What to Do When Your Email Account Is Hacked in Australia | Quick Actionable Ideas and Survival Tips

AUSTRALIA — If somebody has taken control of your email account, act quickly from a trusted device. Check whether bank or payment information is exposed and contact your financial institution immediately if money is at risk. Use the email provider’s official account recovery process, change the password to a new unique one, sign out unfamiliar sessions, remove unauthorised recovery details and forwarding rules, and turn on multi-factor authentication. Warn your contacts not to trust unexpected messages from your address. Report the incident through ReportCyber when appropriate.

Australia’s Australian Signals Directorate (ASD) and Australian Cyber Security Centre (ACSC) advise that an email account compromise can lead to more than stolen messages. Someone controlling your inbox may reset passwords for banking, shopping, social media, government and workplace accounts. The response should therefore protect finances and other connected accounts, not merely reset the original email password.

12 immediate actions — hacked email recovery checklist

Stop and use a trusted device. Do not enter new passwords into a computer or phone you suspect contains malware or remote-access software.
Protect your money first if financial details may be exposed. Contact banks or payment providers using their verified telephone numbers or apps; ask them to check transactions and secure accounts.
Go directly to the email provider’s official website or app. Do not use an unexpected “account recovery” link sent by email, text or social media.
Recover access and change the password. Choose a strong unique passphrase not reused on any other service; follow the provider’s recovery steps if locked out.
Sign out unfamiliar devices and sessions. Review recent login history, trusted devices, session tokens and any new third-party access according to provider settings.
Check account recovery options. Remove unauthorised backup email addresses, phone numbers, passkeys or other recovery mechanisms.
Inspect forwarding, filters and mailbox rules. Attackers may redirect messages, hide security alerts or delete messages from banks or services.
Enable multi-factor authentication. Prefer an appropriate secure method supported by the provider and protect backup or recovery codes separately.
Secure connected accounts. Reset passwords and sessions for banking, shopping, social, cloud, work and government services that use the compromised inbox.
Warn your contacts using a trusted channel. Ask them to ignore suspicious links, attachments, payment changes or requests for verification codes supposedly from you.
Record and report the incident. Use Australia’s ReportCyber service for cybercrime and Scamwatch when a scam was involved; contact the account provider too.
Monitor for further misuse and avoid recovery scams. Check finances, logins and messages; never pay a stranger who promises to return your email account.

If your account is still being used to steal money or impersonate you, focus on securing accounts and contacting your bank before reading the longer explanations. The rest of this guide is for protecting additional services and preventing a second compromise.

Why a hacked email account is more serious than lost messages

Email often functions as the recovery channel for other online accounts. A person who enters your inbox may see password reset links, login codes, bank alerts, invoices, identity documents, private photographs and business correspondence. Even if they only read messages at first, that information can be used to impersonate you or target people who know you.

The ACSC’s account compromise guidance explains that attackers can use email to reset passwords, impersonate the account holder and reach connected services. A criminal may contact friends asking for money, send malicious attachments to colleagues or use a genuine invoice thread to substitute fraudulent payment details.

An email account can also be compromised without a dramatic lockout. Somebody may have copied the password from a breach, created a hidden forwarding rule and remained logged in while the owner continues using the mailbox. The fact that you can still read messages does not prove the account is secure.

Recognising this broader risk changes the order of action. Rather than changing a password and declaring success, check existing sessions, recovery settings, mail rules and the services that rely on the email address. If financial or sensitive work information is involved, alert the appropriate institutions promptly.

Do not assume that every unusual email automatically proves hacking. Sometimes a sender address is spoofed, a fake message is designed to look as if it came from your account, or a provider sends a legitimate warning. Check actual login activity and account settings through the official site rather than relying on the message alone.

Warning signs that an account may have been compromised

The ACSC lists several possible signs: you cannot log in with the expected password, unfamiliar sessions or locations appear, people report messages that you did not send, the provider warns about unusual activity, or recovery settings have changed without your permission.

Other clues include password reset messages for services you did not use, unfamiliar mailbox rules, deleted bank notifications, outgoing messages in the sent folder, changed profile information or alerts that a new device has been registered.

