My Email Was Hacked. Here's Exactly What to Do, in Order

You notice emails you didn't send, or contacts telling you they got a strange message "from you," or you simply can't log in anymore. Here's the order that matters most.

Step 1: Try to get back in immediately

If you can still log in, change your password right now, before doing anything else. Choose something you haven't used anywhere else. If you're locked out, use your email provider's "account recovery" or "forgot password" option right away — the longer an intruder has access, the more damage they can do.

Step 2: Turn on two-factor authentication

Once you're back in, add a second verification step (a code sent to your phone) so a password alone won't be enough to get back in again.

Step 3: Check what they changed

Look for two things a hacker commonly does: a forwarding rule that secretly copies your incoming mail to another address, and a change to your recovery phone number or email. Both are usually found in your account's "Settings" or "Security" area. Remove anything you didn't set up yourself.

Step 4: Change passwords on anything linked to that email

Since email is often used to reset other passwords, treat every account tied to that email address (banking, shopping, social media) as potentially at risk. Change those passwords too, starting with anything financial.

Step 5: Warn your contacts

If the hacker sent messages from your account, a short note to your contacts ("my email was hacked, please ignore anything strange you received, don't click any links") prevents the scam from spreading further through people who trust you.

Step 6: Report it

If money or sensitive information was involved, file a report with the FTC at reportfraud.ftc.gov, in addition to securing the account itself.