At a glance
Email and online accounts are valuable targets for cybercriminals. They will try gain access to your account and steal your information. If you think your account is compromised, secure your email, money and connected accounts. You should also notify your contacts and report the incident to us.
Emergency help: If there is an immediate threat to life or risk of harm, call 000.
Email and online account compromise explained
Email and online account compromise is when someone gets unauthorised access to your email or online account and pretends to be you. Online accounts include streaming services and social media platforms.
Cybercriminals target email accounts because they store sensitive information. They can use this information to:
- impersonate you
- scams others
- reset passwords
- gain access to connected online accounts.
Learn more about different types of account compromise.
Signs you may be affected
You may be experiencing email or online account compromise if you:
- notice changes to your account you didn’t make, such as emails marked as read when you haven’t opened them
- notice posts or activity in your account you don’t recognise
- notice changes to your profile, recovery details or privacy settings
- don’t recognise emails in your deleted or sent folders
- stop receiving expected emails
- receive an unexpected password reset notification
- have been automatically logged out of your account on all devices
- can’t log in to your account, even though the username and password are correct
- have contacts tell you they received an unusual or suspicious email from you
- notice login times or locations that you don’t recognise
- receive an alert about suspicious account activity.
If you’re concerned about a business email, learn how to recover from business email compromise.
If this is happening now
You can reduce further harm by taking immediate action.
Secure your accounts
If your account is compromised, take steps to regain control of your account.
Your email and online account provider may offer specific recovery guidance. If they do, follow their instructions. If not, use the steps below in your account settings.
Each social media platform manages account recovery in a different way. You might find:
- recovery may take time while the incident is investigated
- you now have restricted access or have been removed permanently from the account
- some accounts may not be recoverable.
Even if you cannot recover your account, it’s still important to report it and secure your connected accounts.
Change your password
When changing your password, use your provider's official website or app. Avoid using links in emails or messages. Cybercriminals can use fake password reset links to steal further information.
Use a strong, unique password that isn’t used on any other account. Learn how to create strong passwords and use password managers.
Check your account recovery settings
Under security or privacy in your account settings, review your recovery:
- email addresses
- phone numbers
- other recovery methods.
Remove any recovery options you don’t recognise. Ensure your recovery details are current and correct.
Sign out of all devices
Review the devices currently signed in to your account. Sign out of any devices you don’t recognise. If available, use the option to sign out of all devices at once.
Enable multi-factor authentication
Turn on multi-factor authentication (MFA) if your provider offers it. Passkeys are one of the most secure forms of MFA, and also provide a more secure way to log in to your online accounts than using a password.
Review your authentication methods and remove any you don’t recognise. Confirm that only trusted devices and phone numbers are linked to the account.
Check email forwarding rules
Review your email settings for forwarding rules. Delete any forwarding addresses or rules you didn’t create.
Check automatic replies
Review any automatic reply or out-of-office settings. Remove any replies you did not create. Cybercriminals can use replies to spread scams or malicious content from your account.
Secure your finances
If your email account or personal information has been compromised, your money may be at risk.
With access to your email account, cybercriminals could:
- reset passwords for your connected payment accounts
- access sensitive information stored in your emails
- impersonate you to gain access to financial services or authorise transactions.
Take these steps immediately.
Contact your bank or financial institution
Ask them to check for suspicious activity on your accounts. Follow their advice to:
- secure your accounts
- replace cards
- freeze affected accounts if necessary.
It’s important to review recent transactions yourself as well. If you find anything you don’t recognise, report it immediately.
Continue to check your accounts regularly for unusual purchases or transfers.
If you’re unhappy with their response, you can get free help from the Australian Financial Complaints Authority.
Be aware of recovery scams
If you’ve lost money, be cautious of anyone offering to recover it for a fee. Scammers often target victims with false promises of recovering lost funds.
Learn more about money recovery scams.
Secure your connected accounts
If someone has accessed your email account, check other accounts linked to it. Start with your most important accounts, including:
- banking and financial services
- online shopping and payment platforms
- cloud storage services
- business and work accounts
- social media accounts
- government and health service accounts.
Check linked accounts that use:
- the compromised email address to reset or recover access
- single sign-on services, such as Google and Facebook.
For any affected accounts, review account activity and security settings. Ensure everything is correct and remove any access or logins you don’t recognise.
Use strong, unique passwords for each of your accounts. Learn more in our personal cyber security handbook.
What to do next
Take these extra steps to reduce the impacts of email account compromise.
Check for suspicious activity
After you’ve secured your accounts, continue to check for signs of account compromise. This may include:
- purchases made in your name through an online shopping account
- scam messages sent from your social media account.
Notify your contacts
It’s important to let your contacts know if someone has sent emails or messages pretending to be you. This can help stop them from falling victim to scams sent from your account.
Ensure you tell them:
- your account was compromised
- they may receive suspicious messages from you
- they shouldn’t interact with links, attachments or respond to those messages
- they should delete the message and report it.
For social media accounts, if a message has already been sent, you can:
- post a general warning on your account
- send a group message to all contacts (if available).
Secure your device
If you’re unsure how your email account was compromised, check your device for malware. Cybercriminals can use malware to steal your account details.
Learn how to recover from malware.
How to get help and report
It’s important to record what happened and report the incident to the appropriate authorities.
Try to record as much as possible, including:
- what happened
- when it happened
- how you think the compromise occurred
- what steps you took to secure your account after the incident (such as changing your password).
Report the incident details:
- to us and the relevant police jurisdiction through ReportCyber
- to ScamWatch if the compromise is a result of a scam or your account was used to scam others
- to your account provider if you haven’t already contacted them.
We understand how distressing incidents like this can be. If you want to talk to someone, call our hotline on 1300 CYBER1 (1300 292 371). We’re available 24 hours a day, 7 days a week.
Stay protected
Learn more about how to stay protected through our personal cyber security handbook.