Short answer
Act quickly, but from a trusted device: change your password, sign out all sessions, check recovery details and forwarding, then secure the accounts linked to this email address. Your email account is often the master key to many other services.
Step by step
- 01
Use a trusted device
If you suspect your device itself is affected, use a different, up-to-date device for the following steps.
- 02
Change your password or recover the account
If you can still sign in, set a new, unique password immediately. If you have been locked out, use the provider's official recovery process – not links from emails or search ads.
- 03
End all sessions
In the security settings, sign out all other devices and sessions and remove unknown connected apps.
- 04
Review your settings
Check forwarding rules, filters, auto-replies, stored phone numbers and backup email addresses. Attackers like to change these so they can come back.
- 05
Turn on MFA
Set up two-factor sign-in or a passkey so that a stolen password alone is no longer enough.
- 06
Secure linked accounts
Change passwords for services that use the same address or the same password – starting with your bank, payment services, online shops and social networks.
- 07
Inform your contacts
Warn your contacts if suspicious messages were sent from your account.
Checklist
- New, unique password set
- All unknown sessions and apps removed
- Forwarding rules and filters checked
- Recovery phone number and address verified
- MFA or passkey turned on
- Important linked accounts secured
- Screenshots of suspicious activity saved
Common mistakes
- Only changing the password and overlooking forwarding rules.
- Starting recovery via a search ad or a link in an email.
- Using the same new password for other services too.
- Deleting suspicious messages before keeping evidence.
Frequently asked questions
How can I tell my account has been taken over?
Typical signs are unknown sign-ins, sent messages you didn't write, changed settings or password reset emails from other services.
Do I need to report it to the police?
For fraud, extortion or financial loss, reporting it to the police makes sense. Many German federal states offer online police stations for this.
What if I can't get in at all?
Only use the provider's official recovery process. Have previous passwords, devices and the approximate date the account was created ready.
Does cyber insurance help in this case?
Depending on the plan, assistance or costs for identity misuse may be covered. However, taking out a new policy does not cover an incident that has already happened.
Sources
Checked on 6 Oct 2026.