iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act as if the attacker still has access until you prove otherwise. From a known-good device, contact your email provider or administrator through its official recovery channel, change the password, revoke active sessions, enable multifactor authentication, and then inspect forwarding rules, inbox rules, recovery methods, connected applications, sent mail, deleted mail, and sign-in records. Next, protect accounts that use the mailbox for password resets, warn people who may have received fraudulent messages, preserve evidence, and determine whether your jurisdiction or industry requires a breach notification.
Start with containment and account recovery
Do not begin by replying to a suspicious message or clicking a recovery link in an email. Use a bookmark, a manually entered provider address, or a phone number published on the provider’s legitimate website. If the mailbox is administered through a business platform, involve the administrator immediately. A personal mailbox and an administrator-controlled business account can have very different recovery and logging procedures.
Use a device you can trust
Recover the account from a computer or phone that is updated and not showing signs of malware. If the device itself may be infected, use another known-good device for the first password change and account recovery. Change the compromised password to a long, unique password that has never been used on another service. Do not reuse a password from the hacked mailbox on the administrator account, domain registrar, payroll system, or any other service.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Follow the provider’s official recovery path
- Open the provider’s official account-recovery or administrator-support page without using links from suspicious messages.
- Verify ownership using the provider’s approved recovery method. If the account is part of a business tenant, have an authorized administrator start the process.
- Set a new unique password and record it in the company’s approved password manager.
- Use the provider’s sign-out-everywhere, revoke-sessions, or equivalent control. For Microsoft 365, administrator guidance includes revoking sessions and invalidating refresh tokens for a compromised user.
- Sign in again only after sessions have been revoked, then confirm that the account owner and administrator can access it normally.
A password change alone may leave an attacker’s existing browser session, token, or application connection active. Session revocation is therefore a separate containment step wherever the provider supports it.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Escalate when dependencies are also compromised
If you cannot regain control, contact the provider through its official support process. Tell the provider that the account is a business mailbox and that unauthorized access may still be active. If the suspected compromise includes the administrator account, recovery email, recovery phone, domain registrar, or DNS administration, secure those dependencies through their own official support channels as well. There is no single recovery workflow that applies to every email service.
Remove ways the attacker could return
Once you can sign in, look for persistence mechanisms before treating the account as clean. Work methodically and save screenshots or exports of suspicious settings before deleting them when doing so will not prolong the attacker’s access.
Check forwarding and inbox rules
Review every mailbox rule and automatic-forwarding destination. Remove rules you did not create, especially rules that silently delete messages, mark them as read, move them to obscure folders, or forward copies outside the business. Check organization-level transport or routing rules if your administrator console provides them; a mailbox can look normal while a broader rule copies messages elsewhere.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify recovery details and multifactor methods
Compare the recovery email address and phone number with the owner’s verified information. Remove unfamiliar authenticator registrations, security keys, phone numbers, backup codes, or trusted devices. Do not delete a legitimate recovery method until you have confirmed that another working method is available, or you could lock out the rightful owner.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review connected applications and delegated access
Inspect applications that have permission to read mail, send mail, manage contacts, or maintain offline access. Revoke unfamiliar consent grants, OAuth applications, app passwords, delegates, and shared-mailbox permissions. Microsoft 365 administrator guidance specifically calls out application consent, mailbox rules and forwarding, MFA devices, and session revocation as checks for a compromised account. Other providers use different labels, so follow their current administrative instructions.
Reconstruct what happened
After containment, determine which messages, people, and business processes may have been affected. Keep the original evidence where possible, and record times in a consistent time zone.
Inspect sent and deleted mail
Search Sent Items for messages the attacker sent, including payment changes, password-reset requests, malicious links, and urgent instructions. Check Deleted Items, trash, archive folders, and any provider recovery area for messages that may have been read and removed. Look for replies from customers or vendors that reveal who received the fraudulent communication.
Review sign-in and administrative records
Use the provider’s available sign-in history, audit log, mailbox audit, and administrator records. Record unfamiliar locations, devices, IP addresses, application names, rule changes, password changes, MFA changes, and consent events. A location alone does not prove an intrusion because mobile networks and corporate gateways can alter geolocation; correlate it with the user’s actual activity and the timing of mailbox changes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Classify the sensitive material
Identify conversations and attachments involving payroll, bank details, wire instructions, customer or employee personal information, identity documents, contracts, credentials, and password resets. This inventory determines which accounts and people need protection and whether a formal incident response is warranted.
Check the device used to access email
Email compromise can result from stolen credentials, a malicious browser extension, malware, or a separate service breach. Do not assume the mailbox password was the only problem.
Scan when infection is plausible
On a potentially affected computer or phone, update the security software already installed and run a complete scan. The Federal Trade Commission’s recovery guidance recommends removing identified suspicious software and restarting the device. If the scan cannot establish that the device is safe, stop using it for administrator or financial access and obtain qualified technical help. A paid endpoint product is not a prerequisite for the basic recovery sequence.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Secure accounts that depend on this mailbox
Email access can expose password-reset links for other services. Make a list of important accounts that use the address for recovery, especially banking, payroll, cloud storage, domain administration, customer-management systems, and payment platforms. Visit each service through its official website, check for reset or login activity, change credentials where exposure is possible, revoke unfamiliar sessions, and replace the recovery address if the mailbox cannot yet be trusted.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect employees, customers, and money
Warn staff through a separate trusted channel
Tell employees what happened using a known phone number, in-person conversation, or an internal channel that was not controlled by the compromised mailbox. Explain which dates, addresses, subject lines, or requests may be fraudulent. Instruct staff not to trust payment changes, gift-card requests, credential prompts, or urgent wire instructions merely because they appear in a familiar conversation.
Independently verify payment instructions
Require a second-channel check for wire transfers, bank-account changes, payroll changes, and new vendor payment details. Call a known number from an existing contract or directory rather than a number in the suspicious email. A voice or video call can also be spoofed, so use an independently obtained contact method.
Notify affected outsiders carefully
Contact customers, vendors, banks, or other institutions when the evidence shows that they received fraudulent instructions, were impersonated, or had information exposed. If you send a customer notice by email, avoid hyperlinks that make the message resemble phishing. Give recipients a known website address they can type themselves or a phone route they already trust. State what happened, the dates involved if known, what recipients should ignore or verify, and how to reach the business without using the compromised conversation.
Recommended Free Tools
Decide whether to involve specialists or report
Bring in help when the scope is larger than one mailbox
Contact the email provider, qualified IT or security support, your cyber-insurance contact, legal counsel, or law enforcement when the evidence warrants it. Outside help is particularly important when an administrator or domain account is involved, fraudulent payments occurred, malware is suspected, logs are incomplete, or personal information may have been exposed.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
The Federal Trade Commission’s Data Breach Response: A Guide for Business advises: “Move quickly to secure your systems and fix vulnerabilities that may have caused the breach.” Preserve relevant messages, timestamps, logs, screenshots, exported audit records, and provider case numbers before routine retention removes them. Keep an incident timeline naming who performed each action.
Assess notification duties by jurisdiction and data type
Do not announce a universal deadline or assume that one rule covers every business. Requirements depend on the business location, affected people, industry, contracts, and the kinds of personal information involved. The FTC’s U.S.-oriented guidance says to notify law enforcement, affected businesses, and affected individuals as appropriate. Confirm the applicable rules with counsel, the relevant regulator, and contractual partners before deciding who must be notified and when.
Harden the mailbox and business domain
Make strong access the default
- Require multifactor authentication for every mailbox and administrator account that supports it.
- Prefer a phishing-resistant hardware security key when the provider supports it and the business can maintain secure backup and recovery procedures. A key is a post-recovery control, not an emergency recovery product.
- Keep passwords unique and store them in an approved password manager.
- Review recovery addresses, phone numbers, trusted devices, delegates, app passwords, and connected applications on a regular schedule.
- Remove dormant accounts and apply least-privilege administrator roles.
Choose an MFA method that the provider supports, that employees can use reliably, and that has a documented recovery process. A control that nobody can recover from safely can create a new operational risk.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview SPF, DKIM, and DMARC
If the business sends mail from its own domain, ask the email host or domain administrator to review SPF, DKIM, and DMARC. These mechanisms help receiving servers verify that a message claiming to come from the business was authorized. They can reduce domain spoofing, but they do not remove an attacker from a compromised mailbox, undo fraudulent messages already sent, or replace password, session, and application cleanup.
Quick Recap
Match the response to the incident
| Situation | Immediate focus | Additional concern |
|---|---|---|
| One user mailbox is compromised | Recover the account, revoke sessions, remove rules and forwarding, and inspect sent and deleted mail. | Check accounts that use the address for password resets. |
| An administrator, domain, or recovery account may be compromised | Secure the administrative dependency through its official recovery process and review organization-wide access. | Preserve logs and obtain qualified IT or security assistance. |
| The access device may be infected | Use a known-good device, update security software, and scan the affected device. | Do not return sensitive administration to the device until it is considered safe. |
| Fraudulent instructions or exposed personal information are found | Warn targeted employees and contacts, independently verify payments, and preserve evidence. | Assess legal, contractual, regulatory, insurance, and law-enforcement obligations. |
Common mistakes that prolong the breach
- Changing the password but leaving active sessions, forwarding rules, app access, or unfamiliar MFA methods in place.
- Using a recovery link supplied in a suspicious message instead of the provider’s official route.
- Deleting all evidence before checking sent, deleted, and audit records.
- Trusting a payment-change email because it came from a familiar thread.
- Sending a breach notice with links that recipients cannot independently verify.
- Assuming SPF, DKIM, or DMARC will clean a hacked mailbox.
- Declaring that notification is or is not required without considering location, sector, data type, and contracts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
