The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If your email account may have been exposed, first distinguish a breach notice from signs that someone has actually accessed your mailbox. Follow the notice and your provider’s advice; if you see unfamiliar activity or lose access, recover the account through the provider, change to a unique password, end other sessions, enable two-factor authentication, and check settings attackers could have changed. Changing a password cannot retrieve information already copied.
Does a breach mean someone accessed your email?
Not necessarily. A company may report that information was exposed without evidence that anyone signed in to your email account. Follow the affected service’s instructions, and treat a notice as a reason to check your account—not proof of mailbox takeover.
As an Amazon Associate I earn from qualifying purchases.
The Federal Trade Commission (FTC) identifies warning signs that merit action: you cannot log in; your password, email address, or phone number changed without your permission; you receive a sign-in alert you do not recognize; or contacts receive messages you did not send. These signs indicate possible unauthorized access, but do not by themselves explain how it happened. See the FTC’s account recovery guidance and October 2024 alert.
Recommended Free Tools
What to do first if you cannot sign in
- Open the provider’s official recovery page directly. Do not follow recovery links in an unexpected email or text. Each provider has its own process, so no fixed recovery time or outcome can be guaranteed. The FTC links to provider recovery options; Google’s guidance directs people who cannot sign in, or whose account details changed, to its recovery page.
- After regaining access, change the password. Make it strong and unique to this account; do not reuse a password that may have been exposed. In its October 2024 alert, the FTC advises aiming for 12 to 15 characters or using a passphrase made of words separated by spaces. That is the FTC’s advice in that article, not a universal minimum standard.
- Sign out other devices and sessions. Use the provider’s account security controls to end sessions you do not recognize, or sign out of other devices where that option is available.
- Turn on two-factor authentication (2FA). Use an option your provider supports, and make sure you can still access the second factor and any backup method. Google gives a phone, security key, or printed code as examples. A physical security key is an optional choice; check that both your email provider and the key support it.
- Check recovery details. Confirm that the recovery email address and phone number belong to you and are accessible to you. Remove or correct details you do not recognize.
Audit activity, devices, and mail settings
Once access is secure, inspect recent security events and signed-in devices. Remove unfamiliar devices, connected apps, or access. Then look through settings that could let someone keep reading, redirect, or conceal messages. In Gmail, Google’s security tips and compromised-account guidance point users to account and mail settings that may need review.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Forwarding and filters: Look for an unfamiliar forwarding address or rules that forward, delete, or otherwise hide messages.
- Delegated access and mail protocols: Review who can access the mailbox and whether POP or IMAP settings have changed.
- Sending and automatic replies: Check “Send mail as,” your signature, and any vacation responder for changes you did not make.
- Mailbox activity: Review sent and deleted mail for messages you did not send or messages that may have been removed. Also check scheduled emails and labels if your provider offers them.
- Account and recovery settings: Check connected apps and changes to your recovery information or other security settings.
Remove access or settings only if you do not recognize them, and use your provider’s instructions. A setting you do not remember may have a legitimate explanation; check before deleting anything you rely on.
Secure devices and accounts connected to the email address
The FTC advises updating your computer’s security software and running a scan during hacked-account recovery. If it identifies suspicious software, the FTC says to delete it and restart. A clean scan does not prove the email account is secure; it is one part of checking the devices used to access it. See the FTC’s recovery steps and its hacked-email guidance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change passwords on other accounts that reused the exposed password. Prioritize accounts that use this inbox for password resets or sign-in, as well as accounts where a compromise could cause significant harm. Google also recommends checking apps and sites that share the password, use Google sign-in, contact the account, or contain saved passwords. Use a different password for each important account.
Warn contacts and report suspected identity theft
If your account sent messages you did not write, tell affected contacts through another channel. Ask them not to click unexpected links or act on requests for money that appear to come from you. If you believe personal information was stolen, the FTC’s October 2024 alert directs U.S. readers to IdentityTheft.gov to report identity theft and get a personalized recovery plan.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Why email account security matters
The FTC says, “Your email account is an important part of protecting your personal information online,” in its page “How To Recover Your Hacked Email or Social Media Account”, dated August 2023. Email can be a route to password resets and account notifications, which is why securing related accounts belongs in the response to a suspected mailbox takeover.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
