Recover a Compromised Email Account: Close Every Route Back In

01 / Field notes

Executive Summary

An email account is often the recovery route for everything else you own online. If somebody can read its messages, they may be able to reset other passwords, impersonate you in existing conversations or hide security notices. Recovery therefore has two jobs: regain control of the mailbox and remove the ways another person could continue using it.

A changed password is an important step, but it is not a complete incident record. You also need to inspect account recovery methods, signed-in devices, connected applications and mailbox rules. Different controls address different forms of access. A forwarding rule can keep sending messages elsewhere even when nobody is opening your inbox in a browser.

This guide covers accounts you own, with specific instructions for personal Gmail and Outlook.com. Work and school accounts may have administrator-controlled settings, retention requirements and different recovery routes. Contact that organization's IT or security team promptly rather than applying personal-account instructions to a managed mailbox.

The sequence below is a proposed response checklist, not a report of a tested breach or a guarantee that every trace of access can be found. You may not be able to establish what was copied. Keep that uncertainty visible while you make decisions about other accounts and people who could be affected.

02 / Field notes

Prerequisites / Lab Setup

Prepare a trustworthy place to recover

Use an updated device you have reason to trust. If your normal computer may contain malware or an unwanted extension, avoid entering new credentials into it until you have investigated. Microsoft's recovery guidance explicitly recommends a malware scan before changing a password on that computer. Using a separate trusted device lets you begin account containment while the suspect computer is being checked. [2]

Have your recovery phone or alternate email account available, if you still control them. Type the provider's address yourself or use an established bookmark. Do not use a recovery link supplied by a stranger in a message, a sponsored search result offering account rescue, or someone who asks you to send them a verification code.

Create a private incident note outside the affected mailbox. Record the time you noticed the problem, the alert or message involved, and the actions you complete. Screenshots of unusual settings can be useful, but keep passwords, recovery codes, message contents and personal addresses out of anything you share publicly. A small factual record is more useful than a large collection of sensitive screenshots.

03 / Field notes

Technical Analysis

Choose the recovery route that matches your situation

Being unable to sign in and seeing an unfamiliar location are different situations. A location alone is not proof of compromise: routing, mobile networks and VPN use can affect it. Compare the event with the device, time, activity and changes you recognize. Do not dismiss a genuine unwanted change simply because the approximate location looks familiar.

For Google, the official compromised-account guide links to account recovery if someone changed your password or recovery details. If you still have access, review Security & sign-in and Recent security events in your Google Account. Follow Google's response for activity that was not yours. For Microsoft personal accounts, begin with the sign-in helper linked from its compromised-account guide if normal sign-in fails. [1][2]

Do not repeatedly invent answers to recovery questions or pay an unofficial intermediary to bypass them. Use information you genuinely know and retain the provider's case details. If a service cannot verify ownership, this checklist cannot override its recovery process. Meanwhile, identify critical services that use the inaccessible mailbox and contact their own support teams through official routes.

Treat credentials, sessions and recovery methods separately

Create a new unique password using a password manager you trust. If the old password was reused, those other accounts also need unique replacements. Avoid a small variation of the exposed password: the objective is a new secret, not a new spelling of the same one. Store it somewhere you can access without relying solely on the affected mailbox.

Next, review the account's security and recovery settings. Look for an alternate email address, telephone number, authenticator, passkey or security key that you did not add. Remove unauthorized methods through the provider's security interface. Preserve legitimate recovery routes you still control. If you are unsure about a method, compare its label and creation information with your devices before removing your only usable sign-in option.

Enable or repair multi-factor authentication once the listed methods are yours. A stronger sign-in method helps prevent another password-only login, but it does not answer whether an existing session or a separate application grant remains usable. Keep the session and application reviews as their own checklist items rather than treating an MFA checkmark as proof that recovery is finished.

Google's device page can show multiple sessions for one device. Its listed time may reflect background communication, not just a person opening the account. Review all entries rather than assuming that duplicate names prove an attack or that one familiar name makes every session safe. Sign out sessions you do not recognize or no longer need. [3]

For a personal Microsoft account, Advanced security options includes Sign out everywhere. Microsoft says this can take up to 24 hours and excludes Xbox consoles. Record when you request it and address any Xbox access separately through Microsoft's guidance. The button is useful containment; its documented delay is a reason to continue the other checks promptly. [4]

Inspect applications that have account access

An application grant is a separate question from whether someone knows your password. A calendar helper, mail client or productivity integration may have permission to access some account data. Check what each application is allowed to do, who operates it and whether you still use it. The app's friendly name is not sufficient evidence that you authorized its access.

Google's linked-apps page distinguishes signing in with Google from granting an app access to Google Account data. Select the relevant application, view its details and remove access you did not authorize or no longer need. Removing a sign-in link is not the same as deleting your data at the other service. Review each connection type shown rather than stopping after removing the first visible link. [5]

For other providers, use their account security and application-consent pages, or ask the administrator of a managed account to review grants. Do not assume a Gmail menu exists in Outlook or that a personal-account switch has the same scope in a business tenant. Note any grant you cannot explain and obtain provider-specific help before calling the investigation complete.

