How Does Email Get Hacked? 7 Common Causes and How to Protect Your Account

Most email accounts aren’t broken into with clever technical tricks. Someone gets the password, or gets past the password, and then quietly uses the account. Below are the common ways that happens, the warning signs that your account is no longer only yours, and what to do about it.

The short version: use a unique password, turn on multi-factor authentication, and keep your recovery details current. That stops most of what follows.

1. Phishing

Phishing is still the most common route. You get a message that looks like it came from your email provider, a delivery company, your bank or your IT department. It links to a sign-in page that looks real but sends your password to the attacker. Newer phishing kits sit between you and the real site, so they can also capture a one-time code or the session cookie after you log in.

How to protect yourself: don’t sign in from links in messages. Go to the site directly or use a bookmark. Check the address bar before typing a password. A password manager helps here too, because it won’t autofill on a lookalike domain. For phishing that captures one-time codes, passkeys and hardware security keys are the strongest defense. See also common phishing emails and how to spot them.

2. Reused passwords and credential stuffing

When a website gets breached, its users’ email addresses and passwords often end up in large lists. Attackers feed those lists into automated tools that try each pair on email providers and other popular services. If you used the same password on a forum ten years ago and on your email today, that’s enough.

How to protect yourself: use a different password for your email than for anything else. Check whether your address appears in known breaches with a service such as Have I Been Pwned, and change any password that was reused.

3. Weak or guessable passwords

Short passwords, common words, pet names and birthdays can be guessed, especially if an attacker knows a little about you from social media.

How to protect yourself: use a long passphrase or a random password from a password manager. Length matters more than swapping letters for symbols.

4. Malware and keyloggers

Information-stealing malware collects saved browser passwords, session cookies and keystrokes, then sends them to the attacker. It usually comes from cracked software, fake updates, malicious extensions or email attachments. Stolen session cookies are a particular problem because they can let someone into an account without a password or a second factor.

How to protect yourself: keep your operating system and browser updated, install software only from official sources, and run reputable security software. If you think a device is infected, clean it before changing passwords, and change them from a different device. Our guide to detecting and removing keyloggers covers this in more detail.

5. Account recovery abuse and SIM swapping

Instead of attacking the password, some attackers go after the recovery process. That can mean guessing answers to security questions, or convincing a mobile carrier to move your phone number to their SIM card so they receive your reset codes by text.

How to protect yourself: remove security questions where you can, or use made-up answers stored in your password manager. Use an authenticator app, passkey or security key rather than SMS for your email account. Ask your carrier about a port-out PIN or account lock.

6. Unsafe public Wi-Fi and shared computers

Webmail services use HTTPS, so simply being on public Wi-Fi is far less risky than it used to be. The bigger risks are fake hotspots that push you to a phishing page, and public or shared computers where you forget to sign out or the machine itself is compromised.

How to protect yourself: avoid signing in to email on computers you don’t control. If you have to, use a private window and sign out at the end. Treat captive portals that ask for your email password as a red flag.

7. Third-party app access

Over the years you may have allowed apps, browser add-ons or old phones to access your mailbox. If one of those services is breached, or was malicious to begin with, it may still be able to read your mail.

How to protect yourself: review connected apps in your Google, Microsoft, Apple or Yahoo account settings and remove anything you no longer use.

Signs your email account has been compromised

• Sign-in alerts from places or devices you don’t recognize.
• Sent messages you didn’t write, or friends telling you they got strange emails from you.
• New forwarding rules or filters that send mail elsewhere or delete it automatically. Attackers set these up to hide their activity.
• Password reset emails from other services you didn’t request.
• Changed recovery phone number or backup email.
• You suddenly can’t log in with the right password.

What to do if your email was hacked

1. Secure your device first. If there’s any chance of malware, scan or use a different device.
2. Change the password to a new, unique one. If you’re locked out, use your provider’s official account recovery page.
3. Sign out of all sessions from the security settings page.
4. Check recovery details, forwarding rules, filters and connected apps, and remove anything you didn’t set up.
5. Turn on multi-factor authentication, preferably with an authenticator app, passkey or security key.
6. Change passwords on other accounts that use the same password or that could be reset through this email address, starting with banking.
7. Warn your contacts not to trust recent messages from you that asked for money, gift cards or logins.
8. For a work account, tell your IT or security team right away. Business email compromise is often used for invoice fraud.

A quick checklist

• Unique, long password stored in a password manager
• Multi-factor authentication on, not based on SMS if you can avoid it
• Recovery phone and email up to date
• No forwarding rules or connected apps you don’t recognize
• Operating system, browser and extensions updated

Set aside ten minutes to go through that list once. It covers almost every method on this page.

Joseph Ochieng

Joseph Ochieng’was born and raised in Kisumu, Kenya. He studied civil engineering as first degree and later on pursued bachelors in information technology from the technical university of Kenya. His educational background has given him the broad base from which to approach topics such as cybersecurity, civil and structural engineering. When he is not reading or writing about the various loopholes in cyber defense, the he is probably doing structural design or watching la Casa de Papel . You can connect with Joseph via twitter @engodundo or email him via [email protected] for email about new article releases”