Hacked? Recover Your Email First, It Unlocks Everything Else

Almost every account you own, from Instagram to your bank, sends its password reset link to your email. Whoever controls your email can reset those accounts too.

If you fix Instagram first while the attacker still reads your email, they can take it again with one reset link. That is why Apple's own guide tells you to confirm with your email provider that your email is secure and that you still control it.

Use the page for your email provider. Each one links to the provider's own help pages.

• Gmail or Google Account: see our Google hacked page. If you cannot sign in, Google sends you to its account recovery page.
• Outlook, Hotmail or Microsoft account: see our Microsoft hacked page.
• iCloud Mail or Apple Account: see our Apple hacked page. If you cannot reset your password, Apple's recovery starts at iforgot.apple.com and includes a waiting period.

1. 1
   On Google, use the account recovery page if someone changed your password or recovery phone number, deleted your account, or you cannot sign in for another reason. Answer the questions as best you can.Read to them:“On Google, use the account recovery page if someone changed your password or recovery phone number, deleted your account, or you cannot sign in for another reason. Answer the questions as best you can.”source
2. 2
   On Microsoft, if you cannot sign in, reset your password.Read to them:“On Microsoft, if you cannot sign in, reset your password.”source
3. 3
   On Apple, if someone changed your password, reset it. If you cannot reset it or sign in, start account recovery at iforgot.apple.com.Read to them:“On Apple, if someone changed your password, reset it. If you cannot reset it or sign in, start account recovery at iforgot.apple.com.”source

Attackers often leave settings behind so they keep getting your mail after you change the password. Check these before anything else.

1. 1
   Gmail: remove any labels, filters or forwarding rules you did not set up.Read to them:“Gmail: remove any labels, filters or forwarding rules you did not set up.”source
2. 2
   Outlook: check your connected accounts, forwarding and automatic replies. Microsoft resets some settings after a hack, so set back the ones you need.Read to them:“Outlook: check your connected accounts, forwarding and automatic replies. Microsoft resets some settings after a hack, so set back the ones you need.”source
3. 3
   Apple: on account.apple.com, review your personal and security info and your devices. Fix anything wrong and remove devices you do not know.Read to them:“Apple: on account.apple.com, review your personal and security info and your devices. Fix anything wrong and remove devices you do not know.”source
4. 4
   Check your recovery phone number and recovery email. Change anything you did not set.Read to them:“Check your recovery phone number and recovery email. Change anything you did not set.”source

1. 1
   If you keep card or bank details in your account, contact your bank. Make sure no one gave it instructions in your name, like opening an account or moving money.Read to them:“If you keep card or bank details in your account, contact your bank. Make sure no one gave it instructions in your name, like opening an account or moving money.”source
2. 2
   Change the password on every account that used the same password as your email.Read to them:“Change the password on every account that used the same password as your email.”
3. 3
   Turn on two-step verification on your email so a stolen password alone is not enough to sign in.Read to them:“Turn on two-step verification on your email so a stolen password alone is not enough to sign in.”source
4. 4
   Then go platform by platform: social accounts, shopping and payment apps.Read to them:“Then go platform by platform: social accounts, shopping and payment apps.”