What to Do if an Email Account Is Compromised Print

A compromised email account can be used to send spam, steal data, reset passwords or impersonate your business. It should be treated as urgent.

Signs of compromise

• Unexpected sent messages.
• Customers receive strange emails from your address.
• Mailbox password suddenly stops working.
• Forwarders or filters appear that you did not create.
• Mail delivery reputation drops.
• You receive bouncebacks for emails you did not send.

Immediate steps

1. Change the mailbox password.
2. Check for unknown forwarders or filters.
3. Check devices connected to the mailbox.
4. Scan computers for malware.
5. Review other accounts that use this email for password resets.
6. Contact support so mail logs can be checked.

After securing the account

Email reputation may take time to recover if spam was sent. SPF, DKIM and DMARC should be reviewed, and compromised devices must be cleaned before reconnecting.

Need help?

Open a support ticket directly from within your GetHosting.online customer account. Phone support is also welcome on (+44) 01457 337 247. For international contact numbers, please see our contact page.

GETHOSTING.ONLINE is a subsidiary of GetUK Support.