Friends getting strange emails from you? Lock the account down in the right order — fast.
Involved⏱ 30–60 minAny email provider
Your email is the master key to almost every other account, because password resets go there. If someone has got in, securing it quickly matters more than anything else.
Signs include contacts receiving spam or odd requests from you, sent messages you did not write, password-reset emails you did not request, or new forwarding rules that quietly copy your mail elsewhere.
Try these first — 30 seconds each
[ ]Try to sign in on the real site — if the password has been changed, go straight to account recovery.
[ ]Warn close contacts not to click links or send money in response to recent emails from you.
[ ]Do not reply to any message claiming to be your provider's "security team" asking for your password.
The full fix
6 steps in the order that solves it fastest, plus platform notes, prevention, and when to call
in a pro — unlocks with a short ad.
1
Change the password immediately
From a device you trust, change to a long, unique password you have never used anywhere else. If you cannot sign in, use the provider's official account-recovery page.
2
Sign out all other sessions
Most providers have a "sign out of all devices" or security page listing active sessions. Remove anything you do not recognise.
3
Turn on two-factor authentication
Use an authenticator app or passkey where available; text-message codes are better than nothing. This stops a stolen password alone being enough.
4
Check for hidden changes
Review forwarding addresses, filters/rules (attackers often create rules that delete or redirect replies), the recovery email and phone, and any connected third-party apps. Remove anything you did not set up.
5
Change passwords on accounts that share it
If you reused this password anywhere, change it there too, starting with banking, shopping, and social accounts. Then look for password-reset emails in your inbox you did not trigger.
6
Scan your devices
Run a full scan with your system's built-in security tool (Windows Security, or keep macOS up to date). Remove any browser extensions you do not recognise.
Platform notes
Any email provider
Services like Have I Been Pwned let you check whether your email address has appeared in known data breaches, which helps explain how a password leaked.
Stop it happening again
Unique passwords everywhere, stored in a password manager.
Two-factor authentication on email above all else.
Treat unexpected sign-in links with suspicion — go to the site directly.
When to get professional help
If money was requested or sent, contact your bank immediately. If sensitive personal information was exposed, your national cybercrime or consumer-protection agency can advise on identity theft steps.
This is general troubleshooting information for home users. Menus and settings differ between
device models and software versions. Back up important data before making changes, and contact
the manufacturer or an authorised repair provider for hardware faults or anything under
warranty.
🔓
Keep reading
Watch a short ad to unlock the full step-by-step fix — free, no account needed.
GlitchLantern