Email Account Hacked and “Account Under Review” — what to check first (safe steps)
Steve H.
Expert ★★★★★ 27,853 satisfied customers
Specialities: email account hacked triage, “account under review” hold patterns, suspicious sign-in alerts and security review flows, recovery email/phone.
When your email is hacked and the account is under review, check recent activity, recovery options, suspicious rules/forwarding, and cooldown messages before trying again
Technician
We’ll keep this calm and low-risk. I don’t want you clicking random reset options that can make the review longer or lock you out further.
First, tell me three things:
1) Which email service is it (Gmail/Google, Outlook/Microsoft, iCloud/Apple, Yahoo, etc.)?
2) What does it say exactly — “under review,” “suspicious activity,” “account locked,” “try again later,” or a verification loop?
3) What was the first sign something was wrong (unrecognized sign-in email, password changed, emails sent, missing emails, new forwarding address)?
Technician
When an email account is under review, there are usually two tracks happening:
• The provider is checking risk: unusual sign-in, new device, location/IP changes, or mass sending.
• The system is limiting changes: to prevent an attacker from swapping recovery details or adding forwarding.
Quick safe questions (no changes yet):
1) Can you still sign in anywhere (phone mail app, another device), or are you blocked everywhere?
2) Do you still control your recovery phone/email shown on the screen?
3) Did you see emails sent that you didn’t send (especially in “Sent” or “Trash”)?
Technician
Trust moment: I don’t want you doing repeated sign-in attempts right now. Rapid retries can trigger cooldowns like “try again later,” and that can slow down review windows.
Safe checks that help you understand what happened (and what to report):
1) On the device where you can still access the account, check for recent activity (unfamiliar devices/locations).
2) Look for mailbox changes: forwarding addresses, filters/rules, auto-replies you didn’t set. Attackers often add these quietly.
3) Tell me if you recently installed a new browser extension, “security” tool, or had a pop-up that asked you to re-enter your password.
Technician
Also, updates and extensions can change sign-in behavior — and some extensions are risky if they can read page data.
A few questions (different order on purpose):
1) Are you seeing messages like “try again later,” “we can’t verify it’s you,” or “too many attempts”?
2) Did any of your security info change (recovery email, phone, 2-step verification) without you doing it?
3) On the phone where it sometimes works: do you see any alert about “security review” or “account under review” inside the account settings?
Technician
Trust moment: we’ll start with the least risky items so you don’t accidentally trigger longer locks. If the system is already limiting you, big changes (multiple resets, switching devices constantly) can confuse the review process.
Safe “what to check first” list (no step-by-step clicks, just what to look for):
• Unauthorized mailbox rules: forwarding, filters that auto-delete, or rules that hide password reset emails.
• Suspicious sign-in locations/devices: anything you don’t recognize, especially from a different country.
• Security method status: whether 2-step verification is enabled and whether recovery methods still match you.
• Cooldown behavior: if you saw “try again later,” pause attempts and use the phone path sparingly.
Technician
• Password reuse from another site that had a leak
• A fake sign-in page (phishing email or pop-up)
• A risky browser extension or saved password exposure
• Someone with access to your email recovery channel
It can also be malware, but we don’t assume that first. We focus on account safety evidence and the review process.
Safe check: do you have a password manager or does the browser save passwords? And did you receive any “reset your password” emails you didn’t request?
Technician
Important risk note: while the account is under review, avoid “rapid-fire” actions like requesting multiple codes, switching networks repeatedly, or trying lots of devices. That can look like automated activity and slow the process.
Two helpful, low-risk things to gather (so you’re not stuck guessing):
1) A short timeline: when you saw the reset email, when sent mail appeared, when “under review” started.
2) A list of anything suspicious: unknown device names, unknown forwarding address, or odd filters.
Technician
Signs someone may still have access include: new “Sent” messages, new forwarding, new filters, or security settings you didn’t change. If you see any of those, note them for the provider’s recovery flow and for your own records.
Trust moment: I don’t want you removing recovery info in a panic. During reviews, providers may ask for older details to confirm it’s you, and changing everything at once can make that harder.
Technician
If the laptop shows “try again later” or keeps asking to verify, it can be a cooldown plus browser/session issues. If you installed a coupon extension, that can also affect sign-in pages.
The safest plan is: pause repeated attempts, use the phone only for short checks, and document what you see (under review message, suspicious activity note, sent mail you didn’t send). With that, you’ll have a clear, calm story and the right evidence for the provider’s recovery steps.
