Short answer
Email is the master key to everything else, so it comes first. Secure the account from a device you trust, check the hidden settings scammers change, then work out whether the computer was involved at all.
Signs your email account has been taken over
- People tell you they got a strange message from you — often a link, or a story about needing money or gift cards.
- Sent items contain messages you didn't write, or your sent folder is suspiciously empty.
- Password reset emails arrive for accounts you didn't try to reset.
- Your password stops working.
- Expected emails stop arriving, or messages vanish after you read the first line.
- A sign-in alert from a place or device you don't recognise.
What to do, in this order
- 1
Use a device you trust
If the computer has been behaving strangely, do this from your phone or another computer.
- 2
Change the email password
Pick something long and not used anywhere else. Length matters more than symbols.
- 3
Turn on two-step verification
This is the change that actually keeps them out, even if they still have the old password.
- 4
Sign out all other devices
Every major email provider has this option in security settings. It kicks out any session they still have open.
- 5
Check forwarding and rules
This is the step people miss. Scammers add a rule that forwards your mail to them, or that files bank emails straight into the bin so you don't see alerts. Delete anything you didn't create.
- 6
Check the recovery details
Recovery phone number, recovery email and security questions. If any were changed to something you don't recognise, put them back.
- 7
Warn the people in your contacts
A short note saying "if you got a strange message from me, delete it" saves someone else a bad week.
Was the computer involved?
Not always. Most email takeovers come from a password reused on another website that was breached, or from a convincing fake sign-in page. But if any of these apply, the computer should be checked too:
- You'd had popups, a support call, or gave someone remote access recently.
- The machine has been slow, strange or showing warnings.
- Your browser had all your passwords saved and you can't rule out that someone had access to it.
- Other accounts were taken over at the same time.
What not to do
- Don't reply to the scammer or the messages sent from your account.
- Don't click links in "your account has been suspended" emails — go to the provider's website directly instead.
- Don't reuse the new password anywhere else.
- Don't call a phone number that appeared in a popup or an email claiming to be support.
Stopping it happening again
- Two-step verification on email, banking and anything holding a card number.
- A different password for email than for anything else — if you keep only one unique password, make it that one.
- A password manager, or a written list kept somewhere safe at home. Written down at home is safer than reused everywhere.
- Check forwarding rules every few months. It takes a minute.
If setting that up sounds like more than you want to take on alone, it's the kind of thing we sit down and do with people regularly. You don't have to work it out by yourself.
If you'd rather have help
Bring the computer, and the email address in question, to our counter in Bellevue. We'll go through the account settings with you, check the machine if it needs checking, and get the security set up properly. Serving Bellevue and the Omaha area — call 402-953-0001 if you want to talk it through first.
Common questions
- How did they get my email password?
- Most often it was reused on another website that suffered a data breach, or typed into a fake sign-in page that looked genuine. It doesn't usually mean your computer was infected.
- My contacts got a strange email but my account looks normal. Was I hacked?
- Probably not. Scammers can put your name on a message sent from their own account. Check your sent items and recent sign-ins — if those are clean, the account is likely fine.
- Do I need to make a new email address?
- Rarely. Securing the existing account is usually enough, and changing addresses causes a lot of disruption. We'd only suggest it if the account can't be recovered.
- Should I check my computer too?
- Yes if there were popups, a support call, remote access, or other odd behaviour. Otherwise the account is the more likely route.
- What is a forwarding rule and why does it matter?
- It's a setting that automatically sends copies of your mail elsewhere or hides certain messages. Scammers add them so they keep seeing your email after you change the password. Always check for them.
The service that covers this
Virus, Spyware & Adware Removal
Browser popups, fake warnings, malware and hacked computers cleaned out properly — registry, temp files, browsers and hidden leftovers.
Virus, Spyware & Adware Removal in Bellevue →Optional next step
After we clean it up, keep it protected.
Ask us about Home-IT for ongoing protection, monitoring and remote support — an optional extra layer of help when something looks wrong.
Learn About Home-IT →Related guides
- I Think My Computer Was Hacked: What To Do FirstStrange behaviour, popups, a cursor moving on its own or a support call you now regret. Here's how to tell what you're dealing with, what to do first, and what not to do.
- What To Do If Someone Remotely Accessed Your ComputerWhether it was a scam caller, a stranger or an ex-partner, remote access needs the same response: cut the connection, secure accounts, and check what was left behind.
- What To Do After a Fake Microsoft Support ScamYou called the number or let someone connect. Here is the order to do things in: cut access, secure accounts from a clean device, contact your bank, then have the computer checked.
- Browser Keeps Redirecting to Strange WebsitesUnexpected redirects, a search engine you didn't choose, new tabs opening on their own and constant popups usually come from an extension, adware or changed browser settings.