Email Account Hacked After Password Change — what to check first (safe steps, no lockouts)
Steve H.
Expert ★★★★★ 27,853 satisfied customers
Specialities: email account compromise triage after password change, suspicious sign-in review, mailbox rules/forwarding checks, recovery options.
Email hacked even after you changed the password? Check sign-in activity, forwarding rules, recovery changes, and trusted devices before you try more resets
Technician
1) the attacker still has access through a signed-in device, an app password, or an email forwarding / mailbox rule, or
2) your password change didn’t fully apply everywhere (saved sessions, old devices, or a linked account).
I want to keep this safe: no risky clicks, no repeated resets, and nothing that could trigger a long account security lock.
First, tell me (quick answers are fine):
• Which email service is it (Gmail, Outlook/Hotmail, Yahoo, iCloud, or something else)?
• What “hacked” signs are you seeing — spam sent, password changed again, new recovery email/phone, strange inbox rules, or alerts about unrecognized sign-in?
• When did it start — right after the password change, or hours/days later?
Technician
For Gmail, “Sent mail I didn’t write” usually points to one of these common reasons:
• A device is still signed in (phone/tablet/laptop), so the attacker can send mail even after a password change.
• Mailbox settings were changed (forwarding address, “filters” that hide messages, or auto-replies).
• A third-party app still has access (connected apps, “Sign in with Google,” or an older mail app).
Safe check #1 (diagnostic, not destructive): did you receive any alerts like “new sign-in,” “suspicious activity,” or “security settings changed”?
Technician
A few questions in no particular order (because the pattern matters):
1) Do you use the Gmail app on a phone, or do you check mail in a browser?
2) Did you ever set up an older mail program (like Apple Mail, Thunderbird, or Outlook) with your Gmail?
3) After the password change, did you also turn on 2-step verification (or do you already have it)?
Trust note: we’ll start with the lowest-risk checks first, so you don’t get locked out of your own account.
Technician
• Old “mail app” connections can keep working if they were authorized long ago.
• Even with a new password, a thief can stay in via a connected app or a device that never signed out.
Safe check #2: look for “changes,” not buttons. In your Gmail, do you notice any of these?
• Messages missing or moved to Archive/Trash unexpectedly
• Replies that you didn’t write (auto-reply)
• A lot of “Undeliverable” or “Mail delivery failed” messages
• Friends saying they got strange email from you
Also: have you seen any change to your recovery email or recovery phone number?
Technician
Here’s the key diagnostic question: is the sending coming from your Gmail account, or is someone just “spoofing” your address? The difference matters, and I don’t want you doing heavy changes if it’s just spoofing.
Safe check #3 (easy): when you open one of the suspicious sent messages, do you see it in your Gmail Sent folder as a normal message you could click and open? If yes, it was sent through your account (not just spoofed).
And one more: do you have any security alert emails that say “Your password was changed” or “Security settings changed” after your last password reset?
Technician
I’m going to be careful here: I don’t want you removing things blindly, because you could disconnect something you rely on (like a mail app, calendar sync, or a backup service).
Safe checks to identify the “back door” (without a full step-by-step takeover):
• List what’s signed in: note which devices are currently logged into Google/Gmail (phone, tablet, computer).
• List what’s connected: note any connected apps/services you don’t recognize (especially ones with mail access).
• Check mailbox behavior: look for forwarding addresses and filters that auto-delete, auto-archive, or auto-forward.
Which worries you most right now: losing access, spam being sent, or private emails being read?
Technician
Two trust points before anything else:
1) Don’t follow links from random “security” emails — even if they look official. Use the provider’s official account/security page directly.
2) Don’t keep changing passwords repeatedly today. Multiple resets in a short period can trigger extra verification or recovery delays.
Diagnostic logic (what we’re trying to prove):
• If a strange device is still signed in, it must be removed (but only after you confirm your recovery methods are correct).
• If a connected app has mail access, it can keep sending even after password changes.
• If forwarding/filters exist, they can hide or copy messages quietly.
One simple check: do you see any new “forwarding address” or unfamiliar “filter” names in your mail settings?
And yes — this started suddenly after I changed my password, which is what confused me.
Technician
Since your priority is not getting locked out, the safest order is:
• Verify your recovery phone/email are correct and reachable (so you can get back in if anything asks to re-verify).
• Identify what changed: unfamiliar devices, unfamiliar connected apps, suspicious filters/forwarding.
