Separate real evidence from false warnings
Fictional example: a friend tells Jana that her mailbox sent an unfamiliar payment link. Jana opens her usual mail app and finds corresponding messages in Sent. She records that observation and begins securing the account rather than following a link in a warning.
An email headed “account hacked” is not proof by itself. Reach the service independently and examine actual activity and settings. For work or school accounts, contact the responsible administrator because organisational recovery procedures and available logs may affect the next steps.
Secure access and recovery routes
If you can still sign in, replace the password with a unique one using a trusted device. Review signed-in devices and terminate unfamiliar sessions. Check whether the recovery email, phone number or additional sign-in methods were changed without your knowledge.
If you are locked out, use only the provider’s official recovery process. Prepare known previous account information and case references. Submit evidence through the verified process only. A paid stranger promising to hack the account back cannot offer a reliable recovery guarantee.
Inspect less visible mail routes
Check automatic forwarding and filtering rules. Unfamiliar rules may copy, move or delete messages, hiding security warnings. Also examine connected applications, app-specific passwords and other permissions where the service provides those features. Each represents a possible route that needs separate consideration.
Record suspicious settings before removing them through official controls. A password change does not necessarily delete every rule. Review sent and deleted messages too, without opening suspicious links inside them or executing unsafe attachments merely to investigate their contents.
Prioritise linked services carefully
Make a short list of important services using this address for login or recovery. Start with financial access, central accounts and sensitive information. Look for actual password changes or unfamiliar sign-ins instead of describing every possible connection as a confirmed compromise.
Replace reused passwords and examine suspicious activity with each genuine provider. Contact the financial provider immediately if payment fraud may be involved. Even after securing the mailbox, messages already copied and personal information already exposed may remain outside your control.
Inform contacts and retain the sequence
Jana warns recipients of the identifiable fraudulent messages through another known channel. She briefly explains which message was not hers and asks them not to use its link. She does not circulate screenshots containing private correspondence or include any login information.
Keep a protected list of completed checks, support cases and unresolved issues. Review unusual activity within the agreed follow-up process. Complete recovery and a complete account of events cannot be guaranteed. Business accounts may also involve organisational duties that need discussion with the responsible team.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Why might a new password and two-factor protection not be enough?
Forwarding rules or other access permissions may still exist. Mailbox rules, connected apps and active sessions therefore belong in the review.
Can I tell which messages somebody read?
Not reliably on every service. Available activity logs can provide clues but may not record every message read or copied. Ask the provider which evidence it can supply.
Should I delete the mailbox immediately?
Premature deletion can complicate recovery, evidence and access to linked services. Secure the account first or agree the next steps with the provider or responsible IT team.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- BACS: Konto gehackt oder Daten abgeflossen – Was nun?Source review date:
- BACS: Phishing, Vishing, SmishingSource review date:
