If someone controls your email, they may be able to reset other accounts. Secure the mailbox first, remove hidden access, then work outward. Use a trusted device and open the provider's site or app yourself.
Choose the branch you have
| What works now | First move | Do not assume |
|---|---|---|
| A trusted session still works | Change to a unique password and correct recovery methods before signing out. | A password change alone ends every session or removes hidden access. |
| You are locked out | Use official recovery from a familiar device, browser, and location. | Support can bypass identity checks or safely ask for a code. |
| It is a work or school mailbox | Contact the organization's administrator or security team through a known channel. | Consumer recovery instructions control a managed account. |
Keep a trusted session open until you have checked recovery options.
If you are still signed in
- Change the password. Make it unique. Replace reused copies after the mailbox is stable.
- Correct recovery and sign-in methods. Remove unfamiliar phones, addresses, aliases, two-step methods, passkeys, and recovery codes. Add one you control before removing the last working method.
- Review activity and devices. Remove unfamiliar sessions. Location is a clue, not proof.
- Review connected access. Remove unfamiliar apps, delegates, and app passwords. Disconnecting an app does not erase data it already received.
- Use the sign-out control. Microsoft says its global action may take up to 24 hours and excludes Xbox consoles.
If you are locked out
Go directly to official recovery. Use a familiar device, browser, and location; give the most recent password you remember.
| Provider | Start here | Important limit |
|---|---|---|
| Use Account Recovery; enter codes only at accounts.google.com. | Managed accounts may require an administrator. | |
| Microsoft | Use Sign-in Helper, then the recovery form if directed. | Support cannot bypass two-step verification without another method. |
| Apple or iCloud Mail | Try a trusted device or recovery contact, then iforgot.apple.com. | Recovery may take days; using other signed-in devices can cancel it. |
Never send a password or verification code by email, phone, or message.
Remove the quiet ways back in
A clean password does not fix mailbox rules. Remove only what you do not recognize.
- Mail controls: forwarding, rules, filters, labels, blocked addresses, and automatic replies.
- Connected mail: delegates, connected accounts, send-as addresses, IMAP, and POP.
- Messages: Sent, Deleted, scheduled mail, and reset notices.
- Access: devices, sessions, apps, app passwords, and recovery changes.
Google lists delegation, forwarding, filters, and IMAP/POP in its checks. Microsoft lists connected accounts, forwarding, and automatic replies.
Protect the accounts downstream
- Password manager. Review sessions, recovery, vault changes, and emergency access.
- Money and identity. Check banks, cards, payment apps, and tax or shopping accounts for new payees, transfers, addresses, or resets.
- Cloud, social, and work. Prioritize reused passwords, suspicious notices, and accounts recovered through this mailbox.
- Contacts. Warn people through another channel about unexpected links or payment requests.
Search for resets, alerts, forwarding confirmations, and financial changes. Note unfamiliar addresses, devices, dates, and transactions without delaying containment.
Know when the first hour is over
The immediate problem is contained when a trusted recovery method works, unfamiliar access is removed, high-risk accounts are checked, and contacts know which messages were false. Keep watching alerts and financial activity.
Build an account recovery plan. If phone service failed, follow the SIM-swap route. Then compare two-factor methods.
