What to do if you think your email account has been hacked

Most people assume that changing the password once will lock a hacker out – it doesn’t. The attacker may still have a session token or a recovery phone number under their control. Here’s what we actually do when a client suspects their mailbox has been breached. 1. Verify the breach straight away We start by looking for the tell‑tale signs: unexpected sent mail, login alerts from locations you’ve never been, or a sudden rise in spam sent from your address. In Outlook or Gmail check the Recent activity page – if you see a device you don’t recognise, the account is definitely compromised. 2. Revoke all active sessions From the security centre, hit “Log out of all sessions” or “Sign out everywhere”. This forces every device to re‑authenticate, cutting the attacker’s live connection. It’s a quick way to buy yourself time while you sort the rest. 3. Reset the password with a strong, unique phrase We recommend at least 12 characters, mixing upper and lower case, numbers and symbols – think Blue!Sparrow42$ . Do NOT reuse it on any other service. If you use a password manager, let it generate the new one for you. 4. Update recovery options Check the phone number and alternate email linked to the account. Hackers often change these so you can’t regain access. Remove any numbers you don’t recognise and replace them with a device you control. For extra safety, set up an authenticator app rather than relying on SMS codes. 5. Scan your devices for malware A compromised machine is the most