Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIf you suspect someone has taken over your email, use your provider’s official recovery page if you’re locked out. Once you regain access, secure the device you’re using, set a new unique password, remove unfamiliar account settings, turn on multifactor authentication, and check accounts and contacts that may be affected. Recovery steps differ by provider, and access is not guaranteed.
How to tell whether your email account may be compromised
One unusual event does not prove a takeover, but several signs deserve prompt attention:
As an Amazon Associate I earn from qualifying purchases.
- You can no longer sign in, or your password or account details appear to have changed.
- Messages were sent from your account that you did not write, or expected messages are missing.
- You see unfamiliar sign-ins or security events.
- Your account contains forwarding, filters, inbox rules, labels, connected accounts, or automatic replies you did not create.
Google lists changed account information and unfamiliar Gmail labels, filters, or forwarding among signs and settings to check in its account recovery and security guidance. The FTC also identifies unexpected sent messages and loss of access as warning signs in its consumer guidance on hacked email and social accounts. For Microsoft 365 work mailboxes, Microsoft calls out suspicious inbox rules, forwarding, sent or deleted mail, and unexplained lockouts in its organization response guidance.
Check security activity through the provider’s official site rather than relying on a notice email or an unexpected caller. Microsoft says it will not ask for your password by email; its advice is specific to Microsoft services, not every provider. See Microsoft’s Outlook.com account-protection guidance and Microsoft’s phishing guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you’re locked out, recover access through your provider
Use the official recovery route for the account in question. Avoid recovery links in unsolicited messages and check that you are on the provider’s genuine support domain. Do not give a password or verification code to someone who contacts you unexpectedly.
- Google: Start at Google Account recovery and answer the prompts as accurately as you can. Google’s account recovery guidance directs people who cannot sign in to this process.
- Microsoft or Outlook.com: Follow the steps on Microsoft’s hacked or compromised account page, which points to its sign-in helper and available self-service or support options.
- Another provider: Find the recovery instructions in that provider’s official help center. Recovery questions and verification requirements vary; Google’s or Microsoft’s process will not necessarily apply.
Use a device and network you trust if possible. An official recovery route cannot guarantee that the provider will restore access, and support may not be able to bypass its verification requirements.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
After you regain access, secure the account in this order
1. Check the device before entering a replacement password
If the device may be infected, clean it before changing your email password. Microsoft’s compromised-account guidance specifically says to ensure antivirus software is current and run a full scan before changing the password. The FTC also advises updating or installing reputable security software, scanning, and removing suspicious items in its hacked-account guidance. Prefer a trusted, updated device. A scan is a useful step, not proof that a device is clean.
2. Change the password and remove reuse elsewhere
Set a strong password that you do not use on any other service. If you reused the old password, replace it on other important accounts too, especially financial accounts. The FTC recommends unique passwords for important services such as email and banking, and notes that password-management software can help some people create and track strong passwords in its consumer guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Review security details and account settings
Inspect the account’s security activity and remove or correct anything you do not recognize. Check recovery email addresses, phone numbers, and other security methods; Microsoft notes that alternate email or phone security information can help restore access in its Outlook.com protection guidance.
Also check for settings an attacker could use to keep receiving messages or impersonate you:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Gmail: Review forwarding, filters, and labels using Google’s account-security guidance.
- Outlook.com: Look for unfamiliar connected accounts, forwarding, or automatic replies, as described in Microsoft’s compromised-account guidance.
- Any provider: Check sent and deleted mail, signatures, filters, and rules where those features are available. Remove settings you did not create.
4. Turn on multifactor authentication
Enable multifactor authentication (MFA), also called two-step or two-factor verification, wherever your provider offers it. CISA recommends MFA for email in its guidance on strong passwords and MFA. Options differ by provider. CISA identifies phishing-resistant methods as a stronger target, particularly for organizations, in its phishing-resistant MFA guidance.
A FIDO2 security key is one possible hardware option if your provider supports it. Check compatibility before buying one: a key is an authentication method, not an account-recovery tool, and it does not guarantee protection from every attack. If your provider offers recovery codes, store them somewhere secure rather than in the mailbox they are meant to help protect.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect contacts and accounts tied to this address
If messages went out from your account, tell affected contacts. Ask them not to click unexpected links or act on unusual requests, and to verify requests through a separate channel. The FTC recommends letting friends and family know that an email account was hacked in its consumer guidance.
Review important services that use this address for password resets. Email can be a route to reset access to other accounts, so check for unexpected password changes or activity, secure those accounts, and replace any reused passwords. This is a practical way to limit follow-on risk, not a provider-specific recovery requirement.
For Microsoft’s own service, its phishing guidance states: “Microsoft will never ask for your password in email, so never reply to any email asking for any personal information, even if it claims to be from Outlook.com or Microsoft.” See Microsoft’s phishing guidance. Do not assume that exact statement describes every email provider.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If the compromised mailbox belongs to your workplace
A Microsoft 365 organization mailbox needs an organizational response, not just the consumer steps above. Contact your IT or security team promptly so administrators can investigate mailbox rules, forwarding, sent and deleted items, contact changes, and associated services. Microsoft’s compromised email account response guidance is written for administrators handling that investigation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
