Recover hacked email: lock it in the first hour, then report to ACSC

You opened the inbox and something felt off. A password prompt you did not expect. A sent item you did not write. That sick drop in the stomach is the right signal. Do not sit there refreshing. The first hour decides how much damage they get to do.

• Ask if you can still sign in. If yes, change the password now and turn on multi-factor authentication. Then sign every other session out.
• Ask if the sign-in is gone. Open the official Google or Microsoft recovery page yourself. Never tap a "reset your account" link that just landed.
• Ask if this device is clean. If the computer may have malware, use a phone or another machine you trust before you type a new password.
• Ask who else is at risk. Contacts, banks, and any account that uses this address for resets. Warn people. Report it.

If the mailbox still does not feel safe, Cybersecurity Scientist can take the lock-down from here. Sydney inboxes can start with cybersecurity help across Sydney. Central Coast homes and offices can use cybersecurity help on the Central Coast.

If the first click was a fake invoice or a fake login page, read phishing email examples so the next one is easier to spot.

Your first 30 to 60 minutes

Attackers move faster than the shock. They add a recovery phone. They turn on a silent forward. They send a gift-card story to your sister. The order below limits that.

1. Try a normal sign-in. If it works, change the password immediately.
2. If it fails, go straight to the provider's official recovery page. Type the address yourself.
3. Sign out every other session. Google and Microsoft both have a "sign out of all devices" control.
4. Turn on multi-factor authentication before you read another message.
5. Do this from a device you trust. Not the one that may have captured the old password.
6. Ignore any "verify your account" mail that arrives in this window. They send those too.

Pro Tip: Write the new password on paper first. Then put it in a password manager once the panic drops. Trying to invent and remember a strong phrase while you are shaking is how people reuse an old one.

This is not a weekend project. It is one hour of boring, official steps. That hour is worth more than clever workarounds.

If you can still sign in

This is the better seat. You can shut them out yourself instead of waiting on a form. The job is simple. Remove every way they got in, and every way they could walk back in.

Use a long, unique passphrase. Four random words beat a short "clever" password. Store it in a password manager, not in the browser autofill that malware can read.

• Sign out of all other sessions in the account's device or activity list.
• Open recovery phone and backup email. Delete anything you do not recognise.
• Check filters, forwarding rules, and auto-replies for a copy being sent elsewhere.
• Review connected apps and revoke anything you do not use.

They often add their own recovery details in the first few minutes. That is why a password change alone is not enough. The account looks "fixed" and they stroll back in tomorrow.

Pro Tip: Do the audit even if nothing looks wrong. A forwarding rule that silently copies mail can sit there for months.

Newcastle and Hunter inboxes that need a person on the lock-down can start from cybersecurity help in Newcastle.

If you cannot get in

Losing the sign-in feels worse. It is also where people click the second trap. A "recover your account" link in a fresh email is often the attacker again, not the fix.

1. Open the official tool yourself. For Gmail, use Google's account recovery steps. For Outlook or a Microsoft account, use Microsoft's recovery process.
2. Have proof ready: roughly when you created the account, subject lines you remember, devices you used, and any billing tied to it.
3. Answer every question as honestly as you can. Partial accuracy across a few questions beats one perfect guess.
4. Submit once. Then wait. Repeated failures can make your own request look suspicious.

The Australian Cyber Security Centre says these official workflows are the right channel. Extra checks can take a few days. That wait is the system working. It is not a sign you have failed.

Checks after you are back in

Getting in is half the job. An account that is recovered but not audited often gets hit again. Treat it like an incident, not a login glitch.

• Remove third-party apps you do not recognise or no longer use.
• If this password was reused anywhere else, change those too. One leak becomes five.
• Re-check the recovery phone and backup email. Prefer an authenticator app or a hardware key over SMS alone.
• Rotate passwords on banking, cloud storage, and anything that holds a card, because those resets go to this inbox.

Pro Tip: Set a reminder for 30 days. Some attackers wait a few weeks, then test whether their old back door still works.

If this started with a fake login page, keep phishing email examples handy. The next one will look calmer than you expect.

Use a different device if this one feels dirty

Yes. If malware grabbed the old password, typing a new one on the same machine hands it straight back.

• Use a clean phone, a work laptop, or a machine you have just reset to change the password and submit recovery.
• Run a full antivirus and anti-malware scan on the affected computer. Install pending updates before you sign into anything important on it again.
• If you suspect ransomware, or a scan that never stays clean, unplug it from the network and get help before you reconnect it.

This step feels fussy when you just want the inbox back. It is the one that stops a second lock-out tonight.

Who you should tell

Your contacts are next. A hacked address is a trusted messenger. Attackers use that trust.

• Tell colleagues, family, and suppliers. Ask them to ignore urgent gift-card, invoice, or money requests from this address.
• Check Sent, Drafts, and Bin for mail you did not write. That tells you who was targeted, so the warning can be specific.
• The ACSC treats those folder checks as a normal part of working out what happened.
• If bank details sat in old mail, watch the accounts. A credit check is reasonable if identity details went with them.

How to report a hacked email in Australia

Reporting is not paperwork for its own sake. It helps them spot a pattern, and it can get a spoofed address looked at. Do it even if the damage already feels done.

• Lodge the incident through ReportCyber and Scamwatch. Note what happened. Keep copies of the odd messages.
• If your address is being used to spoof others, send an abuse report to the provider as well.
• Contact police if there is financial loss, identity theft, or a threat. Keep the logs. Do not tidy the evidence away first.

The ACSC recovery page for a compromised email is the same family of advice as the Google and Microsoft tools. Official pages only. No "helper" sites from a search ad.

When to call for help

Some of this is a form and a checklist. Some of it is not. Malware that comes back after a scan, suspected ransomware, or a Microsoft 365 mailbox compromised at the admin level can chew a weekend and still not be clean.

Write down what you noticed, when you noticed it, and which devices were involved. That short list speeds the next step. Remote help covers a lot of inbox lock-downs in a day. Onsite help earns its keep when the computer itself is the problem.

PC Scientist can lock the inbox with you

If you would rather not sort a compromised inbox on your own, that is a fair choice. Cybersecurity Scientist covers the clean-up: sign-in, odd forwarding rules, malware on the device, and the mailbox underneath. Remote first if photos and a timeline are enough. Onsite if the computer itself is the hole.

Tell us whether you can still sign in, which provider it is, and whether a work Microsoft 365 admin account is involved. We will say what you can finish tonight, and what needs a person. Call 0493 563 381, or pick your area below.

Sources

These pages help when you want the official steps, not a random forum:

• Recover from an email account compromise - ACSC
• ReportCyber - ACSC
• Secure a hacked or compromised Google Account - Google Support
• How to recover a hacked or compromised Microsoft account - Microsoft Support
• Report a scam - Scamwatch