If someone takes over your email, they may be able to read sensitive messages, use password-reset links to reach other accounts, and impersonate you to people who trust your address. A takeover does not always lead to identity theft or phishing, but it can turn one compromised account into a wider security and fraud problem. If you suspect it has happened, recover the mailbox through your provider’s official route, secure it and its recovery settings, then warn contacts and address any exposed accounts.
Why a hacked email account can put other accounts at risk
Email is often more than a place to receive messages. It may hold financial or personal correspondence, receipts, account notices, and details that help someone convincingly impersonate you. It may also be the address used to reset passwords elsewhere. An intruder who can read the inbox may find password-reset messages or trigger new resets, then use them to try to enter other accounts.
As an Amazon Associate I earn from qualifying purchases.
The risk is not limited to accounts that use the same password. A mailbox can expose recovery links and private context even when every other service has a different password. What happens next depends on what the intruder can access, which services rely on the email address for recovery, and how quickly the account is secured.
Free tools Windows power users keep installed
One-click scans. No signup required.
The Federal Trade Commission (FTC) warns that hackers target email and social accounts to steal personal information. Stolen information may be used for identity theft, malware distribution, or scams against other people. The FBI’s Internet Crime Complaint Center (IC3) also identifies deceptive emails as one way criminals steal login credentials. These are possible paths, not a claim that every takeover follows one sequence or that every phishing email comes from a hacked inbox.
#1 Best Overall
How a takeover can become phishing or identity theft
- Access is gained. Someone may trick the account owner into giving up credentials, or use credentials stolen elsewhere—particularly if a password was reused. Phishing messages can be one route to credential theft.
- The intruder examines the mailbox. Messages may reveal personal details, financial relationships, account names, and how the owner communicates. The inbox may also contain messages used to recover other accounts.
- Other accounts or identity information may be exposed. An attacker may attempt password resets or use details from messages to impersonate the owner. A mailbox takeover does not automatically give access to every linked account; each service has its own safeguards and recovery process.
- The attacker may contact people as the owner. A message from a familiar address can ask for money, login details, or a click on a malicious link. Contacts may be more likely to trust it because it appears to come from someone they know.
Phishing and identity theft are related but distinct risks. Phishing is a deceptive attempt to get information, money, or an unsafe action. Identity theft involves using someone’s personal information without permission. A takeover can enable either, both, or neither; the outcome depends on what the attacker does and what information or access is available.
How to tell if someone may have taken over your email
One alert or strange message can have an innocent explanation, but several changes you did not make—or a notification that you have lost access—warrant prompt action. The FTC identifies these warning signs:
- A notice says your password, email address, or phone number changed, but you did not make the change.
- You receive an alert about a login attempt or successful login you do not recognize.
- You can no longer sign in, or your usual password or recovery method no longer works.
- Contacts tell you they received messages you did not send, especially requests for money or credentials or messages containing suspicious links.
Do not use an unexpected message’s embedded “recovery” link to investigate. Go to the provider’s official website or app yourself and use its account-recovery flow. An alert is a reason to verify the account using a trusted route, not proof on its own that the account has been taken over.
Rank #2
What to do if someone took over your email
Work through these actions in order where possible. If you cannot regain access, start with the provider’s official recovery process; if money has been transferred or sensitive information is being misused, contact the affected institution promptly as well.
1. Open the provider’s official recovery route
Use the email provider’s official account-recovery page or app, reached by typing its known address or opening the app you already use. Do not follow a recovery link in an unexpected email or text. The FTC’s account-recovery guidance directs people to provider-specific instructions because the steps differ between services.
2. Check the device you will use for recovery
The FTC recommends making sure your computer security software is up to date and running a scan before proceeding through recovery. Use a device you trust. If you suspect the device itself is compromised, avoid entering a new password there until you can use a safer device or get appropriate technical help.
3. Change exposed passwords
Once you regain access, replace the mailbox password with a strong, unique one that you do not use on another site. The FTC suggests a password of 12–15 characters or a passphrase. Also change the password on any other account where you reused the old one. Prioritize important accounts such as financial services and accounts that can reset other credentials.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA password manager can help create and store unique passwords, but it does not undo a mailbox takeover or stop every form of phishing. The key point is that the email password—and any reused password—must no longer be useful to someone who already knows it.
