Think Your Business Email Has Been Hacked? What to Do Right Now

If you think someone has got into your business email, act now: the first hour matters more than anything else. A hacked mailbox can be used to trick your customers into paying fake invoices, to reset your other passwords, or to quietly copy every email you receive.

This guide explains the warning signs, what to do first depending on whether you can still log in, and how to stop it happening again. Never share your password with anyone offering to help, including us.

Watch out for any of these:

• contacts receive strange emails from you that you didn’t send, often with links or attachments
• emails in your Sent folder that you don’t recognise, or your Sent folder suddenly empty
• alerts about sign-ins you don’t recognise, or a password that suddenly stops working
• replies going missing, or customers saying you never answered them
• your provider warning you about unusual activity

Hacked or spoofed? If people receive fake emails that appear to come from you, but there’s nothing in your Sent folder and no strange sign-ins, your email may be being spoofed rather than hacked. Scammers are faking your address from their own servers. That’s a different problem, fixed by setting up DMARC properly, and our guide to SPF, DKIM and DMARC explains how.

What to do next depends on one question: can you still get into the account? If you can, follow the steps below straight away. If you can’t, skip to “If you’re locked out”.

Wherever possible, do this on a different device from the one you normally use, in case that device has been compromised.

Work through these in order:

• Change your password to a new, strong one you haven’t used anywhere else.
• Sign out of every other device. Changing the password doesn’t always kick out someone already logged in. Google and Microsoft both let you sign out all sessions from your account security settings, and a Google Workspace or Microsoft 365 administrator can do this for any user.
• Turn on 2-step verification, so a password alone is no longer enough to get in.
• Check your recovery details. Make sure the recovery email address and phone number are yours. Attackers often change them so they can get back in later.
• Check forwarding and rules. This is the step most people miss. Attackers often set up a rule that quietly forwards your email to them, or hides certain messages. In Gmail, check “Filters and Blocked Addresses” and “Forwarding and POP/IMAP” in settings. In Outlook, check your rules and forwarding settings. Delete anything you didn’t create.
• Check connected apps and remove any you don’t recognise.

• Use your provider’s official account recovery — Google’s account recovery page, Microsoft’s account recovery form, or your email host’s support. Only use the provider’s own website.
• If your email is through Google Workspace or Microsoft 365, whoever manages the account (you, a colleague or your IT provider) can reset the password and sign out all sessions from the admin console.
• Beware of “account recovery” services advertised online or offered by strangers on social media. Many are scams.

Once you’re back in, go through every step in the section above.

The most expensive part of a hacked business mailbox is often what happens to your customers. Attackers read your emails, wait for an invoice to be due, then send a convincing message from your real account saying your bank details have changed. This is often called invoice fraud or business email compromise.

• Warn your customers and suppliers, especially anyone who’s due to pay you or be paid, that your email was compromised.
• Tell them you will never change your bank details by email, and that they should phone you on a number they already have if they’re ever asked to.
• Check your Sent folder to see who the attacker may have contacted.

Your email is the key to most of your other accounts, because password resets go there. Once your email is secure:

• change passwords on anything that used the same or a similar password
• check your bank, accounting software, domain registrar and website logins, and turn on 2-step verification where you can
• run a security scan on the computer or phone you use for email

• If you’ve lost money, contact your bank immediately.
• In England, Wales and Northern Ireland, report cyber crime and fraud to Report Fraud (the service that replaced Action Fraud) at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
• Forward any phishing emails you’ve received to the National Cyber Security Centre at report@phishing.gov.uk.
• If customers’ personal information may have been exposed, you may need to report it to the Information Commissioner’s Office (ICO), usually within 72 hours of finding out. The ICO website has a self-assessment tool to help you decide.

• Turn on 2-step verification for every email account. It stops the large majority of account takeovers.
• Use a password manager, so every account has its own strong password.
• Be wary of login pages reached from links in emails. Most hacked accounts start with a fake sign-in page. If in doubt, go to the website directly.
• Set up SPF, DKIM and DMARC properly, so scammers find it much harder to send email pretending to be you. Our guide on how to check your email is set up correctly shows you how to see where you stand.

If you’ve been through the steps above and everything looks clean, keep an eye on your account for the next few weeks, and tell your contacts to be cautious of any unexpected payment requests.

If you’re not sure you’ve caught everything, or you’re locked out and getting nowhere, we can help you secure the account, check for hidden forwarding and rules, and set up the protections that stop it happening again.

To make a repeat less likely, work through email security for small businesses.

Need help fixing this?

We provide:

• Free initial assessment
• Clear explanation of the issue
• Fixed-price solutions
• UK-based support

If you think your email has been hacked, get in touch and tell us it’s urgent. We’ll help you lock it down and put it right.