How To Change Your Email Password After a Hack: A Step-by-Step Guide to Securing Your Account

Introduction: The Dreaded Email Hack

Discovering that your email account has been compromised can feel like a punch to the gut. It’s a violation of privacy, a potential gateway for identity theft, and a source of immense stress. Your email isn’t just a place for messages; it’s often the key to your entire online life. It’s linked to your bank accounts, social media profiles, shopping accounts, and countless other services. A hacker gaining access can wreak havoc in a matter of minutes.

If you suspect your email has been hacked, time is of the essence. The faster you act, the better your chances of mitigating the damage and securing your account. This comprehensive guide will walk you through the essential steps to take immediately after an email hack, focusing primarily on changing your password and implementing other security measures.

Step 1: Recognize the Signs of a Hacked Email Account

Before we dive into the recovery process, let’s make sure you’re actually dealing with a hack. Sometimes, what appears to be a hack could be a simple case of forgetting your password or a temporary glitch. However, certain signs strongly suggest a compromise:

• Unusual Account Activity: Keep an eye out for emails you didn’t send, read messages marked as unread, or sent items you don’t recognize.
• Password Reset Notifications: Receiving password reset requests you didn’t initiate is a major red flag. It means someone is actively trying to gain access to your account.
• Suspicious Login Attempts: Many email providers now send notifications when a login occurs from a new device or location. If you see one you don’t recognize, investigate immediately.
• Changes to Your Account Settings: Look for alterations to your profile information, recovery email, phone number, or security questions. Hackers often change these settings to lock you out and maintain control.
• Friends Reporting Strange Emails: If your contacts tell you they’ve received spam or phishing emails from your account, it’s a clear sign your account has been compromised.
• Being Locked Out: The most obvious sign is being unable to log in to your account with your usual password.

If you notice any of these signs, proceed with the steps below as quickly as possible.

Step 2: Immediately Change Your Email Password

This is the most crucial step. If you can still access your account, change your password immediately. Don’t delay. Even if you think the hacker hasn’t done anything yet, changing your password prevents them from causing further damage.

Here’s how to change your password on some of the most popular email platforms:

Gmail

1. Go to your Google Account settings (myaccount.google.com).
2. Click on “Security” in the left-hand navigation.
3. Under “Signing in to Google,” click on “Password.”
4. You may be asked to verify your identity.
5. Enter your new, strong password and click “Change Password.”

Outlook/Hotmail

1. Go to your Microsoft account security settings (account.microsoft.com/security).
2. Click on “Change password.”
3. You may be asked to verify your identity via email or phone.
4. Enter your current password, then your new password twice, and click “Save.”

Yahoo Mail

1. Go to your Yahoo account security settings (login.yahoo.com/account/security).
2. Click on “Change password.”
3. Enter your new, strong password and click “Continue.”

AOL Mail

1. Go to your AOL account security settings (myaccount.aol.com).
2. Click on “Account Security.”
3. Click on “Change Password.”
4. Enter your current password, then your new password twice, and click “Save.”

Important Considerations When Choosing a New Password:

• Strength is Key: Your new password should be strong and unique. Avoid using easily guessable information like your name, birthday, or pet’s name.
• Length Matters: Aim for a password that is at least 12 characters long. The longer, the better.
• Mix It Up: Use a combination of uppercase and lowercase letters, numbers, and symbols.
• Avoid Common Passwords: Don’t use common passwords like “password123” or “123456.”
• Use a Password Manager: Consider using a password manager to generate and store strong, unique passwords for all your accounts. Popular options include LastPass, 1Password, and Dashlane.

Step 3: Enable Two-Factor Authentication (2FA)

Changing your password is a critical first step, but it’s not always enough. Two-factor authentication (2FA) adds an extra layer of security to your account, making it much harder for hackers to gain access, even if they have your password.

With 2FA enabled, you’ll need to provide a second verification factor, in addition to your password, when you log in from a new device or location. This second factor is typically a code sent to your phone via text message or generated by an authenticator app.

Here’s how to enable 2FA on the major email platforms:

Gmail (Google Account)

1. Go to your Google Account settings (myaccount.google.com).
2. Click on “Security” in the left-hand navigation.
3. Under “Signing in to Google,” click on “2-Step Verification.”
4. Follow the on-screen instructions to set up 2FA using your phone number or an authenticator app.

Outlook/Hotmail (Microsoft Account)

1. Go to your Microsoft account security settings (account.microsoft.com/security).
2. Under “Advanced security options,” find “Two-step verification” and turn it on.
3. Follow the on-screen instructions to set up 2FA using your phone number or an authenticator app.

Yahoo Mail

1. Go to your Yahoo account security settings (login.yahoo.com/account/security).
2. Click on “Turn on two-step verification.”
3. Follow the on-screen instructions to set up 2FA using your phone number or an authenticator app.

