Dealing with a hacked email account
What is a hacked email account?
A hacked email account occurs when someone gains access to your email account without your permission. This can happen if your password was:
Stolen through a phishing attack.
Guessed because it was weak.
Reused from another website that experienced a data breach.
Captured through malware on one of your devices.
Once criminals gain access to your email account, they may be able to:
Read your private emails.
Reset passwords to your other online accounts.
Send scam emails pretending to be you.
Access sensitive documents and personal information.
Commit financial fraud or identity theft.
Because your email account is often linked to banking, social media, online shopping, work and other important services, gaining access to it can have serious consequences.
If you suspect your email account has been compromised, act immediately.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
How do I know if my email account has been hacked?
Common warning signs include:
You can no longer log in because your password no longer works.
You receive password reset emails that you did not request.
Friends, family or colleagues receive emails that you did not send.
You receive login alerts for unfamiliar devices or locations.
Your recovery email address, phone number or security settings have been changed without your knowledge.
Your emails have been deleted, moved or marked as read unexpectedly.
New forwarding rules or automatic replies have been created without your permission.
Example
Friends tell you they have received emails from you asking for money, gift cards or personal information, but you never sent those messages.
What to do if your email has been hacked
If you think your email account has been accessed without permission, don’t panic. Follow these steps as soon as possible.
Quick Response Checklist
1) Change your password immediately
If you can still access your email account:
Change your password immediately.
Choose a strong, unique password that you have never used before.
If you cannot sign in, use your email provider's official account recovery process.
2)Enable Multi-Factor Authentication (MFA)
If your email provider supports Multi-Factor Authentication (MFA), enable it immediately.
MFA can significantly reduce the likelihood of someone accessing your account again, even if they know your password.
3) Review your account settings
Check your account for any unauthorised changes, including:
Forwarding rules.
Recovery email addresses.
Recovery phone numbers.
Trusted devices.
Login history.
Security settings.
Remove anything you do not recognise.
If available, take screenshots of suspicious activity before making changes, as they may assist with reporting or investigation.
4) Check your sent emails
Review your Sent folder for messages you did not send.
If scam emails were sent from your account:
Warn your contacts not to click on any links or attachments.
Tell them to ignore any requests for money or personal information.
5) Scan your devices for malware
If malware was responsible for stealing your password, changing your password alone may not stop the attacker.
Run a full antivirus or anti-malware scan on every device you use to access your email account and remove any threats detected.
6) Change passwords on other important accounts
If you reused the same password elsewhere, immediately change the passwords for:
Banking accounts.
Mobile network accounts.
SARS eFiling.
Social media accounts.
Online shopping accounts.
Cloud storage services.
Insurance portals.
Medical aid portals.
Any other accounts linked to your email address.
Use strong, unique passwords for every account.
7) Contact your email provider
Most major email providers offer support for compromised accounts.
If you are unable to secure your account yourself, contact your provider's support team and follow their recovery process.
What to do if you cannot access your email
If the attacker has locked you out:
Use the Forgot Password option immediately.
Follow the provider's official account recovery process carefully.
Complete any identity verification requested.
Contact the provider's support team if recovery is unsuccessful.
Major providers, including Gmail, Outlook and Yahoo, have account recovery processes for compromised accounts.
How to report a hacked email
If your hacked email account has been used for fraud, identity theft, extortion, threats or unauthorised access to other online accounts, report the incident to the South African Police Service (SAPS) at your nearest police station. When reporting the crime ask for the case reference/CAS number and keep the reference number for future enquiries.
Clearly explain:
How your email account was compromised.
Whether money was stolen.
Whether other online accounts were accessed.
Whether your identity has been misused.
SAPS records reported crimes in its Crime Administration System and provides the complainant with a CAS number for future enquiries.
For an emergency requiring immediate police assistance, use the appropriate SAPS emergency reporting channel. For less serious complaints, SAPS advises contacting the nearest police station.
If your identity information may have been exposed or misused, you may also consider contacting the Southern African Fraud Prevention Service (SAFPS) for guidance on Protective Registration and identity-fraud protection. SAFPS provides Protective Registration for people whose identity has been compromised or who have experienced identity fraud.
How to protect your email in the future
Once your account is secure, take steps to prevent it from happening again.
Use strong, unique passwords. Use a different password for every online account and never reuse passwords across multiple services.
Consider using a password manager. A reputable password manager can:
Generate strong passwords.
Store them securely.
Help prevent password reuse.
Enable Multi-Factor Authentication (MFA). Enable MFA wherever it is available, particularly for:
Email accounts.
Banking services.
Social media accounts.
Cloud storage.
Be cautious of phishing. Do not click links or open attachments unless you are confident they are genuine.
Be particularly cautious of emails that:
Create a sense of urgency.
Ask you to verify your account.
Request passwords or verification codes.
Monitor your account activity. Regularly review:
Login history.
Connected devices.
Security alerts.
Recovery settings.
Investigate any unfamiliar activity immediately.
Keep devices updated. Keep your:Computer.
Mobile phone.
Tablet.
Applications.
Antivirus software.
fully updated with the latest security patches.
Common examples of email account hacks
Phishing
A fake email claims your account will be suspended unless you sign in immediately. The link leads to a fraudulent login page that steals your password.
Password Reuse
A password leaked during a breach of another website is used to access your email because the same password was reused.
Malware
Malicious software installed on your device captures your keystrokes or stored passwords and sends them to criminals.
Hacked email account do’s and don’ts
✅ Do
Change your password immediately.
Enable Multi-Factor Authentication (MFA).
Review your account settings for unauthorised changes.
Warn your contacts if fraudulent emails were sent from your account.
Scan your devices for malware.
Change passwords for other important accounts.
Preserve suspicious emails, login alerts and screenshots where possible.
❌ Don’t
Reuse old passwords.
Ignore security alerts or suspicious login notifications.
Delay taking action.
Click links in unexpected password reset emails without verifying them first.
Assume the attacker no longer has access without checking your account thoroughly.
Share your password or MFA codes with anyone claiming to help you.
Get additional support
If you continue to experience problems after following these steps:
Contact The Cyber Helpline for further guidance.
If you need technical assistance with your own device, consider seeking help from a trusted IT professional or reputable computer repair service.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.