These clues are not conclusive by themselves. A login from a different region may reflect travel or the provider’s location system. A spam message can forge your address without giving the spammer actual access to the mailbox. Look for a combination of evidence and follow the provider’s security review.

If you receive a message saying the account is hacked and demanding payment, do not pay simply because the sender includes an old password. A password may have come from a historical breach rather than current access. Verify the account through the provider’s legitimate settings and change exposed credentials.

If the provider confirms suspicious sign-in or altered recovery information, take the matter seriously even if no money appears to be missing. The attacker may be preparing another step.

First protect banking, payments and your phone number

The ACSC advises people whose financial details may be exposed to contact their bank or payment provider immediately. Explain that an email account was compromised and that reset messages, account statements or other sensitive information might have been visible. Ask about suspicious transactions, account protection and any required card replacement.

Use a bank number you obtain independently from its official website or application, or from the back of a genuine card. Do not call a number supplied in an unexpected message claiming to be from a bank security team.

If an online payment account is linked to a card or bank account, notify both the payment provider and the linked financial institution when there is evidence of compromise. The ACSC’s bank-account recovery guidance explicitly describes these as potentially separate actions.

Review bank transactions, registered devices, new payees, altered contact details and login alerts. A person who can access your inbox may have intercepted verification or account-recovery messages. A password reset alone may not reverse an unauthorised bank transfer.

If your phone suddenly loses cellular service or shows an unexpected number change, contact the mobile carrier urgently. Scamwatch identifies this as a potential sign of account or identity takeover. A criminal who controls a SIM or number may intercept text-based verification codes for other accounts.

Do not move money into a so-called safe account because somebody claiming to represent a bank or police officer tells you to. Verify instructions through a known channel and report any suspicious transaction immediately.

Recovering access through the official email provider

The recovery process differs between Gmail, Outlook, iCloud Mail, Yahoo Mail and other providers. Start at the company’s verified official website or app and follow its compromised-account help. Avoid clicking a link provided by a stranger who promises priority support for a fee.

If you still have access, change the password to a new and unique one. Prefer a long passphrase or a securely generated password stored in a reputable password manager. Do not reuse the same password for banking or another email account.

If the attacker has changed the password, use the provider’s official recovery workflow. You may need trusted device confirmation, a recovery email, an authenticator or a formal identity-verification process. Some accounts may not be recoverable if all legitimate recovery options were replaced or the provider cannot confirm ownership.

The ACSC cautions that recovery may take time and that some social or online accounts cannot be restored. Continue protecting other services even if the original mailbox remains inaccessible. Telling your contacts that the address is compromised can reduce further harm.

Never send your password, authenticator code, backup code or full identity documents to somebody claiming to be a private account-recovery agent. Legitimate providers have their own official procedures and do not require a random social media intermediary.

Why signing out other devices matters

Changing the password may not automatically end every active session. Some services keep browsers or applications logged in until a session is revoked or the provider’s security system requires reauthentication. A criminal could therefore still have access through a previously authorised device or token.

Review the account provider’s security dashboard for recent sessions and recognised devices. Sign out devices you do not control and revoke suspicious third-party application permissions, as the ACSC recommends. The exact location of these settings differs by provider.

Be cautious if you see unfamiliar access through a location you do not recognise. Confirm the provider’s explanation and review dates and device names. Do not assume a location alone proves who is responsible.

If the account uses passkeys, application passwords or connected email clients, review them as well. An attacker may have added another method of access that is not removed by changing the ordinary password. Follow the provider’s security checklist to close persistent access paths.

Take screenshots of suspicious sessions before removing them when feasible and safe, especially if a formal report or workplace investigation may require a timeline. Do not delay blocking ongoing access merely to build a perfect evidence archive.

Mail forwarding and inbox rules: the hidden persistence problem

An attacker may create an automatic forwarding rule that sends incoming messages to a separate address. They may also create filters that archive or delete security warnings, hide messages from a bank or redirect particular senders into a folder you rarely check.

These settings can allow continued information exposure even after you change the password. Review forwarding destinations, mail filters, blocked or trusted senders, delegated mailbox access and third-party integrations. Remove anything you did not deliberately create, subject to appropriate evidence preservation when needed.

