Email account hacked: what to do now

Step by step

1. Go directly to your provider's site (type it yourself; don't use links in emails) and change your password to a new, unique one.
2. If you're locked out, use the provider's official account recovery page.
3. Turn on two-step verification (an authenticator app or passkey is best).
4. Sign out of all other sessions (Gmail: Security › Your devices. Microsoft: account.microsoft.com › Security).
5. Check settings for rules, forwarding addresses, and changed recovery phone/email. Remove anything you didn't add.
6. Change passwords on other sites where you used the same password, starting with banking.
7. Warn contacts not to open recent links from you.
8. Scan your computer for malware.