AOL Mail

1. Go to your AOL account security settings (myaccount.aol.com).
2. Click on “Account Security.”
3. Turn on “Two-Step Verification.”
4. Follow the on-screen instructions to set up 2FA using your phone number or an authenticator app.

Choosing an Authenticator App:

While receiving codes via SMS is convenient, using an authenticator app is generally more secure. Authenticator apps generate time-based codes that are less susceptible to interception than SMS messages. Popular authenticator apps include Google Authenticator, Microsoft Authenticator, Authy, and LastPass Authenticator.

Step 4: Review and Update Your Recovery Information

Your recovery email and phone number are crucial for regaining access to your account if you ever forget your password or get locked out. Hackers often change this information to prevent you from recovering your account. Therefore, it’s essential to review and update your recovery information immediately after a hack.

Here’s how to review and update your recovery information on the major email platforms:

Gmail (Google Account)

1. Go to your Google Account settings (myaccount.google.com).
2. Click on “Personal info” in the left-hand navigation.
3. Under “Contact info,” check your email and phone number. Make sure they are accurate and up-to-date.
4. Add or update any missing information.

Outlook/Hotmail (Microsoft Account)

1. Go to your Microsoft account security settings (account.microsoft.com/security).
2. Under “Advanced security options,” review your recovery email and phone number.
3. Add or update any missing or incorrect information.

Yahoo Mail

1. Go to your Yahoo account security settings (login.yahoo.com/account/security).
2. Under “Account security,” review your recovery phone number and email address.
3. Update any outdated or incorrect information.

AOL Mail

1. Go to your AOL account security settings (myaccount.aol.com).
2. Click on “Account Security.”
3. Review your recovery email and phone number.
4. Update any outdated or incorrect information.

Step 5: Scan Your Devices for Malware

Sometimes, email hacks are the result of malware on your computer or mobile device. Malware can steal your passwords, track your keystrokes, and compromise your online security. After an email hack, it’s crucial to scan your devices for malware to ensure your system is clean.

How to Scan for Malware:

• Run a Full System Scan: Use a reputable antivirus program to perform a full system scan on your computer and mobile devices. Popular antivirus programs include Norton, McAfee, Bitdefender, and Kaspersky. Windows Defender, which comes pre-installed on Windows, is also a decent option.
• Update Your Antivirus Software: Make sure your antivirus software is up-to-date with the latest virus definitions. This will ensure it can detect and remove the latest threats.
• Consider a Second Opinion Scanner: If you’re concerned that your primary antivirus program might have missed something, consider running a second opinion scanner. These scanners are designed to detect malware that your primary antivirus program might have overlooked. Examples include Malwarebytes and HitmanPro.
• Be Cautious of Suspicious Files: Be extra careful when opening email attachments or downloading files from the internet. Avoid clicking on suspicious links or downloading files from untrusted sources.

Step 6: Review Your Email Filters and Forwarding Settings

Hackers often create email filters and forwarding rules to intercept your emails, send spam from your account, or gather sensitive information. Review your email filters and forwarding settings to ensure they haven’t been tampered with.

Here’s how to review your filters and forwarding settings on the major email platforms:

Gmail

1. Go to your Gmail settings (mail.google.com).
2. Click on the “Filters and Blocked Addresses” tab.
3. Review your filters and delete any that you didn’t create.
4. Click on the “Forwarding and POP/IMAP” tab.
5. Disable any forwarding addresses that you don’t recognize.

Outlook/Hotmail

1. Go to your Outlook settings (outlook.live.com).
2. Click on “View all Outlook settings” at the bottom.
3. Click on “Mail,” then “Rules.”
4. Review your rules and delete any that you didn’t create.
5. Click on “Mail,” then “Forwarding.”
6. Disable forwarding if it’s enabled and you didn’t set it up.

Yahoo Mail

1. Go to your Yahoo Mail settings (mail.yahoo.com).
2. Click on “Settings,” then “More Settings.”
3. Click on “Filters.”
4. Review your filters and delete any that you didn’t create.
5. Click on “Forwarding.”
6. Disable forwarding if it’s enabled and you didn’t set it up.

AOL Mail

1. Go to your AOL Mail settings (mail.aol.com).
2. Click on “Options,” then “Mail Settings.”
3. Click on “Filters.”
4. Review your filters and delete any that you didn’t create.
5. Click on “Forwarding.”
6. Disable forwarding if it’s enabled and you didn’t set it up.

Step 7: Check Your Connected Accounts and App Permissions

Many email providers allow you to connect your account to other services and apps. Hackers can exploit these connections to access your data or send spam from your account. Review your connected accounts and app permissions and revoke access to any apps or services that you don’t recognize or no longer use.

Here’s how to check your connected accounts and app permissions on the major email platforms:

Gmail (Google Account)

1. Go to your Google Account settings (myaccount.google.com).
2. Click on “Security” in the left-hand navigation.
3. Under “Third-party apps with account access,” click on “Manage third-party access.”
4. Review the list of apps and services that have access to your account.
5. Remove access for any apps or services that you don’t recognize or no longer use.

