Recovering from an email account compromise means moving on three fronts at once: preserve what the attacker did, lock them out of the account, and protect the financial accounts your inbox unlocks. The order matters, and some of the deadlines are measured in days.
Document What Happened Before You Change Anything
The first instinct is to change the password immediately. Resist it for a few minutes. Once you clean up, some of the evidence you need for a police report, an IC3 complaint, or a bank dispute becomes harder or impossible to recover.
Take screenshots of anything unfamiliar: sent messages you didn’t write, forwarding rules you didn’t create, connected apps you don’t recognize, and the login activity log showing IP addresses and timestamps. If a phishing message led to the compromise, save it with full headers (look for “show original” or “message source” in your provider’s menu) rather than forwarding it, since forwarding strips the metadata investigators use.
Keep a short written log noting dates, times, and what each screenshot shows. A documented submission reads very differently to law enforcement than a vague complaint, and the same record supports every dispute letter you may need to send later.
Take the Account Back
Go to your email provider’s account recovery page. You’ll typically verify your identity through a backup email or phone number linked when you created the account. If the attacker changed those recovery methods, major providers offer secondary verification based on the account creation date, recent contacts, or other details only the real owner would know.
Changing the password is not enough. Attackers almost always leave behind a way back in, and three places need to be checked the moment you regain access:
- Forwarding rules and filters. Attackers set up automatic forwarding so a copy of every incoming message goes to an address they control, often under a blank or generic name. Delete anything you didn’t create.
- Active sessions and devices. Open the “recent activity” or “logged-in devices” view and sign out of every session except the one you’re using. This kills any session the attacker is holding open through a stolen cookie.
- Connected third-party apps. Review every application with permission to access your inbox and revoke anything you don’t recognize. An authorized app acts as a persistent backdoor even after the password changes.
Report the Crime to the Right Agencies
FBI Internet Crime Complaint Center
The IC3 is the FBI’s intake point for cybercrime complaints. Filing there enters your case into a database agents use to connect related incidents and track criminal networks.1Internet Crime Complaint Center. About – Internet Crime Complaint Center Include the email headers you preserved, suspicious URLs, the approximate date you lost access, and a description of any financial losses. Specifics are what make a report useful.2FBI. File Cyber Scam Complaints With the IC3
FTC Identity Theft Report
If the attacker used your inbox to reach financial accounts or steal your identity, file at IdentityTheft.gov. The FTC’s portal builds a personalized recovery plan, pre-fills dispute letters, and generates a formal Identity Theft Report that carries legal weight with banks and credit bureaus.3Federal Trade Commission. IdentityTheft.gov The IC3 complaint feeds criminal investigations; the FTC report gives you the paperwork to clean up the financial damage.4Federal Trade Commission. Report Identity Theft
Local Police Report
A local report can feel pointless for a crime that likely crossed borders, but certain institutions require one. Under the Fair Credit Reporting Act, businesses that extended credit or services to the person who stole your identity can require a police report, a completed affidavit, and proof of your identity before releasing transaction records tied to the fraud. They must then provide those records free of charge within 30 days of your written request.5Federal Trade Commission. Businesses Must Provide Victims and Law Enforcement With Transaction Records Relating to Identity Theft Some insurers and banks also want a police report before processing a fraud claim. Bring your screenshots, login logs, and any fraudulent transaction records when you file. The report number is what you’ll need to produce later.
Protect the Money
Call Your Bank the Same Day
Federal rules on electronic fund transfers run on a short clock. Notify your bank within two business days of learning about an unauthorized transfer and your liability is capped at $50. Wait longer and the cap rises to $500. If an unauthorized transfer shows up on a periodic statement and you don’t report it within 60 days, you can be liable for the full amount of any further transfers after that window closes.6Consumer Financial Protection Bureau. 12 CFR 1005.6 – Liability of Consumer for Unauthorized Transfers
Filing an IC3 report does not pause these deadlines. Call every bank and brokerage linked to the compromised email the day you discover the breach.
Credit Freezes
A credit freeze blocks lenders from pulling your credit report, which stops new accounts from being opened in your name. Contact each of the three major bureaus separately: Equifax, Experian, and TransUnion. Freezes are free by federal law. A bureau must place a freeze within one business day of an online or phone request, and must lift it within one hour of an electronic request when you need to apply for credit yourself.7Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report?
Fraud Alerts
A fraud alert is lighter: it tells lenders to verify your identity before extending credit. An initial alert lasts one year, and you only need to contact one bureau because it must notify the other two. With an FTC Identity Theft Report in hand, you can place an extended fraud alert that lasts seven years, and you become entitled to additional free credit reports beyond the standard annual disclosure.
IRS Identity Protection PIN
If your Social Security number may have been exposed through old tax documents in your inbox, enroll in the IRS Identity Protection PIN program. The PIN prevents anyone from filing a federal return under your SSN without it. Anyone with an SSN or ITIN can enroll; the fastest route is through an online IRS account. If you can’t verify online, you can submit Form 15227 by mail (available to individuals with adjusted gross income below $84,000, or $168,000 for married filing jointly) or visit a Taxpayer Assistance Center. A new PIN is issued each year and must appear on every federal return you file.8Internal Revenue Service. Get an Identity Protection PIN (IP PIN)
Social Security Administration
If you believe someone is using your SSN for employment, report it to the SSA, which will review your earnings record and correct discrepancies. In severe cases where problems persist, the SSA may assign a new number, though you’ll need to demonstrate ongoing harm and provide identity documentation.9Social Security Administration. Identity Theft and Your Social Security Number
Harden the Account Before the Next Attempt
Getting back in without upgrading your security sets up the next compromise. Two changes do most of the work.
Move off SMS-based two-factor codes. Text message codes are better than nothing, but they fall to SIM swapping, where an attacker uses personal details to convince your mobile carrier to transfer your number to a SIM they control. Hardware security keys and built-in device authenticators using the FIDO standard are the strongest widely available option, and NIST identifies FIDO authenticators as the most effective phishing-resistant method. Most major email providers now support them.10National Institute of Standards and Technology. Multi-Factor Authentication
Use a password manager. Current NIST guidance recommends passwords of at least 15 characters for accounts that rely on a password alone, and advises against the old complexity rules requiring special characters and mixed case. Long passwords you don’t have to memorize are both stronger and easier to live with. The one rule that matters most is never reusing a password across services, because reuse is what makes automated credential-stuffing attacks work.11National Institute of Standards and Technology. NIST Special Publication 800-63B – Digital Identity Guidelines
If the Compromised Account Belongs to a Business
Personal recovery is one thing; a business inbox that held customer data triggers notification obligations. Covered entities handling health information must notify affected individuals within 60 days of discovering a breach under the HIPAA Breach Notification Rule.12U.S. Department of Health & Human Services. Breach Notification Rule All 50 states also have their own breach notification laws. About 20 set specific numeric deadlines between 30 and 60 days; the rest use qualitative standards like “without unreasonable delay.” Missing a deadline can create regulatory penalties on top of the breach. If customer records were exposed, consult a data privacy attorney before notifications go out, because the triggers for what data counts, how many records require reporting, and which state attorney general must be told vary enough that getting it wrong turns one legal problem into two.