How to Secure Your Email Account After a Hack or Scam

 Your email account is one of your most important digital assets.

If a scammer or attacker gains access to your email, they may be able to reset passwords for other accounts, read private messages, or misuse your identity.

If you suspect your email account was hacked or exposed in a scam, take action quickly.

1. Change Your Email Password Immediately

If you can still access your account, change the password as soon as possible.

Create a strong password that you have not used anywhere else.

Avoid using:

• Old passwords

• Simple patterns

• Personal information

• The same password across multiple websites

A unique password reduces the damage if another website has a data leak.

If you suspect your password has been exposed, follow our guide on what to do if your password has been leaked.

2. Enable Two-Factor Authentication

Two-factor authentication adds an extra security layer.

Even if someone knows your password, they may still need a second verification step to access your account.

Enable it for your email account and other important services.

3. Check Recent Login Activity

Review your account activity and look for anything unusual.

Check for:

• Unknown devices

• Strange locations

• Unfamiliar sign-ins

• Security alerts you did not recognize

Remove access from devices or sessions you do not trust.

Google Security Checkup helps you review account security settings, signed-in devices, and recent security activity.

4. Review Recovery Information

Attackers may change recovery details to keep control of an account.

Check your:

• Recovery email address

• Phone number

• Backup options

Remove any information that does not belong to you.

For broader protection of your online accounts, review our guide on how to protect your online accounts from hackers.

5. Check Email Forwarding and Account Settings

Hackers sometimes create hidden rules to receive copies of your emails.

Review settings for:

• Email forwarding

• Filters or rules

• Connected apps

• Account permissions

Remove anything you did not create.

6. Secure Other Accounts Connected to Your Email

Your email may be used to recover many other accounts.

Review important services such as:

• Banking

• Social media

• Shopping accounts

• Payment services

Change passwords if they may have been exposed.

7. Watch for Fake Security Messages

After an account problem, scammers may pretend to be:

• Email providers

• Security teams

• Customer support

They may ask for:

• Passwords

• Verification codes

• Remote access

• Payment

Never share security information with unexpected callers or messages.

If someone asked you for a password or verification code, review our guide on what to do after sharing sensitive account information with a scammer

8. Scan Your Devices if Needed

If the account compromise happened after clicking a suspicious link or installing something unusual, check your devices.

If you clicked a suspicious link before the account problem started, follow our guide on what to do after clicking a phishing link on your phone.

Google provides an official account recovery process to help users regain access when they cannot sign in.

Keep:

• Operating system updated

• Browser updated

• Security software active

Remove suspicious applications or extensions.

Quick Safety Checklist

• Change your email password

• Enable two-factor authentication

• Check login activity

• Review recovery information

• Remove unknown devices

• Check forwarding rules

• Secure connected accounts

• Ignore fake support messages

Final Thoughts

Your email account is often the key to your entire online identity.

Protecting it after a hack or scam can prevent attackers from taking control of your other accounts.

Act quickly, use strong security settings, and never share verification codes or passwords with anyone.