeping It From Happening Again

A little prevention goes a long way. These habits make your email very hard to break into in the first place.

Most hacks start with a stolen or reused password, or a fake login page. Guarding against those two things stops the vast majority of trouble.

• Use a long, unique password you do not use anywhere else.
• Keep 2-step verification turned on.
• Keep your recovery phone and backup email current.
• Never type your password into a page you reached from an email link.
• Be suspicious of any message that creates urgency or fear.

Locked Out, Not Hacked

Sometimes you are simply locked out because you forgot the password or got a new phone. That is not a hack, and the fix is gentler.

The same recovery pages solve these too. If you lost access to your code source, the Try another way option offers backup methods. Answer the questions from a familiar device.

• You forgot the password or mistyped it too many times.
• You got a new phone and lost the app that gave your codes.
• You changed your phone number and did not update recovery.
• The account was inactive for a long time.

When to Get Help

There is no shame in asking for a hand. Some situations really are easier with someone experienced sitting beside you.

When you call me, I will never ask for your password. I will guide you through the official steps, or come to your home and do it with you, at your pace.

• You have tried recovery and cannot get back in.
• You are not sure whether an email or page is real.
• You found strange rules or forwarding and are unsure what is safe to remove.
• Money or your bank may be involved.
• You simply feel overwhelmed and want calm, honest guidance.

A Calm Recap

If you remember only a handful of things from this guide, let it be these. They keep you safe and get you back in.

Being locked out feels frightening in the moment, but it is almost always fixable. Steady steps, official pages, and a little help win the day.

• Do not panic and do not pay anyone to recover a free account.
• Use only the official recovery pages you type in yourself.
• Set a strong, unique new password once you are back in.
• Turn on 2-step verification.
• Check for and remove hidden forwarding rules and filters.
• Tell your contacts if strange mail went out in your name.

What's in the 27-page PDF

• How to tell if your email was hacked
• The first, calm moves to make right away
• Official recovery steps for Gmail, Microsoft, and Yahoo
• Setting a strong new password and turning on 2-step verification
• Finding and removing hidden rules a hacker may have set
• Warning your contacts and knowing when to get help

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill