My parent's email was hacked. What to do

Signs it really was hacked

If the contacts' emails came from a slightly different address, the account may have been spoofed rather than hacked. Still change the password, just in case.

• Friends got emails your parent didn't send, often asking for money or gift cards.
• Your parent can't sign in, or got an alert about a password change they didn't make.
• Sign-in alerts from devices or places they don't recognize.
• Messages are missing, or the Sent folder has emails they didn't write.

Gmail: get back in

1. Use Google's recovery page

   Go to accounts.google.com/signin/recovery and answer the questions as best you can. Google says there's no limit to how many times you can try.

2. Do it with your parent, on their usual device

   Recovery asks questions only the owner can answer. Sit with them rather than doing it for them.

3. Don't pay for help

   Google says it can't help you sign in by phone and doesn't work with third-party recovery services. Anyone offering to recover the account for a fee is likely another scammer.

4. Set a new, strong password

   One they've never used before. A password manager or a written note kept at home is fine.

Gmail: close the hacker's back doors

This is the step most people miss. Google's own checklist for a compromised account covers all of these.

1. Review security events

   In the Google Account, open Security & sign-in, then Recent security events. Mark anything your parent didn't do as "No, it wasn't me."

2. Sign out unknown devices

   Under Your devices, choose Manage devices. For anything unfamiliar, select Don't recognize a device? and follow the prompts.

3. Fix recovery phone and email

   Make sure the recovery phone and recovery email are your parent's, or yours if they want you as a backup. Hackers swap these to lock people out again.

4. Remove unknown apps

   Use Review apps with access and remove anything you don't recognize.

5. Check Gmail settings

   In Gmail settings, look at Automatic mail forwarding, Filters, Mail delegation, Vacation responder, and POP or IMAP access. Delete anything your parent didn't set up. A hidden forwarding rule can send a copy of every email to the hacker.

6. Turn on 2-Step Verification

   Then remind your parent: never read a Google code to anyone who calls.

Warn their contacts

The FTC suggests telling friends and family so they don't click links or answer urgent requests for money.

What was in the inbox?

A hacker may have read old emails. Search the inbox together for these and act on what you find:

• Bank or card statements: Call those banks and ask for fraud notes on the accounts. See I gave a scammer my bank account information.
• Tax documents, Social Security letters, or scans of IDs: Freeze credit at all three bureaus. See I gave a scammer my Social Security number.
• Password reset emails from other sites: Change those passwords too, starting with any that used the same password.
• Medicare or insurance emails: See I gave a scammer my Medicare number.

How the hacker probably got in

Most often it's a phishing email or text that led to a fake sign-in page, or a reused password exposed in a data breach. Talk about it without blame. "These fake pages fool everyone" keeps the door open for next time.

OwlGuardian works with Gmail. It scans incoming mail and quarantines likely phishing before your parent sees it, and you get a plain-English alert as their Trusted Contact. It won't recover a hacked account, but it helps stop the email that starts the next one.

Report it

• If money was stolen or asked for: ReportFraud.ftc.gov, and ic3.gov for online losses.
• If personal information was misused: IdentityTheft.gov.
• If your parent is 60 or older: the National Elder Fraud Hotline at 1-833-372-8311 can help with reporting.

Questions people ask