For a business account, the IT administrator may need to examine server-side forwarding rules and mailbox permissions, not merely the user’s visible settings. Contact the employer or managed service provider rather than attempting unauthorised changes to a work system.

If a suspicious rule forwarded messages for weeks, assume sensitive information may have been exposed during that period. Consider which clients, banks or other institutions may need notification. The exact legal obligations depend on the account and organisation.

Do not accuse a particular person based only on the name of a forwarding address. It could be false or under another person’s control. Report the technical evidence and let the relevant provider or investigators assess it.

Your recovery email and backup phone number

Account recovery mechanisms are often the next target after a password. A criminal may add their own phone number, change the recovery email or generate new backup codes so they can regain access later.

Check the account’s recovery options carefully. Remove entries you did not authorise, and confirm that the legitimate phone and recovery email are correct. If the recovery email was also compromised, secure it as a separate account using a trusted device.

Replace previously exposed backup codes or recovery keys where the provider offers that option. Store new codes in a secure place separate from the compromised device or inbox. Do not photograph them and upload them into an unsecured public album.

Enable multi-factor authentication using a suitable method, such as a passkey, authenticator app or security key where supported and appropriate. SMS may still be useful in some circumstances, but a compromised phone number can weaken it.

A trusted family member helping with recovery should use official delegated or recovery options rather than taking permanent possession of the account owner’s passwords. The aim is to restore control to the legitimate user.

The social-media and messaging accounts connected to email

A compromised email can be used to reset access to social media, shopping sites, travel accounts and messaging services. Review which services use the same address for password recovery and prioritise those containing sensitive information or payment methods.

For each affected service, change the password, review active sessions and check whether recovery options or authorised devices were altered. Look for messages you did not send, advertisements you did not place, purchases you did not make or a new profile photograph designed to impersonate you.

The Australian eSafety Commissioner provides guidance on reporting impersonation, online abuse and intimate-image misuse. If somebody has posted harmful material from a hacked account, preserve relevant evidence and use the provider’s report function. Some serious harmful content may be reported to eSafety through its statutory schemes.

Do not use an unknown “de-hacking tool” advertised as a browser extension or social-media bot. It may steal credentials or install malware. Use the platform’s official recovery process and ACSC recommendations.

If friends receive requests for money or codes from your account, ask them to verify through another channel before acting. Your warning should avoid forwarding the attacker’s links or attachments.

How to warn contacts without spreading the scam

Tell family, friends or clients that the account was compromised and that suspicious recent messages should not be trusted. Use a verified alternative account, telephone number or workplace communication channel rather than the compromised mailbox while control remains uncertain.

A simple message might say that the email account was accessed without permission, nobody should open unexpected attachments or transfer money based on recent requests from it, and people should contact you through another known route. Keep it factual rather than speculating about who hacked you.

If your account was used to send a fraudulent invoice, contact the recipient directly and explain the legitimate payment details through a verified channel. Do not simply email another bank account number from a newly created address without independent verification; that may look exactly like the attacker’s method.

For a business or volunteer organisation, tell the responsible administrator about the incident and ask whether additional customer or regulatory notifications are necessary. Do not promise that no personal data was accessed before a competent investigation supports the claim.

Warn contacts about follow-up scams. An attacker may impersonate an investigator or “account recovery team” and ask for another payment or new authentication code after the first compromise.

What to do if the hacked account belongs to your employer

A company email account may contain customer records, contracts, invoices, internal files or authentication links to cloud systems. Report the issue immediately to the organisation’s IT security or incident-response contact, even if you have already changed your password.

Do not delete evidence or independently wipe a company device unless the authorised IT team directs it. The organisation may need logs to investigate unauthorised access and determine whether personal data was involved.

The ACSC’s business guidance distinguishes personal cybercrime reports from cyber security incident reporting by organisations. A workplace may have sector-specific duties, reporting requirements or insurance obligations that the individual staff member should not attempt to satisfy alone.

Avoid transferring company documents into a personal email account for convenience while recovering. That can create another data protection problem and may bypass the controls needed to investigate the incident.