• Then tighten security carefully (like turning on 2-step verification) once you know you’re the one in control.
If anything prompts you for extra verification, stop and note the exact message. I don’t want you forced into a recovery process because you clicked too fast.
Quick answer: the accepted fix
Accepted safe approach when an email account is hacked after a password change:
• Stop repeated password resets and avoid clicking “security” links in random emails (reduces lockout risk).
• Confirm your recovery phone and recovery email are correct and you can receive codes.
• Review recent sign-in activity and list any devices you don’t recognize (don’t remove anything blindly yet).
• Check for suspicious forwarding addresses, filters, or “rules” that hide messages or send copies out.
• Note any unfamiliar connected apps with mail access (this is a common reason the problem continues after a password change).
Why it can continue even after you changed your password
A password change is important, but it does not always end a compromise immediately. Attackers may still have access through a signed-in device, a connected app with permission, or hidden mailbox settings like forwarding and filters. Some seniors also run into “I changed my password, but they’re still in” because the account is linked to other services (phone, tablet, old mail apps) that remain authorized until you review and remove them safely.
What to check first without making it worse
Start with low-risk checks: confirm you can receive recovery codes, review recent security activity, and look for changes like new devices, new recovery email, or new apps with access. Then check mailbox settings for forwarding, filters, or “rules” that move messages out of your inbox. If you see prompts for extra verification, pause and write down the exact wording before trying again—rapid changes can trigger extra security checks.
Safety reminder: don’t share codes or “support” details
Hacked email situations often attract scammers.
No real helper should ask for your verification code, password, recovery code, or “support PIN.” If someone calls or messages claiming to be support, do not provide codes. Use the provider’s official account security pages to review activity, and focus on safe checks first (recovery access, sign-ins, forwarding/filters, connected apps).
Disclaimer: This information is AI-generated and intended for general guidance only. Steps vary by device, region, and service. For exact instructions for your setup, consult a verified expert or the manufacturer’s support site.
Getting Started Is Easy
Calm, low-risk checks
Confirm recovery access first, then identify the most common “still hacked after password change” causes safely.
Stop the “back door”
Spot suspicious devices, connected apps, and email forwarding/filters that can keep access open.
Escalation-ready notes
Collect what changed (devices, apps, rules) so official provider support can act faster if needed.
FAQ
Why did it start suddenly, right after I changed my password?
This can happen when an attacker already had access and set up a “back door,” like a connected app, a signed-in device, or a forwarding/filter rule. The password change triggers alerts, but it may not remove those existing connections right away. It can also be normal timing: you noticed the problem only after the warning and password reset.
Could this be related to an update (phone or browser update) instead of hacking?
Updates can change sign-in behavior, but they do not usually create emails in your Sent folder. If messages were sent from your account or new rules/forwarding appeared, that points to account access rather than an update. Still, note any recent updates because they can affect how your devices stay signed in.
Is this a hardware problem, or is it just settings and account security?
In most cases it’s not hardware. Hacked-email symptoms are usually account security or mailbox settings: sign-in activity, connected apps, and forwarding/filters. Hardware issues might cause crashes or slowdowns, but they won’t normally send email from your account.
Can this be fixed without going to a service center or paying for repair?
Often yes, because it’s handled in the email provider’s security settings. The safest approach is to confirm recovery access, review sign-ins and connected apps, and check forwarding/filters before making major changes. If you cannot receive recovery codes or your recovery info was changed, you may need the provider’s official recovery process.
Sources
- Google Account Help — Secure a hacked or compromised Google Account
- Microsoft Support — What to do if your Microsoft account has been hacked
- Apple Support — If you think your Apple ID has been compromised
- Gmail Help — Check Gmail settings (filters/forwarding) when something looks wrong
Filed under: Account Access Help
Related articles
- Email Account Hacked After Travel — what to check first (before you reset anything)
- Email Account Hacked After a Phishing Attack — what to check first (without making it worse)
- Email Account Hacked After Malware Infection — what to check first (without making it worse)
- Email Account Hacked After Device Change — what to check first (without making it worse)
- Email Account Hacked & Verification Keeps Failing — what to check first (without triggering more lockouts)
- Email account hacked — “Security investigation ongoing” and I can’t regain control (safe checks first)
- Email Account Hacked — “Recovery Pending” for Weeks? What to Check First (Safely)
- Email account hacked and recovery options removed — what to check first (before you get locked out)