Revocation limits future authorized use through that grant; it cannot prove that previously obtained messages were never copied. This is why a recovery record should say “unwanted access removed” when that is what you verified, rather than “all stolen data deleted.” If an unfamiliar application had access to sensitive documents, include that exposure in your follow-up decisions.

Look for mailbox rules that hide or export messages

Check forwarding even if every device now looks familiar. Mail handling is part of the account's configuration. A rule that forwards a receipt, a reset message or an entire conversation can matter as much as an interactive login. Inspect rules that delete, archive, redirect or mark messages as read, especially those matching security alerts or financial senders.

In Gmail on a computer, open Settings, then See all settings. The Forwarding and POP/IMAP or Forwarding tab contains the automatic-forwarding control. If unwanted forwarding is enabled, choose Disable forwarding and save the change. Then inspect Filters and blocked addresses separately: Gmail filters can forward selected messages even when general forwarding is off. Review each filter's condition and action, and delete or edit unauthorized rules. [6][7]

In Outlook.com, open Settings, then Mail and Forwarding to review automatic forwarding. Clear unwanted forwarding and save. Also inspect Settings, Mail, Rules. Microsoft documents rule-based forwarding and redirection separately from the forwarding setting, so checking only one page leaves a gap. Record suspicious destination addresses privately before removing the corresponding behavior. [8][9]

Review other account settings for unfamiliar changes, including automatic replies, sending identities and delegates where the provider offers them. Check Sent, Deleted and other folders for suspicious conversations without opening attachments or following their links. An empty Sent folder is not proof that no message was sent; it is only one piece of the available evidence.

Work outward from the mailbox to dependent accounts

List the services that use this address for password recovery. Prioritize accounts where misuse has an immediate consequence: your password manager, financial services, primary social accounts, cloud storage, domain registration and any workplace access. The list should reflect what you actually use, not a generic inventory you cannot finish.

For each priority service, open its official website directly, inspect recent security events and recovery settings, and change exposed or reused credentials. Review its active sessions and revoke access you do not recognize. If the service's password was reset during the incident, treat that as a distinct account-recovery task even after your email account is functioning again.

Think about the content of the mailbox as well as the account list. A conversation containing an invoice may enable a convincing follow-up scam. A stored identity document may create a different exposure from an old newsletter. Describe the information involved accurately when contacting the relevant provider; do not claim a particular message was read unless the evidence supports it.

04 / Field notes

Mitigation / Defense

Verify the changes before declaring recovery complete

Reopen the settings you changed and confirm the saved state. A checklist entry should describe an observable outcome: an unknown grant is gone, an unwanted forwarding destination is disabled, or your own recovery phone is present. “I visited the security page” is too vague to establish that a problem was corrected.

Send a harmless test message from an account you control, then confirm expected delivery and reply behavior. Use an ordinary sentence with no verification code or confidential information. This can reveal a broken or overlooked rule, but it does not demonstrate that nobody else receives a copy. The configuration review remains necessary.

Communicate without spreading the incident

A useful warning to a contact is specific: identify the approximate time, the suspicious subject or request, and the action they should avoid. Ask them to verify any changed payment details using a known phone number. Do not resend the malicious attachment as evidence or include a working phishing link in a group warning.

If the affected mailbox handled another person's confidential information or business records, involve the responsible organization. It may need to preserve logs or decide how to notify people. Consumer recovery steps are not a substitute for that organization's incident process, and deleting evidence to make the account look tidy can complicate its investigation.

Make the next recovery less fragile

Once the immediate incident is contained, check that your recovery email is independently protected and still accessible. Keep recovery codes securely outside the mailbox they recover. Review browser extensions and devices used with the account, update supported software, and remove integrations you no longer need. These are ongoing housekeeping tasks rather than proof that a particular attacker has been identified.

Retain a short final record with completed actions, dates and open questions. If unfamiliar activity returns, compare it with that record instead of repeating random password changes. Recurrence may point to an unresolved device issue, another recovery route, an application grant or a separate compromised account. Escalate with those concrete observations to the provider or your organization's security team.

05 / Field notes

References

Official provider instructions were checked on 25 October 2026. Menu labels can vary by locale and account type. Decision tables, prioritization and verification checklists are editorial synthesis, not a claim of a completed incident investigation.

1. Secure a hacked or compromised Google Account ↗Google Account Help · accessed 2026-10-26
2. How to recover a hacked or compromised Microsoft account ↗Microsoft Support · accessed 2026-10-26
3. See devices with account access ↗Google Account Help · accessed 2026-10-26
4. How to sign out of your Microsoft account everywhere ↗Microsoft Support · accessed 2026-10-26
5. Manage links between your Google Account and apps from other developers ↗Google Account Help · accessed 2026-10-26
6. Automatically forward Gmail messages to another account ↗Gmail Help · accessed 2026-10-26
7. Create rules to filter your emails ↗Gmail Help · accessed 2026-10-26
8. Turn on or off automatic forwarding in Outlook.com ↗Microsoft Support · accessed 2026-10-26
9. Use rules to automatically forward messages ↗Microsoft Support · accessed 2026-10-26

Questions readers ask