If a work email was used to request a change in supplier bank details, verify all pending transactions with finance personnel through known telephone numbers. A criminal may have read previous invoice threads and crafted a convincing message using genuine details.

What to do if the email account belongs to a teenager or child

Children may use email for school, games, social networking and login recovery. A compromised account can lead to unwanted messages, impersonation or exposure of personal information. Parents or guardians should help the child follow the official provider’s recovery process while respecting age-appropriate privacy and the child’s safety.

Check whether the account has been used to contact classmates or request verification codes. Alert a school safeguarding contact if school accounts, student records or other children may be involved. Avoid publicly identifying the child or sharing private messages broadly.

The eSafety Commissioner has youth-focused material on protecting accounts and responding to impersonation or image abuse. A young person may need help preserving evidence and reporting harmful content through the platform and eSafety.

If somebody threatens a child or publishes intimate images, do not attempt to negotiate with the offender or forward the images to others. Seek the appropriate eSafety and police assistance, and call 000 if anyone is in immediate physical danger.

An account takeover should not automatically become a punishment discussion. The immediate priorities are securing access, preventing harm to others and finding out whether the child needs support.

What if documents, ID or tax information were stolen?

An inbox may contain scanned passports, drivers’ licences, tax file numbers, myGov messages or other identity documents. If these were accessible to an attacker, consider additional identity-protection steps.

IDCARE provides free identity and cyber support in Australia and can help individuals build a recovery plan. Its published contact is 1800 595 160, generally during its advertised business hours rather than a 24-hour emergency telephone service.

For tax-related identity concerns, contact the Australian Taxation Office through its verified website or contact numbers. Do not use links in suspicious emails claiming to be from the ATO. A compromised myGov account requires its own Services Australia support pathway, separate from ordinary email recovery.

Scamwatch’s account-takeover guidance identifies the Services Australia Scams and Identity Theft Helpdesk at 1800 941 126 for a compromised myGov account, with published weekday service hours. Verify current hours and reporting instructions before calling.

If a criminal has used identity information to apply for credit, contact the relevant financial institutions and seek appropriate guidance about credit-report monitoring or a credit ban. Australia’s processes are not identical to US credit freezes, so do not follow a US checklist automatically.

Reporting a hacked account in Australia

Australia’s official ReportCyber service is available through the ACSC’s Submit a Report page. Select the cybercrime option when somebody accessed your accounts without consent, stole personal information, committed online fraud or used your account to impersonate you.

The report helps direct information to the relevant police jurisdiction. A report is not a guarantee that police will recover the account or trace every offender, but it creates a formal record and supports investigation. Record when the incident occurred, the platform, suspected access method and actions already taken.

If a scam was involved—such as a fake login page or someone using the hacked account to ask contacts for money—make a separate report to Scamwatch. Scamwatch specifically says its reporting form is not an official police report.

Contact the affected account provider as well, since it controls access, login history and removal of impersonation content. A police report cannot reset a password on the provider’s behalf.

The Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371) and operates 24/7, according to the ACSC’s current guidance. It provides support for cyber security concerns. For an immediate threat to physical safety, call Triple Zero 000, not the cyber hotline.

How to preserve evidence without prolonging the compromise

Make a brief timeline: first suspicious login, unexpected reset messages, accounts affected, transactions, contacts who received scams, and when each protective action was taken. Save the provider’s security alert and a copy of any malicious messages where safe.

Do not keep an attacker logged in simply to gather additional evidence. If financial or personal harm is ongoing, secure the account first. A technically skilled respondent or police investigator can advise on preserving records after containment.

Avoid downloading suspicious attachments to a second computer. A message or file involved in the attack may contain malware. Use screenshots or the provider’s safe reporting facility when appropriate, without opening the material unnecessarily.

If an attacker has intimate photographs or highly sensitive identity documents, restrict who receives the evidence. Do not forward them into a public social-media group or unencrypted mailing list merely to prove the incident occurred.

Keep bank case references, ReportCyber report numbers, Scamwatch report details and any IDCARE correspondence together. This makes the recovery process easier when several services need to be contacted.

