Hacked Email: What to Do Next (FTC Video Guide)

Friends are getting strange emails from you, or your password suddenly doesn’t work. Your email has probably been hacked. It’s fixable, and acting quickly matters because your email can reset almost every other account you own. This FTC video walks through the basics. Our checklist covers the settings hackers often change and how to lock the account down afterward.

From the Federal Trade Commission (FTC) · Part of our Online Safety Video Library

What the video shows

The video lists the common signs: people receiving messages you didn’t send, or being unable to log in. It advises staying calm and starting with your device: update your security software, scan for malware, delete anything suspicious, and restart.

Next, change your password and any similar passwords you use elsewhere, or contact your email provider to recover the account if you’re locked out. Then check your settings for unfamiliar forwarding or signature links, and let friends and family know your account was hacked.

Key takeaways

• Scan your device first, so a hacker can’t simply capture your new password.
• Change the email password, plus any other account that used the same or a similar password.
• Check settings hackers commonly change: forwarding, filters, signature, and recovery phone or email.
• Tell your contacts, so they don’t click links in messages ‘from’ you.
• Turn on two-step sign-in so a stolen password alone isn’t enough next time.

Hacked email recovery checklist

1. Scan your computer or phone with up-to-date security software and remove anything it flags.
2. Change your email password. If you can’t log in, use your provider’s official account recovery page.
3. Check recovery options. Make sure the backup phone number and email are yours, and remove any you don’t recognize.
4. Review forwarding and filters. Delete any rule that forwards, hides, or deletes your messages.
5. Sign out other sessions. Many providers let you see devices that are signed in and sign them out.
6. Turn on two-step sign-in, ideally with an authenticator app or passkey.
7. Change other passwords that matched or resembled your email password, starting with banking.
8. Warn your contacts not to click links or send money in response to recent messages from you.

Why your email matters most

Most websites send password reset links to your email. If someone controls your inbox, they can take over your bank, shopping, and social media accounts too. That’s why email is the first account to protect with a strong, unique password and two-step sign-in.

Common questions

How did they get my password?

Common causes include reusing a password that leaked in a data breach, a phishing message that imitated a login page, or malware on your device.

My provider says my account is fine but people still get spam ‘from’ me. Why?

Scammers can fake the ‘from’ name without accessing your account. If your sent folder shows nothing unusual and settings are clean, it may be spoofing rather than a hack.

Should I just make a new email account?

Usually it’s better to recover and secure the old one, since many accounts are linked to it. If recovery isn’t possible, update your important accounts to a new address.

Related guides

• Authenticator Apps Reviewed
• A Password Manager for a Household
• What to Do After a Data Breach: A Five-Step Checklist
• Phishing, Malware, and Ransomware: What’s the Difference?

About this video

This video was produced by the Federal Trade Commission (FTC), a U.S. government agency, and plays from the agency’s own channel. Juggling Chaos wrote this summary and guide; we are not affiliated with or endorsed by the agency. Some details on screen, such as phone models or web addresses, may look dated, but the advice still applies. Checked October 7, 2026.

The FTC’s written guide is How to Recover Your Hacked Email or Social Media Account.