4. End other sessions and inspect account access
Changing a password may not by itself end every active session or remove attacker-controlled settings. Use the provider’s security or account-activity controls to sign out other devices, review recent logins, and remove unfamiliar sessions or devices. Check that the recovery email addresses and phone numbers belong to you.
Rank #4
Also inspect mailbox settings that could preserve access or hide activity: forwarding rules, filters, connected apps, and any delegated access the provider offers. Remove settings or permissions you do not recognize. These checks are practical parts of securing the mailbox; the exact menu names and controls vary by provider.
5. Turn on the strongest practical multi-factor authentication
Multi-factor authentication (MFA) asks for another proof of identity in addition to a password. It reduces risk, but does not make account takeover impossible: attackers may target recovery flows, steal session tokens, compromise devices, exploit SIM swaps, or trick people into approving repeated sign-in prompts.
Where your provider supports them, prioritize phishing-resistant methods based on FIDO standards, such as a physical security key or a passkey. CISA describes physical FIDO security keys as a strong option against phishing; its December 2024 mobile communications guidance also identifies passkeys as an acceptable FIDO-based alternative. Support and enrollment steps depend on the provider and device.
If those methods are unavailable, use the strongest MFA option the provider offers. SMS and email codes are weaker than phishing-resistant MFA, though a code-based method may still add protection compared with relying only on a password. Before enrolling a physical key, check how to register a backup and how account recovery works if the key is lost.
| Method | Phishing resistance | Compatibility and recovery considerations |
|---|---|---|
| Physical FIDO security key | CISA identifies this as a strong, phishing-resistant choice. | The provider and device must support it. Check enrollment instructions and register a backup or understand the provider’s recovery process. |
| FIDO-based passkey | CISA identifies passkeys as an acceptable phishing-resistant alternative where supported. | Availability and the way a passkey is stored or synchronized depend on the provider and device. Confirm how you would recover access if you lose access to the device. |
| SMS or email code | Weaker than phishing-resistant methods, according to CISA’s MFA guidance. | May be a fallback when stronger methods are unavailable. Keep the associated phone number or recovery mailbox secure. |
6. Tell contacts what happened
After taking back control, notify people who may have received fraudulent messages from your address. Ask them to ignore unexpected requests for money, credentials, or links sent during the compromise. If someone already acted on a message, they should contact the relevant bank or service through an independently verified channel and secure their own account.
7. Protect exposed accounts and report fraud
If the mailbox contained financial, tax, government, or identity information, contact the affected organization using a known official website or phone number. For suspected identity theft in the United States, use IdentityTheft.gov, the FTC’s recovery resource. If a bank transfer or other bank fraud occurred, contact the financial institution immediately and file a report with FBI IC3. Report phishing to the FTC.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to reduce the chance of another takeover
- Use a unique password for email. Do not reuse it on other services; a password manager can help manage distinct passwords.
- Turn on MFA, choosing a FIDO security key or passkey when the provider supports it and you can maintain a safe recovery plan.
- Do not click unexpected links or open unexpected attachments. If a message claims to be from a bank or company, reach the organization through a website or phone number you already know is genuine.
- Pay attention to security notices about password, recovery-address, phone-number, or sign-in changes. Verify unexpected notices through the provider’s official site or app.
- Keep devices used to access email updated and protected, and review account activity and access settings when you receive an unfamiliar sign-in alert.
In 2025, the FTC reported that email was the most common reported contact method for scammers for the second consecutive year in 2024. It also reported more than $12.5 billion in total consumer fraud losses in 2024 and more than 1.1 million identity-theft reports received through IdentityTheft.gov that year. Those U.S. figures describe reported scam contact, total reported fraud losses, and identity-theft reports; they do not measure how many takeovers began with email or how many identity-theft cases were caused by mailbox compromise.
What the available figures do—and do not—show
The official figures establish that email is a common reported way scammers contact people and that reported fraud and identity theft are significant problems. They do not isolate email-account takeovers as the cause. There is no directly attributable figure in the cited official sources that counts identity-theft cases caused specifically by email account compromise, so it would be misleading to treat the overall fraud or identity-theft totals as takeover statistics.
CISA’s guidance also needs to be read in context. Its directive concerning the 2024 Microsoft corporate email compromise applied to federal civilian executive branch agencies. CISA encouraged other organizations that might have been affected to take stringent security measures, but the directive is not a consumer rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