Outlook/Hotmail (Microsoft Account)

1. Go to your Microsoft account security settings (account.microsoft.com/security).
2. Under “Advanced security options,” find “Manage how you sign in to Microsoft” and click on it.
3. Review the list of apps and devices that have access to your account.
4. Remove any devices or apps that you don’t recognize or no longer use.

Yahoo Mail

Yahoo Mail doesn’t have a central location to manage connected apps. You’ll need to review the settings of each individual app or service that you’ve connected to your Yahoo Mail account.

AOL Mail

AOL Mail also doesn’t have a central location to manage connected apps. You’ll need to review the settings of each individual app or service that you’ve connected to your AOL Mail account.

Step 8: Notify Your Contacts

If your email account has been hacked, it’s important to notify your contacts as soon as possible. Let them know that your account has been compromised and that they should be wary of any suspicious emails they receive from you. This will help prevent them from falling victim to phishing scams or malware attacks.

What to Tell Your Contacts:

• Inform them of the hack: Clearly state that your email account has been hacked.
• Warn them about suspicious emails: Tell them to be cautious of any emails they receive from you, especially those containing links or attachments.
• Advise them to verify requests: If they receive a request for money or personal information, instruct them to verify the request through another channel, such as a phone call or text message.
• Apologize for any inconvenience: Apologize for any inconvenience or concern the hack may have caused them.

Step 9: Monitor Your Accounts for Fraudulent Activity

After an email hack, it’s crucial to monitor your other online accounts for fraudulent activity. Hackers often use compromised email accounts to access other services, such as bank accounts, social media profiles, and shopping accounts. Keep a close eye on your financial statements and credit reports for any unauthorized transactions or suspicious activity.

Steps to Monitor Your Accounts:

• Check Your Bank Accounts Regularly: Log in to your bank accounts frequently to review your transactions and balances. Report any unauthorized transactions to your bank immediately.
• Monitor Your Credit Reports: Order a free copy of your credit report from each of the three major credit bureaus (Equifax, Experian, and TransUnion) and review them carefully for any suspicious activity. You can order your free credit reports at AnnualCreditReport.com.
• Set Up Account Alerts: Enable account alerts for your bank accounts, credit cards, and other online services. These alerts will notify you of any unusual activity, such as large transactions or changes to your account information.
• Be Wary of Phishing Emails: Be extra cautious of phishing emails that attempt to trick you into providing your personal or financial information. Never click on links or open attachments from suspicious emails.

Step 10: Report the Hack to the Authorities (If Necessary)

In some cases, it may be necessary to report the email hack to the authorities. If you believe you’ve been the victim of identity theft or financial fraud, consider filing a report with the Federal Trade Commission (FTC) or your local law enforcement agency.

When to Report the Hack:

• Identity Theft: If the hacker has used your email account to steal your identity or open fraudulent accounts in your name, report the incident to the FTC.
• Financial Fraud: If the hacker has accessed your bank accounts or credit cards and made unauthorized transactions, report the incident to your bank and the FTC.
• Significant Damage: If the hack has caused significant damage to your personal or professional life, consider filing a report with your local law enforcement agency.

Prevention is Better Than Cure: Future-Proofing Your Email Security

While knowing how to recover from a hack is essential, proactively preventing one is even better. Here are some measures you can take to enhance your email security and reduce the risk of future attacks:

• Use Strong, Unique Passwords: As mentioned earlier, use strong, unique passwords for all your online accounts, especially your email account.
• Enable Two-Factor Authentication: Enable 2FA on all your important accounts, including your email, bank, and social media accounts.
• Be Wary of Phishing Emails: Be cautious of phishing emails and avoid clicking on suspicious links or opening attachments from untrusted sources.
• Keep Your Software Up-to-Date: Keep your operating system, web browser, and antivirus software up-to-date with the latest security patches.
• Use a Password Manager: Use a password manager to generate and store strong, unique passwords for all your accounts.
• Be Careful on Public Wi-Fi: Avoid accessing sensitive information on public Wi-Fi networks, as these networks are often unsecured.
• Regularly Review Your Account Settings: Periodically review your email account settings, including your recovery information, filters, and forwarding settings.
• Educate Yourself: Stay informed about the latest cybersecurity threats and best practices.

Conclusion: Taking Control of Your Digital Security

An email hack can be a stressful and disruptive experience. However, by taking swift action and following the steps outlined in this guide, you can mitigate the damage, secure your account, and prevent future attacks. Remember, vigilance and proactive security measures are the best defense against cyber threats. Stay informed, stay cautious, and take control of your digital security.

By following these steps, you can significantly reduce the risk of falling victim to email hacks and protect your online identity and personal information. Digital security is an ongoing process, not a one-time fix. Keep yourself updated on the latest threats and adapt your security practices accordingly. The internet can be a safe place if you take the necessary precautions.