When the device itself may be infected

An email password can be stolen through a fake website, a data breach or malware running on a device. If you suspect malicious software or remote-access tools, isolate the affected device from the internet when safe and seek appropriate removal guidance before entering new credentials on it.

The ACSC advises disconnecting compromised devices, scanning for viruses and following safe recovery procedures. A malicious program may capture a password again after it is changed if it remains installed.

A person who granted screen-sharing or remote-access permissions to a scam caller should treat that as an additional risk. Disconnect, contact the bank, and ask for professional device assessment as needed. Do not assume that uninstalling one visible app removes every form of access.

If the affected device is a company laptop, involve authorised IT staff rather than independently reinstalling the operating system and destroying potential evidence. If it is a personal device, use the device vendor’s official guidance and keep backups that can be checked for safety.

After the system is appropriately restored, install security updates, remove unknown software and confirm that important credentials were changed from a trusted environment.

What if your phone number is also taken over?

An unexpected loss of mobile service, new SIM notification or contact from the carrier about a number transfer can indicate a separate account-takeover attempt. Scamwatch lists these as potential warning signs. A criminal controlling a phone number may try to intercept SMS authentication codes.

Contact the telecommunications provider through a verified number, report the unauthorised change and ask for urgent account protection. Then review services where the phone number is used for account recovery or payment authorisation.

Do not give SIM activation codes, account PINs or two-factor verification codes to somebody who calls claiming to be carrier support. The caller’s display name is not proof of their identity.

A compromised phone number can complicate recovery of email and bank accounts, so tell each affected provider about the issue. Use alternative verification methods where supported.

If you cannot receive emergency verification codes, the provider’s formal identity recovery procedure may take additional time. Continue securing the accounts you can control rather than using an unofficial shortcut offered for a fee.

A hacked online store or shopping account

An email takeover can lead to an attacker changing passwords on online shopping accounts and using stored payment information. Check order histories, saved cards, shipping addresses, gift-card balances and any newly created accounts.

Contact the shopping provider through its official channel and ask it to disable fraudulent orders, revoke sessions or close the compromised account. Contact the bank as well if a card was charged or financial details were exposed.

A returned or cancelled order does not guarantee the attacker no longer has the email account. Make sure the central inbox and other connected services are secured.

Do not share card numbers with a stranger claiming to be a “refund processor” in a direct message. Use the provider’s usual secure refund method.

If an attacker has changed the delivery address to another location, give that information to the platform and ReportCyber as appropriate. Do not visit the address to confront whoever may be there.

A business email compromise involving invoices

A fraudster who can read a genuine email thread may replace a supplier’s banking details or send a client a fake invoice using familiar wording. The victim may believe the message is legitimate because it appears in an existing conversation.

If you or a contact made a payment based on a suspicious instruction, contact the bank urgently and explain what happened. The time available to stop or recall a transfer can be limited and recovery is not guaranteed.

Tell the affected supplier or customer using a telephone number you already know, not a number within the suspicious message. Ask them to verify all recent account changes and avoid making further payments until the correct details have been confirmed.

Preserve original emails and relevant headers for professional review. Do not delete an entire correspondence thread solely because one message is suspicious.

A company may need to assess whether client data or other personal information was exposed, and whether any separate contractual or privacy obligations arise. Professional incident responders and legal advisers can help with such decisions.

Common scenarios and the best response

Open the provider’s official website independently, review security activity and change the password from a trusted device. Revoke suspicious sessions, check recovery details and enable stronger authentication. Do not click an unverified link within the alert itself.

Your friends say you emailed them a request for urgent money

Treat it as possible impersonation or compromise. Secure the inbox, check the sent folder and mail rules, warn contacts through another trusted channel, and report the account if unauthorised access is confirmed.

You cannot log in because the recovery telephone number changed

Use the provider’s official account recovery procedure; do not pay a private service promising immediate return. Secure your bank and other connected accounts while attempting recovery, and report the incident appropriately.

You notice bank payments after your email was hacked

Contact your bank immediately through a verified channel. Secure relevant accounts and report the cybercrime through ReportCyber. A Scamwatch report may also be appropriate if deception was involved. Do not wait for the email provider to finish investigating before protecting money.

