The short version: your email account can reset the passwords for your other accounts, so protect it first. Use a strong, unique password or a passkey, add a second step, and check for settings you did not make.
Why email is the master key
Click “Forgot password” on a shopping site. The site sends a reset link to your inbox. Whoever controls your inbox can use that link.
If someone gets into your email, they can ask for a reset link for any of your other accounts. Then they can change the password and lock you out. This is why your email is the most important account to protect.
There is no need to panic. Six checks make it harder for someone to take over your email.
Step 1: Give your email a strong, unique password, or a passkey
“Unique” means you use it for nothing else. If you reuse it and another site leaks it, a criminal needs only that one password. Change it as soon as possible if you have reused it.
A password manager can make and remember a long password for you. A passkey is a newer way to sign in with your fingerprint, face or screen lock instead of a typed password. Google says you can create one in its Security Checkup.
Step 2: Add a second step that is not a text message
A second step is called two-factor authentication (2FA) or 2-step verification. A stolen password is then not enough to get in. Choose a passkey or an authenticator app. Google says text message codes are open to common phishing tricks (scams that trick you into giving away a code). It names security keys (small devices you connect to your phone or computer) and Google prompts as stronger choices. Use a text message only if nothing else is offered.
Step 3: Check your recovery options
Recovery options are the phone number and backup email address the provider uses to help you get back in. Check that each one is current and yours. Remove old ones, such as a phone number you no longer have. Google says these details can also alert you to suspicious activity.
Also save your recovery codes, if your provider offers them.
Step 4: Check where you are signed in
Look at your devices and recent sign-ins. Sign out any device you do not know. Microsoft says mobile phone services can route activity through other places, so a strange location is not always a problem. A device you do not know is the clearer sign.
Step 5: Look for changes you did not make
A person who gets in once may leave a way to get back in. Check three places:
- Forwarding. This sends a copy of your new mail to another address. Gmail, Outlook and iCloud Mail all have it. Someone could read your mail without signing in.
- Filters or rules. These move, hide or delete messages on their own.
- Apps with access. Some apps and sites can get into your mailbox or account. Remove any that you do not know or no longer use.
Delete anything you did not set up. If you did not set up a forwarding address, also change your password.
Step 6: Do not type your password after clicking a link
Phishing is a fake message or call that tricks you into giving away a password, a code or other private details. If a message says there is a problem with your email, do not click its link. Open your email provider’s website or app yourself. Google says it never asks for your password in an email, message or phone call.
Where to look in four common providers
Gmail / Google Account
- Google Account > Security & sign-in > Security Checkup (look for any “Recommended actions”).
- In Gmail, open Settings > See all settings. Check the Forwarding and POP/IMAP tab, and check your filters.
- Open the “Linked apps” page in your Google Account to review and remove access.
Outlook / Microsoft account
- Sign in to your Microsoft account, open Security, and look at Recent activity (the last 30 days).
- In Outlook, open Settings > Mail > Forwarding (or Forwarding and IMAP), then check Mail > Rules.
- Microsoft’s activity list shows “Permission given to an application” when you let an app into your account. If you see one you do not recognize, change your password.
Apple Account / iCloud Mail
- On an iPhone: Settings > [your name], then scroll down to see your devices. Tap one to see “Remove from Account”.
- On icloud.com/mail: Settings > Mail Forwarding. Make sure “Forward my email to” is off, unless you set it.
- In the same Settings, check Rules.
Yahoo
- Open the Yahoo Account security page. Check “Current sign-ins”, “External connections” and “Recent account activity”.
- Sign out any device you do not know. To remove an app, delete its app password.
- Also check your Yahoo Mail settings for filters. Forwarding is a Yahoo Mail Plus feature, so a free account may not have it.
If you think someone got in
Take these steps in order:
- Use a device you trust. Change your email password.
- Sign out of all devices.
- Check forwarding, filters and apps with access.
- Check your recovery phone and email.
- Tell your contacts not to click links or send money if they get a message from you.
If you lost money or data, report it:
- US: reportfraud.ftc.gov.
- England, Wales and Northern Ireland: Report Fraud (formerly Action Fraud) at reportfraud.police.uk, or call 0300 123 2040.
- Scotland: call Police Scotland on 101.
- Phishing email, UK: forward it to report@phishing.gov.uk.
- Phishing email, US: forward it to reportphishing@apwg.org.
For a wider check of your other accounts, see the 30-minute account cleanup. Related words: account takeover, single sign-on, recovery code.
Do this today (about 9 minutes)
- Open your email provider’s security check (for example Google Security Checkup or the Microsoft account security page).
- Remove any forwarding rule or sign-in that you do not recognize. If you find one, also change your email password on a device you trust.
Another day: turn on a passkey or an authenticator app, then save your recovery codes.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.
