How to Recover a Hacked Business Email Account in 7 Steps

If you need to recover a hacked business email account, act in this order: cut off the attacker, take back the login, remove what they left behind, then warn people. I put this guide together from Microsoft's compromised-account guide and the FBI's business email compromise page, both read on 2026-11-07. It is general information, not legal or insurance advice.

Quick answer

• Block the account first (disable it, or reset the password from a clean device).
• Sign the attacker out of every session and turn on multi-factor authentication (MFA).
• Delete forwarding rules, inbox rules, and unknown app permissions they added.
• Check for fake payment requests sent from your account. Call your bank fast if money moved.
• Tell customers and staff. Report money fraud at ic3.gov.

How do you know the account is hacked?

Microsoft lists common signs for a hacked Microsoft 365 mailbox. I use them as a checklist because they apply to most business email.

• Mail is missing or deleted.
• Inbox rules you never made, such as forwarding to unknown addresses or moving mail to Junk or RSS folders.
• Sent Items or Deleted Items hold odd messages, like "I'm stuck in London, send money."
• Unexplained lockouts or frequent password changes.
• A new external forwarding address.
• A strange signature you did not write.

One sign is enough. Do not wait for proof.

Step 1. Lock the attacker out

Move fast. Microsoft says to block access as soon as possible, and that disabling the account is preferred until the investigation is done. If you cannot disable it, reset the password.

Use a strong, unique password. Do not email the new password to the user, because the attacker may still be reading that mailbox. Do not reuse any recent password.

Use a device you trust. If the attacker's malware is on your laptop, a new password will not help.

Step 2. Sign out every session

A password change alone may not kick the attacker out. Microsoft's guide includes a "revoke user access" step for this reason. Most business email suites have a similar sign-out option in the admin console. I did not verify other providers' exact menu names, so check your provider's admin help.

Step 3. Check your MFA devices

Attackers sometimes add their own phone or authenticator. Microsoft tells admins to review the MFA devices registered to the user. Remove any you do not recognize. Then turn on MFA if it was off.

Step 4. Remove what the attacker left behind

This is the step people skip. It is also why hacked accounts get hacked twice.

• Forwarding. Remove any forwarder you did not set up.
• Inbox rules. Delete rules that forward, hide, or delete mail.
• App permissions. Revoke apps the user never approved. Microsoft lists reviewing apps with user consent as its own step.
• Admin roles. Remove any role the user should not have.

Where to look	What you are hunting for
Inbox rules	Forward, move, or delete rules
Mailbox forwarding	An outside address you do not know
Connected apps	Unfamiliar apps with mail access
MFA methods	A phone or app you did not add

Step 5. Look for fake requests sent from your account

The FBI calls this business email compromise (BEC). Criminals send a message that looks like it came from someone you know, such as a vendor with a new mailing address or a boss asking for gift cards. The FBI says victims have lost thousands, sometimes hundreds of thousands of dollars.

Read the Sent Items and Deleted Items folders. Look for invoices, payment changes, and wire requests.

Step 6. If money moved, call your bank now

The FBI says to contact your financial institution immediately and ask it to contact the institution that received the transfer. Then report the scam at ic3.gov. Time matters here, so do this before cleaning up anything else.

Step 7. Warn the right people

Tell your team, customers, and vendors that the account was hacked. Say plainly which messages to ignore. Ask them to confirm any bank change by phone, using a number you already had.

If clients get files through email links, review those too. Our guides on building a customer portal without developers and automating client onboarding show ways to keep client access off personal inboxes.

What if you cannot log in at all?

• You have an admin. Ask them to reset your password and sign-in methods.
• You are the admin. Use your provider's account recovery for admins.
• You bought through a reseller. Contact the reseller or your IT provider.

Expect to prove who you are. Support teams may ask for domain ownership proof or billing details.

Common mistakes

• Changing the password but leaving the forwarding rule in place.
• Resetting from an infected computer.
• Telling the team by email from the hacked account.
• Waiting a day to call the bank.

How to lower the risk next time

• Turn on MFA for every mailbox, starting with admins and finance.
• Check forwarding rules every few months.
• Confirm payment changes by phone. The FBI's page treats fake payment requests as the core BEC risk.
• Give each person their own login. Shared mailboxes make it hard to see who did what.

FAQ

Can I recover a hacked business email account myself?

Often yes, if you can still reach your admin console or the provider's recovery page. If the attacker changed your recovery options, you will need your provider or admin.

What should I do first if my business email was hacked?

Cut off access. Disable the account or reset the password from a clean device, then sign out all sessions. Do this before anything else.

How do I know if a hacker is still in my email?

Check for inbox rules, forwarding addresses, unknown app permissions, and MFA methods you did not add. Any of these can let an attacker back in after a password reset.

Do I need to report a hacked business email account?

If money was sent to a scammer, the FBI says to contact your bank right away and report at ic3.gov. Other reporting duties depend on your state, industry, and contracts, so ask a qualified professional.

Sources

• Microsoft Learn, Respond to a compromised cloud email account (read 2026-11-07)
• FBI, Business Email Compromise (read 2026-11-07)

I did not test these steps myself. Menus change, so follow your own provider's current help pages.

Last updated: November 7, 2026