The attacker has created a hidden forwarding rule

Remove the unauthorised rule from the recovered account, revoke suspicious sessions, review what information may have been exposed and consider whether connected accounts or affected contacts need notification.

Common mistakes that make account hacking worse

Do not follow an unknown password-reset link instead of navigating directly to the official provider.
Do not change passwords on a device you believe has active malware before taking appropriate precautions.
Do not reuse the old password or one used at another service.
Do not assume password change alone ends every active session.
Do not forget forwarding and filtering rules.
Do not give verification codes to anyone claiming to be technical support.
Do not delay contacting the bank when money may be at risk.
Do not assume a Scamwatch report is an official police report.
Do not pay account recovery or stolen-money recovery scammers.
Do not ignore government, work and social accounts connected to the compromised inbox.
Do not expose private documents publicly while trying to prove that hacking occurred.

A 30-day recovery and prevention plan

Confirm that your email account has a unique strong password and suitable multi-factor authentication.
Review all signed-in devices, recovery settings, forwarding rules and third-party access.
Change passwords at other services that shared the original password.
Check banking and payment accounts, registered devices and transaction alerts.
Contact the mobile carrier if a SIM or number-transfer issue occurred.
Monitor social media, shopping, cloud storage, employer and government accounts for unauthorised changes.
Warn affected contacts through a verified alternative communication route.
Make ReportCyber and Scamwatch reports when applicable, preserving reference numbers.
Seek free IDCARE advice if identity information may be misused.
Remove malware or unauthorised remote-access software through appropriate professional or official steps.
Keep system and security updates current, and review backups for important data.
Use separate recovery channels and securely stored backup codes.
Verify payment instructions through known contact methods, especially changes to supplier bank details.
Review whether a child, family member or colleague needs additional safeguarding support.
Keep a factual incident timeline and review settings periodically after recovery.

Frequently asked questions

What should I do first if my email is hacked in Australia?

Protect money if at risk, then use a trusted device to secure the account through the provider’s official site. Change the password, revoke suspicious sessions, check recovery and forwarding settings, and enable multi-factor authentication.

What number can I call for cyber help in Australia?

The Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371) and operates around the clock. Call 000 for immediate physical danger.

Is a hacked email a police matter?

Unauthorised account access and related identity theft or fraud may be reported through ReportCyber, which forwards relevant cybercrime information to the appropriate police jurisdiction. Contact the platform as well.

Do I report to Scamwatch or ReportCyber?

They have different purposes. Use ReportCyber for cybercrime and Scamwatch when a scam or attempted scam was involved. Scamwatch’s form is not an official police report.

Can a hacker stay inside after I change my password?

Possibly, if active sessions, recovery methods, third-party permissions or mail forwarding remain. Review and revoke unauthorised access using the provider’s official security settings.

What if I have lost my recovery phone number?

Use the official account-recovery process and contact the mobile carrier if an unauthorised SIM or number change occurred. Never hand codes to a purported recovery expert.

How do I get help after identity theft?

IDCARE provides free identity and cyber support in Australia on 1800 595 160 during its advertised opening hours. Contact banks and relevant government agencies promptly too.

Can I get my stolen money back?

Recovery depends on the actual transactions, the bank’s investigation and applicable law. Contact your financial institution immediately. Avoid third parties promising guaranteed recovery for a fee.

What if intimate images were posted through the hacked account?

Preserve relevant evidence, report the content to the platform and consider the Australian eSafety Commissioner’s reporting service. If anybody is in immediate physical danger, call 000.

The decision sequence to remember

Protect bank accounts. Recover email via the official provider. Change the password. Sign out unknown sessions. Remove unauthorised forwarding and recovery settings. Secure connected accounts. Warn contacts. Report through ReportCyber or Scamwatch as appropriate. Monitor for further misuse.

Related digital safety guide: What to Do When Your Identity Is Stolen in the United States.

Official Australian sources

Independent Australian cyber-safety guide reviewed 7 November 2026 against ACSC, Scamwatch, IDCARE and eSafety. Account providers and banks control their own recovery procedures; use their verified channels and qualified help when necessary.