Your email account may have been hacked.

If your email account has been hacked, other accounts may be vulnerable too. Email accounts are often used to reset passwords or passphrases for other accounts.

Check that your money is secure

Can your email account be used to reset the password or passphrase for your bank or financial institution account? If so, your money may be at risk, if you have not already done so, contact your bank or financial institution immediately. Follow their guidance on securing your account and freezing any affected accounts or cards.

If you are not satisfied with the response from your bank, you can seek free advice from the Australian Financial Complaints Authority (AFCA). If you have lost money, do not accept offers from third parties to help you get it back – this is a common tactic used by scammers to steal more money from you.

Which accounts to secure

After you’ve confirmed that your money is secure, start to secure your other accounts. You will need to secure:

the email account that may have been hacked
any other account that uses this email address for password or passphrase resets
any account that shares the same password or passphrase as the email account that may have been hacked.

When securing multiple accounts, start with the most important ones first. For most people, important accounts include bank or financial institution accounts, email accounts, business accounts, cloud storage accounts and accounts that can be used to access other important services. Accounts that don’t hold sensitive information should be secured last.

Check for advice from your email provider

Some email providers have resources to help you secure your account. We’ve listed resources for some popular email providers below. If your email provider is listed, follow the advice on their website. If your email provider is not listed, you can check their website for advice or keep reading to see our recommended steps to secure your account.

Secure your email account

Change your password or passphrase. It is best practise to change your password or passphrase by logging into your account’s online platform or app directly. Avoid clicking on password or passphrase reset links you receive by email or messages because fake reset links are commonly sent by cybercriminals. The ACSC has published guidance on using password managers and guidance on creating passphrases. If you cannot access your account to change your password or passphrase, check if the email provider has an account recovery option. Note, in some cases, email providers may take a number of days to conduct additional checks before facilitating access to your account.
Go to your account settings and check that your account recovery details are accurate and up to date. Remove any account recovery options you don’t recognise.
You may be able to manage what devices are logged into the account. If your account has this option, log out of all devices. You can usually find this option on your account security settings page. Changing your password or passphrase should also automatically log out all other devices currently logged into your account.
If your account supports multi-factor authentication, turn it on. Multi-factor authentication will make it harder for cybercriminals to get access to your account again. The ACSC has published guidance on enabling multi-factor authentication. Remove any multi-factor authentication methods you don’t recognise.

Check for unauthorised activity on your email account

It’s important to check your account activity to determine if the person who accessed your account has done anything that requires a response from you.

Check your email forwarding rules in your account settings. If you see any new rules to forward your emails to another address, remove them.
Check your email folders to see if emails have been sent, opened or deleted without your knowledge. Pay particular attention to your sent emails folder and deleted emails folder.

Be aware that the person that accessed your account may have hidden their activity, for example, by permanently deleting emails or marking emails they opened as ‘unread’.

The ACSC has published advice on protecting your email accounts and phone numbers including guides on improving the security of your email accounts and advice on protecting against business email compromise.

Australian Cyber Security Hotline

Australian Cyber
Security Hotline