Worried someone has your email? Recover access and check what else changed.

Use the provider’s security information to review signed-in devices, recent events and connected apps or delegated access. Identify entries with help from the provider/administrator when names, locations or times are unclear. Keep a private record of suspicious access rather than assume every unfamiliar device label is an attacker.

Follow the provider’s supported sign-out/revocation process for unauthorised sessions and app permissions, with your legitimate recovery/access confirmed first. On a managed account, the responsible team may need to revoke access and investigate service logs. Do not rely on uninstalling Outlook or removing one phone from a list to invalidate every token or permission.

Effects and timing differ. Microsoft’s personal-account sign-out-everywhere guidance currently allows up to 24 hours and names an Xbox-console exception; do not assume an immediate universal sign-out or apply that timing to other providers. If unauthorised activity continues or revocation cannot be confirmed, get provider/incident help promptly rather than wait through repeated password changes.

Through genuine webmail/account settings, check forwarding addresses, inbox filters/rules, delegated mailbox access, automatic replies, signatures and outgoing identity settings where the service supports them. Check for changes that hide, redirect or impersonate mail. Some legitimate apps or work processes also use these features, so identify the setting before removing it.

Keep a private record for the provider or incident team, then correct confirmed unauthorised settings through the supported process. Google’s compromised-account guidance includes Gmail filters, forwarding and delegation. Other services expose different controls. Do not delete all rules, all messages or local archives as a blanket fix, or disable a required business workflow without its responsible team.

Look for missing or unexpected mail in the relevant folders without clearing evidence. Tell the provider promptly if messages appear deleted or redirected; recovery options and retention can be limited. A corrected rule stops that configured behaviour going forward but does not recall information already copied, read or forwarded.

With the provider or responsible team, identify important accounts that use this email for password resets, sign-in or recovery. Prioritise financial, work, government and other sensitive access relevant to you. Review affected security/activity through those services’ genuine routes, including any single-sign-on relationships. Do not share passwords with a helper or assume changing the mailbox password also changes every linked service.

Tell the responsible organisation about exposed business/customer records. If someone has impersonated you or sent harmful requests, warn affected contacts through a known safe channel, explaining what to ignore without circulating the live attachment or private evidence. Check changed payment instructions independently with the relevant parties. A warning does not replace the bank’s or provider’s action.

Keep suspected device exposure separate. Use the malware-response checks and trusted support when a file, extension or remote-control tool may be involved; do not assume a clean scan reverses stolen credentials or information. Keep follow-up identity, payment and incident references private and monitor as the responsible services recommend.

Through the genuine provider, confirm your own sign-in and recovery methods, reviewed active access and intended mail settings. When appropriate, test ordinary sending and receipt with a trusted contact using harmless content. Check that mail is not unexpectedly redirected and that essential legitimate apps still work.

Reconnect authorised mail apps only through their supported sign-in. A Telstra/BigPond password change can require an existing mail app to authenticate again; do not weaken account security, enable legacy access or delete its only local mail store to fix a prompt. Keep records/archives intact and use provider/app guidance if the supported connection fails.

If legitimate use and the required response actions are verified, stop repeated setting changes and continue the agreed monitoring/follow-up. Unexpected rules, sign-ins or messages returning need provider/incident escalation. No short quiet period, working inbox or scan can certify that information was never accessed. Keep remaining financial, identity and workplace actions open until their responsible parties resolve them.

Contact the genuine provider if recovery access is unavailable, settings cannot be secured, messages are missing or unauthorised activity returns. A work/school account needs its administrator and incident process. Keep the account identity, dates, observations and actions available privately; do not provide passwords or codes to an unsolicited caller or public help post.

Bank/card and identity exposure need their relevant services promptly, even if email recovery is incomplete. Preserve device evidence and legitimate access while a supported plan is agreed. Be cautious of paid recovery guarantees or someone asking to install remote software before explaining who they are and what access is needed.

Our remote IT support can help assess the mail/device problem and coordinate appropriate next steps when access is authorised. It does not bypass provider ownership checks, guarantee recovery or certify that no information was taken.