You are locked out of your own inbox and someone else is in it. That is a sick feeling, and I am not going to tell you to calm down. A hacked inbox does not mean a hacked identity everywhere: kill the compromised alias and the leak stops spreading. I run AliasFleet, an email-alias service, and I will tell you this instead: recovering a hacked inbox is two jobs, not one. Job one is getting back in. Job two is evicting the intruder. Most guides walk you through the first and stop, and that is exactly where recoveries quietly fail.
The intruder had whatever got them through the door: your password, your recovery phone, a keylogger on your machine. A new password locks the front door again. It does nothing about the side doors they built while they were inside: their sessions, their forwarding rules, their recovery email, their app access. Those footholds are built to survive a password change, and they do. So work the two jobs in this order, and finish both.
Before you start, one piece of the machinery. An email alias is a separate forwarding address per site, all landing in your one inbox. One address reused everywhere is why a hacked inbox feels like a hacked life. One address per site shrinks the blast radius to that site alone. Hold that thought. It is the final step, once the intruder is out.
One scope note: this guide covers Gmail and Outlook (Microsoft 365), the two most common inboxes, and not Yahoo, AOL or Apple Mail, whose recovery paths I have not walked through here.
Job one: get back into the inbox
Do the first job from a device you trust, not the one you were using when things went wrong. Microsoft's recovery page tells you to run a full antivirus scan before you change the password, and the order is the whole point. On a machine with a keylogger, the new password belongs to the attacker the moment you type it. If you do not have a clean device, borrow one, and park the suspect machine until it is cleaned.
Microsoft's official order is malware scan first, password change second, because an infected machine reads the replacement password the moment you type it. No clean device at hand? Run the entire recovery on a different one and treat the suspect machine as out of service until it is cleaned.
Gmail: the recovery form, on ground it recognises
If the attacker changed your password, your recovery phone or deleted the account, Google's account recovery page is the official route, and Google's hacked-account guide starts there. Two things move the odds in your favour. Do it from a device you have signed in on before, on the network you normally use. Google's recovery checks lean hard on recognised devices and locations, and one independent recovery guide reports that rapid failed attempts make the model stricter, so space your attempts out instead of hammering the form. Still signed in on one device? That session is your control point. Run the whole lockdown from there; that is how hacked.com frames it: take the ground you hold, then clean the rest.
Outlook and Microsoft accounts: the form is the only door
Microsoft's route is the sign-in helper first, then the account recovery form if the normal reset will not let you in. Microsoft's help page for the form is blunt about two things. Fill it in from a device you have used before, somewhere Microsoft will recognise, like home or work. And if it rejects you, keep going, up to twice a day; wrong guesses do not count against you, and Microsoft reviews each submission within 24 hours. Nobody at support can bypass the identity checks or send you a reset link. The form is the only door in.
Work address on Google Workspace? Skip the personal flow and call your domain admin. Admins hold tools the self-service route does not.
Job two: throw the intruder out
Back inside does not mean they left. Anyone who held your inbox for a while tried to build a way back in. These footholds are built to survive a password change, so work them in this order.
1. Kill their sessions
Open the account security page and sign out of everything you do not recognise. On Google that is the Your devices section; on a Microsoft account it is recent activity and devices. If anything looks wrong at all, do not pick through the list: sign out everywhere and sign back in only from the device you trust. Changing your Google password already signs out most other sessions, which starts invalidating stolen session cookies (this phishing playbook documents the mechanics), but verify it yourself. Never assume.
2. Take back the recovery methods
Check the recovery email and recovery phone in the settings and make sure both are yours. This is the quietest back door after a takeover: an attacker who added their own recovery address can walk back through "forgot password" next week and lock you out the week after. Remove anything you did not add, and add a second recovery method of your own if the provider allows it. Our piece on whether changing your password stops hackers walks the full list of doors a new password misses. Recovery takeover is the one nobody notices.
3. Hunt for what they planted inside the mailbox
Most guides skip this step. Do not. The intruder's persistence lives in mail settings, not in the password, so it survives the password change. Work the panels in full, on a computer; the mobile apps hide some of the settings.
Open Settings, then See all settings, and check three tabs. Under Forwarding and POP/IMAP, remove any forwarding address you did not add. Attackers set silent auto-forwarding to siphon a copy of every message, and stripping it is exactly what Google's hacked-account guide tells you to do. Under Filters and Blocked Addresses, delete every filter you did not create, and read hardest the ones matching "security", "password" or your bank's name: that is how attackers hide Google's own alerts so you never see the warning. Under Accounts and Import, check the send-as addresses and the delegation list for anyone else able to send or read your mail, then remove them.
Open Outlook on the web, then Settings, then Mail (labels can shift with UI updates). Under Rules, delete anything you did not create, especially rules that forward or redirect mail to an unfamiliar address. Under Forwarding, make sure no external address is listed. If a rule keeps reappearing after you delete it, the attacker still has access or the rule sits at admin level, and you need to re-run the full account lockdown. Also check the blocked senders list, since attackers sometimes block addresses to make legitimate mail vanish, a pattern this Microsoft community thread documents.
4. Revoke their app access
Two things with confusingly similar names, and the attacker can use either. App passwords are credentials you generated so older apps could sign in; each one bypasses two-factor, so review the list and delete every one you do not actively use. Third-party connections (OAuth) are apps you granted permission to read your mail, calendar or files; remove anything you do not recognise or no longer use. Revoking stops the app reading your account from that moment. It does not delete data it already took. On the Microsoft side, check whether the attacker was sending through SMTP or a connected app rather than the web interface, because that traffic skips the Sent folder entirely. An account can look quiet and still be working.
5. Regenerate what they might have copied
If you use two-factor backup codes, generate a fresh set now. The new set kills the old one, so any codes the attacker saw turn to dust. Give the authenticator app entries tied to the account the same review. Then switch two-factor on if it was off before, and take the strongest method on offer: a passkey or security key beats an authenticator app, which beats a texted code. If the account holds anything high-value, Google's Advanced Protection Program is free and demands a passkey or security key at sign-in, which keeps an attacker out even with your password in hand.
Take back the address they know
When job two is done, the inbox is yours and the intruder is out. The remaining problem is that the address they now know is still the address every site on earth holds for you, and the next attack starts from that list.
This is where per-site aliases change the shape of the damage. When the address the attacker harvested belongs to exactly one site, killing that alias kills the channel: their mail bounces, your real address and every other alias keep working. The setup takes about two minutes per method, and the one-alias-per-site habit turns the next incident from a crisis into a ten-second pause.
Stated plainly: aliases do not evict someone from an inbox they already control. That was jobs one and two, which you just did. Aliases do the job after eviction, which is making the address the intruder walked away with worth nothing. A hacked inbox does not have to mean a hacked identity everywhere.
Lock the rest of your life out of it too
Your inbox is the reset path for everything else, so the job is not finished at the inbox. Change every password the inbox password shared, starting with the accounts that lean on this inbox for resets: banking, your other email accounts, social, shopping. Have I Been Pwned tells you whether the address already circulates in known breaches, and our walkthrough of reading its result shows how to work each breach it names.
Two things left, then you are done. Warn your contacts that the account was compromised and to ignore the phishing it may have sent; inbox takeovers are routinely followed by scam mail to the contact list. And run our full audit of every account linked to the email, because the forgotten forum account with the same password is the intruder's next try. When the whole pass is finished, our hardening guide keeps the account in that state, and the pricing page covers the free tier if you want the alias habit: 10 active aliases, enough for the accounts that matter most.
