Most account takeovers are not loud. No skull on the screen. Just a password that stops working, or a friend asking why you emailed them a strange link. This guide covers the signs, why email is the account that matters most, how attackers usually get in, and what to do first. It is educational only, not personal advice.
Recognizing the most common warning signs
Start with the clearest one. You get a notice that your password or recovery address changed, and you did not change it. Or your usual password simply fails. The FTC lists both among the signs of a hacked email account, along with sign-in notices from a device or place you do not recognize.
Do not wave off an alert because the login seems to have failed. Open the account's security activity page and look at which devices and locations were actually used. That page tells you more than the alert does. Dismissing an alert because you were traveling is a common mistake.
Then there is the outbound side. Friends or family receive emails you never sent. These are often short and link-heavy. Your sent folder may show messages you do not remember writing.
The quiet signs are easy to miss. Mail goes missing. A forwarding rule appears. A filter sorts messages out of sight. An app you never approved has access. An intruder can set up forwarding and let copies of your mail flow out for a long time.
Here is a short scorecard. Count how many apply to you right now:
- Your password or recovery details changed without you.
- You cannot sign in at all.
- The security page lists a device or place you do not know.
- Contacts report spam or odd links from you.
- Sent messages you did not write.
- Missing mail, new filters, or new forwarding rules.
- Connected apps you do not remember approving.
- A burst of password reset emails you did not request.
One yes is worth checking. Several is worth acting on.
Why your email account matters more than others
Email is the master key. Most services send their password reset links to your inbox. Someone inside it can request a reset for a shopping, banking, or social account, read the link, change the password, and lock you out.
That is how a person who never touched your other accounts can still lose them. The reset messages simply went to the wrong hands.
So email security deserves steady attention, not a panic after the fact. Keep your recovery phone number and recovery address current. Review them now and then. A recovery detail that quietly changed is a common way in.
How attackers usually get in
Usually they already hold something. A password that was phished. A password reused on several sites. A password exposed in a breach at some unrelated company. A fancy new exploit is less common than a stale credential.
Credential stuffing replays leaked username and password pairs against other services. Password spraying tries a few common passwords across many accounts, so no single account trips a lockout.
MFA fatigue is exactly what it sounds like. The attacker triggers approval prompts over and over until the tired user taps yes. Session cookie hijacking and password-capturing malware can also get around a strong password.
This is why a sudden pile of reset emails or an unexpected verification prompt is not routine noise. Treat it as meaningful until you have checked.
Steps to take if you suspect a takeover
Order matters. Do these first, in this sequence.
1. Clean the device first
Software on a compromised computer may record the new password as you type it. The FTC order is to update your security software, run a scan, delete what it finds, restart, and only then begin recovery. See the FTC consumer alert on hacked email and social media for the agency's own wording.
2. Change the password and sign out everywhere
If you can still get in, choose a long password used nowhere else. Then sign out of all devices. On some providers a new password alone does not end sessions that are already open.
3. Remove what the intruder left
Check forwarding rules, filters, connected apps, app passwords, and recovery phone numbers and addresses. Delete anything you did not set up. A new password does not erase these.
4. Turn on two-factor authentication
Passkeys and hardware security keys are generally considered stronger than text message codes, which can be bypassed through SIM swapping. A text code is still better than nothing.
5. Use only the official recovery process
Do not search for a support number. People who advertise recovery help may be running a second scam, and some large providers say they do not offer phone support for sign-in problems. Also be careful with a threatening email claiming your account was taken over. It can be spoofed. Check through the official site, not the links in the message.
One gap worth stating plainly: this guide does not cover checking bank or card accounts for misuse, or what protections apply to losses. Those questions need official sources of their own.
