Someone got into my email and set up a forwarding rule. I've changed the password, what else could I have missed?

#1Marisol K(Joined Oct 2026 · 3 posts)October 26, 2026, 8:44 pm

Got a "new sign in from an unknown device" alert on Friday which I ignored because I'd just bought a new laptop. Saturday my sister asks why I emailed her a weird link about a shared invoice. I didn't.

Changed my password straight away and felt very pleased with myself, and then this morning I found a rule in my settings forwarding every email with the words bank, password or verify to an address I've never seen. It's been there since Friday. I've deleted it.

Now I'm paranoid. What else do these people usually do once they're in? I don't want to find the next thing in another week.

#2Grace H(Joined Mar 2025 · 31 posts)October 27, 2026, 7:58 am

Check the recovery email and phone number on the account. They're the quiet ones. And your sent folder, to see who else got the invoice link.

#3tomd52(Joined Jun 2025 · 20 posts)October 27, 2026, 1:22 pm

Sign out of every device from the security settings, not just change the password. Changing the password didn't kick my old work laptop off, which made me realise it wouldn't necessarily kick off anyone else either.

#4Marisol K(Joined Oct 2026 · 3 posts)October 28, 2026, 9:15 pm

Grace H said:

Check the recovery email and phone number on the account.

There was a second recovery email on there. Mine plus one I didn't recognise. Removed. Sent folder had the invoice email to 140 people. I've been apologising all evening.

#5David MercerModerator(Joined Jan 2025 · 214 posts)October 30, 2026, 9:05 am

Marisol, you've done more right in four days than most people do in four weeks, so take a breath. Deleting the forwarding rule was the big one, because that rule would have kept feeding the hacker your reset emails even after the password change.

The FTC's checklist for this, which matches what Grace and Tom said, is: run a scan on your devices first, change the password, sign out of all devices, turn on two-factor authentication, check the recovery details, then look through the settings for forwarding rules, the sent folder for what went out, and the deleted folder for anything the hacker read and binned, like security alerts. Then warn your contacts. You've done almost all of it. The two I'd add are the device scan, given the new laptop, and two-factor with an app rather than texts.

After that, think about what that inbox could reach. Any account that uses that email address for resets is worth a look, banking first, and any account with the same password needs a new one. I've put the whole sequence in one place in what to do about a hacked email or social media account.

#6Marisol K(Joined Oct 2026 · 3 posts)November 1, 2026, 4:38 pm

Scan came back clean, authenticator set up, and two old shopping accounts with the same password are now not the same password. Also found the hacker had read and deleted a "your payee was added" email from my bank, so I rang them. Nothing had gone out, but they'd added a payee. Removed. That deleted folder tip was the one that mattered.