Recover the mailbox before linked accounts
- Start at the provider's official account-recovery page.
- Remove unfamiliar sessions, rules, apps and recovery methods.
- Search for password resets, security alerts and financial messages sent during the compromise.
Check for access that survives a password change
A new password does not remove every forwarding rule, app connection or trusted session.
Sessions and devices
End unfamiliar sessions and remove devices you do not control.
Mail behavior
Inspect forwarding, filters, deleted items and sent mail for hidden changes.
Recovery and apps
Remove unknown recovery contacts, app passwords and connected applications before checking linked accounts.
Remove hidden access and protect reset routes
Check for hidden persistence
Attackers often create mail-forwarding rules, filters that hide security notices, app passwords or trusted devices. Review every security and mail-setting area, not only the password screen.
Work outward by consequence
Secure banking, mobile service, cloud storage, password manager, social media and work accounts that use the email for reset links.
Warn contacts safely
Use another known channel to warn people if the attacker sent requests or links. Keep the warning simple and do not repeat the malicious link.
If recovery fails
Follow the provider's documented compromised-account route. Ignore social-media replies offering paid recovery or claiming an employee can bypass the process.
Inspect the mailbox as a recovery system, not only an inbox
Email can reset financial, shopping, cloud and social accounts. The recovery must remove hidden access before those linked services can be trusted.
- Session review
- End unknown sessions and inspect device, browser and location details the provider makes available. Record suspicious access before removing it when that can be done without delaying containment.
- Mail rules
- Check forwarding addresses, filters, blocked senders, delegates, sent mail, deleted items and archived folders. Attackers may hide security messages or quietly copy incoming mail.
- Account recovery
- Verify recovery phone numbers, email addresses, app passwords, connected applications, security keys and backup codes. Replace exposed secrets and store new codes securely.
- Linked services
- Search for reset messages, purchase receipts, new-account notices and changed-payment alerts during the compromise window. Secure each affected service through its own official recovery process.
Warn contacts through another channel if the mailbox sent harmful links or money requests. Keep the warning simple and do not share details an attacker could use against the recovery. Recheck forwarding, sessions and recovery settings after the first cleanup because one overlooked connection can reopen access.
If the incident reaches another account or record
After securing the mailbox, use the account-takeover checklist to inspect connected financial and social accounts.
If recovery messages keep arriving, follow the unexpected reset-code response.
Record the email compromise
- List altered recovery details, unfamiliar sessions, forwarding rules and sent or deleted messages.
- Note the clean device and official recovery path used to secure the account.
- Record linked financial or identity accounts reviewed because the mailbox could reset them.
Questions that come up during containment
Should I delete all suspicious mail?
Preserve relevant security notices and sent messages first. They can define the compromise window and affected accounts.
Is changing the password enough?
No. Revoke sessions and check rules, recovery details, app access and backup codes as well.
Processes, rights and deadlines depend on your location, provider and policy. Use the relevant official service for your jurisdiction.