Make your inbox a priority
Email often holds password-reset links, identification documents and conversations with work, family and service providers. A stolen inbox can be used to impersonate you and intercept account recovery.
Review these security settings
Use a unique password or passkey and enable MFA.
Confirm your recovery email and phone number. Remove details you no longer control.
Review signed-in devices and recent security activity.
Check automatic forwarding, inbox rules, delegates, app passwords and connected apps. Remove anything unfamiliar.
Keep your mail app and browser updated, and avoid leaving a mailbox open on a shared device.
Handle attachments and sign-in links safely
Unexpected invoices, shared documents and delivery notices can lead to fake sign-in pages. Confirm unusual requests separately. Use the document service's app directly rather than signing in from an unexpected link. Do not enable document macros, install extensions or run a command just to view a message.
If someone has accessed your email
Use a trusted device and the provider's official recovery process. If it is a work or school account, tell your IT team promptly.
Set a new unique password, revoke unfamiliar sessions and secure MFA and recovery methods.
Remove malicious forwarding rules and connected apps. Review sent, deleted and archived messages for changes.
Secure sensitive accounts whose resets arrive in this inbox. Warn contacts through another channel if fraudulent messages were sent.
Keep relevant alerts and message headers. If payments were redirected, contact the financial provider immediately.
When you cannot get back in
Use only the provider's official recovery pages. A stranger promising guaranteed recovery may be running another scam. Do not send them identity documents, payment or recovery codes. Keep the provider's case reference for follow-up.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.