I watched it happen to my cousin: one morning his email would not accept his password, and his friends started getting messages from him asking for gift cards. The account was taken over overnight, and he spent a frantic week untangling it.

The good news is that email providers have built recovery paths for exactly this situation. The bad news is that most people do not know the order to do things, so they panic and make it worse.

Act in This Order

When you realize the account is compromised, do not click around randomly. Follow this sequence:

1. Go straight to the provider’s account recovery page. Do not use the normal sign in. Search for the official recovery flow from the provider’s own site.
2. Use the recovery options you set up: recovery email, recovery phone number, or security questions.
3. Reset the password to something long and unique the moment you get back in.
4. Sign out of every device using the provider’s security settings. Most have a sign out everywhere button.

Check What the Attacker Changed

Once you are back in, the attacker may have added their own recovery email or phone number to keep access. Check the account’s security and recovery settings and remove anything you did not add. Look for:

• Unknown recovery email addresses or phone numbers
• Email forwarding rules you did not create
• Messages in your sent folder you did not send
• Recent sign ins from locations you do not recognize

Email forwarding is the sneaky one. An attacker can forward copies of your mail to themselves without touching your password, so check that setting specifically.

Lock Down Everything Else

Your email is the master key to your digital life, because password resets for other accounts land there. If your email was taken over, assume your other accounts are at risk:

• Change the password on any account that uses the same email. Start with banks, payment apps, and shopping sites.
• Turn on two factor authentication on your email first, then on the important accounts.
• Check your password manager if you use one, and rotate any password that was reused.

Tell People, Briefly

If the attacker sent messages from your account, tell the people who received them that the account was compromised and to ignore anything strange. A short group message is enough. Do not over share the details, just warn them not to click links or send money.

The best recovery tool is prevention: a recovery phone number set up today means a five minute recovery instead of a week of panic later.

If Recovery Fails

If the provider’s recovery flow does not work because the attacker changed everything, use the provider’s manual identity verification. It takes longer and may need ID documents, but it exists for exactly this situation. My cousin got his account back in four days through that path. It felt like forever, but it worked, and his bank account was untouched because he changed those passwords first.

📋 Quick Summary: Use the provider’s official recovery flow, reset to a strong unique password, sign out everywhere, remove unknown recovery options and forwarding rules, then change passwords on linked accounts and turn on two factor authentication.