Quick answer: the accepted fix
Most common safe steps when an email account is hacked and shows “account under review”:
• Pause repeated sign-ins and code requests if you see “try again later” (cooldowns can extend).
• On a trusted device (often your phone), check for sent mail you didn’t send, unfamiliar devices, and suspicious recent activity notes.
• Look for silent mailbox changes: forwarding addresses, filters/rules, and auto-replies you didn’t set.
• Keep a short timeline (what happened first, when review started) so you can follow the provider’s recovery flow without guessing.
Why “account under review” can appear after an email hack
Modern sign-in protection is often risk-based: the service scores your attempt (device trust, IP reputation, location changes, VPN/proxy use, retry volume) and may enforce the strictest identity verification repeatedly. If the verification result can’t be saved (cookies blocked, CAPTCHA scripts filtered, session token issues), it looks like an “endless verification loop” even when you enter the correct code.
Safe checks before you change passwords or recovery settings
Start with reversible diagnostics: confirm device time/date, use one browser profile, avoid VPN, and try a single attempt on a different network to isolate router/DNS filtering. Note whether tracking protection or third-party cookie blocking is enabled during sign-in, and whether the loop happens only on a laptop browser or also in a mobile app. Avoid rapid retries, repeated code requests, or removing recovery options while you’re in a cooldown state.
Security tip: don’t share codes while your email is under review
Verification loops attract phishing scams.
If anyone asks you to send a verification code, password, recovery key, or “support PIN,” treat it as suspicious. Legitimate recovery should happen only through the official sign-in pages or the provider’s help site. Stick to safe checks (network isolation, session consistency, blocker/DNS review) and keep notes you can share with official support.
Disclaimer: This information is AI-generated and intended for general guidance only. Steps vary by device, region, and service. For exact instructions for your setup, consult a verified expert or the manufacturer’s support site.
Getting Started Is Easy
Low-risk diagnosis
Identify whether the verification loop is driven by risk signals, cookie/session persistence, or blocked security resources.
Reduce security friction
Learn why repeated attempts can trigger cooldowns and how to test safely without escalating lockouts.
Escalation-ready notes
Collect the exact prompts, timestamps, and environment differences so official support can triage faster.
FAQ
Why did my email account hack and “account under review” start suddenly?
It often starts after a suspicious sign-in, unusual sending, or a reset attempt that you didn’t request. Sometimes the provider detects it hours later and then applies a review hold. Repeated sign-in attempts can also trigger cooldown messages. A short timeline of what happened first helps a lot.
Can this happen after an update (browser, phone, or system update)?
Yes. Updates can change sign-in protection, cookie rules, or how verification pages load. A browser extension may also behave differently after an update. That can make one device work and another device fail. Try to keep attempts minimal while the account is under review.
Is this a hardware problem or just account/settings?
Almost always it’s account security and settings, not broken hardware. The review hold is meant to protect the mailbox after suspicious activity. Issues on a laptop can also come from extensions, strict privacy settings, or blocked scripts. A trusted phone path often works better during review.
Can this be fixed without service or repair?
Usually yes, because it’s a security process for the email account. Focus on safe checks: recent activity, sent mail you didn’t send, and suspicious forwarding or filters. Keep notes and follow the provider’s recovery prompts when they appear. If identity verification is required, you may need to complete that review step.
Sources
- Google Account Help — Secure a hacked or compromised Google Account
- Gmail Help — Report suspicious emails or activity
- Microsoft Support — Microsoft account hacked or compromised
- Apple Support — If your Apple Account is locked, not active, or disabled
Filed under: Account Access Help
Related articles
- Email Account Hacked — “Account Under Investigation”? What to check first (without making it worse)
- Email Account Hacked & Verification Keeps Failing — what to check first (without triggering more lockouts)
- Email account hacked — “Security investigation ongoing” and I can’t regain control (safe checks first)
- Email Account Hacked — “Recovery Pending” for Weeks? What to Check First (Safely)
- Email account hacked and recovery options removed — what to check first (before you get locked out)
- Email Account Hacked — Recovery Failed (what to check first without locking yourself out)
- Email Account Hacked, and Proof of Identity Denied — what to check first (without making lockouts worse)
- Email Account Hacked — Only Automated Responses (safe checks before you get locked out)
