You try to sign in and the password is rejected. Or you receive an alert that a new device just signed in from a city you have never visited. Or a family member forwards a message that came from your address and you know you did not send it.
Any of those signals means the email account needs immediate attention. Email is still the master key for most household digital life. It can reset banking passwords, open shopping accounts, reach school portals, and receive medical appointment reminders. The recovery sequence below is designed for the first hour, when speed and order matter more than perfection.
Print this page or keep it open on a second device so you can follow the steps without losing your place.
Do this now
From a different device or browser that is still signed in, change the password if you can.
If you are still logged in on a phone or computer, go straight to the account security settings and set a new password. Choose something you have never used elsewhere. Write it down on paper for the next few minutes; you will move it into a password manager later.If you cannot sign in at all, start the official account-recovery process immediately.
Use only the recovery link or form provided by the email provider itself—Gmail, Outlook, iCloud, Yahoo, or whichever service you use. Do not trust links that arrived in unexpected messages. The recovery flow will ask for previous passwords, recovery email addresses, phone numbers, or other details you set up earlier. Have those ready.Sign out of other sessions once you regain control.
Most major email providers offer a “sign out of all other devices” or “recent activity” page. Use it. This closes sessions that an unauthorized person may still have open.Turn on or strengthen two-factor authentication.
Prefer an authenticator app or a hardware key over SMS when the provider offers the choice. If the only option available right now is a text message to a phone number you control, use it and plan to upgrade later.Check the recovery email and phone number listed on the account.
If either has been changed, restore the correct ones and remove any unknown addresses or numbers.
Why the order prioritizes control before perfection
Changing the password or beginning official recovery while you still have any access limits the window an attacker has to lock you out further. Signing out other sessions immediately after regaining control closes active doors. Strengthening two-factor and verifying recovery contacts then hardens the account against the next attempt. Trying to perfect every setting before you have locked the door often leaves the account exposed longer.
What to do when you are completely locked out
If no device still has an active session, go directly to the provider’s official recovery page from a different device or network. Have previous passwords, recovery email, recovery phone, and any backup codes ready. The forms are designed to verify identity through information only the real owner should know. Do not use links from unexpected emails or texts claiming to help with recovery; those are frequently part of the same attack.
Handling the temporary paper password
Writing the new password on paper for a few minutes is a practical bridge, not a permanent practice. Once the account is secure and two-factor is enabled, move the password into a password manager and destroy the paper note. The short-term paper step prevents the common failure mode of setting a strong password and then immediately forgetting it under stress.
Preserve evidence while you work
Before you delete suspicious messages, save:
The headers or full source of any email that looks like it came from the compromised account.
Screenshots of login alerts that show time, location, or device.
A written list of the approximate time you first noticed the problem.
You may need these details if you later contact a bank, a shopping site, or a school about related activity. You do not need to become a forensic expert. A short dated note and a couple of screenshots are usually enough.
Why headers and alerts matter more than the body of the message
The body of a phishing or spam message sent from your address can be rewritten. The headers and the provider’s login-alert screenshots contain timestamps, IP or location clues, and device information that help later conversations with banks or platforms. Capturing them before cleanup preserves options without requiring specialized tools.
Keeping the evidence offline and limited
Store the screenshots and note on a device or in a folder that is not the compromised email itself. A notes app on a phone that did not open the suspicious messages, or a simple printed page, is sufficient. The goal is usable reference material, not a complete archive of every message that ever arrived.
When to stop collecting and start recovering
Evidence collection should take only a few minutes. Once you have the time, the approximate wording, and any login alerts, return to the recovery sequence. Over-collecting under stress delays the actions that actually cut off access and protect connected accounts.
Once you are back in the account
Work through the connected services in this order:
Banking and financial accounts that use the email for login or password resets.
Sign in to each one (using a password manager or the official app) and confirm that the email address on file is still correct. Change the password on any account that shared the old email password. Review recent transactions and set up or confirm transaction alerts.Shopping and payment accounts.
Amazon, PayPal, and similar services often allow password resets through email. Change those passwords and review order history and stored payment methods.School, work, and healthcare portals.
These accounts sometimes send sensitive notices only by email. Confirm the contact email and enable any available two-factor options.Social media and other high-value accounts.
Change passwords and review active sessions.
Do not try to fix every account in one sitting if you are exhausted. Secure the email first, then the financial accounts, then the rest over the next day or two.
Helping a family member whose email was taken over
If the compromised account belongs to a parent, spouse, or teenager, sit with them through the recovery form. The questions can feel invasive when someone is already upset. Keep the focus on the next field to fill in rather than on how the account was lost.
A useful script:
“We’re going to use the official recovery page only. I’ll read the questions with you. We can stop and call the provider’s support line if the form gets stuck.”
Avoid asking “What password did you use?” in a way that sounds like blame. The practical question is whether any other accounts shared that password, and those can be changed once the email is secure.
After the first recovery window
Create or update a simple one-page emergency sheet that lists:
The primary email address and the recovery email or phone.
The location of backup codes (printed and stored offline).
The official support numbers or help pages for the email provider and the main financial institutions.
Store the sheet where the household can find it under stress. The kitchen drawer works. A sealed envelope in a desk drawer works. A password manager emergency-access feature can work if everyone who needs it knows how to use it.
Review the “apps and services with access” or “third-party access” section inside the email account. Remove anything you do not recognize or no longer use.
What this does not mean
An email takeover does not automatically mean every connected account has been emptied. Many takeovers are limited to sending spam or phishing messages from the address. The sequence above assumes the safest practical posture: treat the email as compromised, cut off other sessions, and verify the high-value accounts that rely on it.
It also does not mean you need to abandon the email address forever. Once recovery is complete and two-factor authentication is in place, most people continue using the same address with stronger protections.
The next safe step
Open the security settings of your primary email account right now and confirm that the recovery phone number and recovery email are still correct. If two-factor authentication is off, turn it on using the strongest method the provider offers that you can actually maintain.
Take the next safe step.
