Answers

What should you do if your business email account is hacked?

Ascent Vision · Published October 25, 2026

Lock the account down first: change the password, sign out devices you do not recognize, turn on two-step sign-in, and remove forwarding rules and filters you did not set up; Google's and Microsoft's guides cover these steps. Then warn customers and suppliers, especially if invoices or payment details may have gone out from your account, call your bank at once if money moved, and report the crime to the FBI's Internet Crime Complaint Center.

Signs your business email has been taken over

Microsoft's guide to a compromised Microsoft 365 mailbox lists signs that include:

• The mailbox is blocked from sending email.
• Rules that automatically forward email to unknown addresses, or recently added external forwarding.
• Suspicious messages in Sent Items or Deleted Items.
• Frequent password changes or unexplained account lockouts.

The first hour

• If you cannot sign in, Google says to use its account recovery page, for example when someone changed your password or recovery phone number.
• Change the password. Google says that if you think someone else is signed in, change it immediately, along with the password for any other account where you used the same one.
• Review recent security events, then check signed-in devices and remove any you do not recognize, as Google's steps describe.
• Remove any labels, filters or forwarding rules you didn't set up; Google lists this for Gmail.
• Turn on two-step sign-in. Google says it means that "if your password is stolen, your account is still secure".
• If someone else runs your email, such as an admin for Google Workspace or Microsoft 365, call them now. Microsoft's guide says not to send the new password to the user by email, because the attacker could have access to the mailbox.

Warn the people who may be fooled

Microsoft's guide says attackers often use a compromised mailbox to send to recipients inside and outside the organization, and calls business email compromise a "prolific type of attack". As general advice, tell customers, suppliers and your bookkeeper that your account was taken over, and point them to the call-back rule in the related answer on spotting a fake invoice.

Report it

If money moved, call your bank first. Google's steps also say to contact your bank or local authorities to make sure no one gave them instructions, such as to transfer money, especially if banking or personal details were saved in the account or you think someone is impersonating you.

The FBI's Internet Crime Complaint Center (IC3) calls itself the central hub for reporting cyber-enabled crime and asks people to file a report even if unsure whether a complaint qualifies. It says it cannot respond directly to every submission.

Make it harder next time

As general advice: two-step sign-in on every mailbox, a separate login for each person, a unique password for each account, and at least two people who can get into the admin account. The related answer on Google Workspace or Microsoft 365 covers keeping the account in the business's name with a second admin.

Sources

1. Google Account Help, "Secure a hacked or compromised Google Account"
2. Microsoft Learn, "Respond to a compromised email account in Microsoft 365" (last updated July 17, 2026)
3. FBI Internet Crime Complaint Center (IC3), home page

Related answers

• How do you spot a fake invoice or a payment-change email?
• Google Workspace or Microsoft 365: which should a small business use for email?
• How can you tell if your business website has been hacked, and what do you do first?