Hacked email · What to do next
What To Do If My Business Email Was Hacked
Act now, even if you're not sure. Change the password from a different device, sign the account out everywhere, and check for inbox rules and forwarding the attacker may have added. Then warn anyone who may have received fraudulent messages, especially about payments.
By SupportMax · Updated October 13, 2026
Do this right now
1
Change the password from another device
2
Sign the account out everywhere
3
Warn clients and staff about payment requests
SupportMax: 310.331.8119 · Mon–Fri, 9–6 Pacific.
Plain-English guidance
Based in West Los Angeles
Help for clients and non-clients
One accountable team
Signs
How do you know your business email was hacked?
These are common signs. Any one of them is worth acting on.
01
Messages you didn't send
Clients or coworkers receive emails from your account that you never wrote, often about invoices or payments.
02
New inbox rules or forwarding
Rules that move, delete, or forward messages appear without anyone on your team creating them.
03
Unfamiliar sign-ins
Sign-in alerts from places or devices you don't recognize, or multi-factor authentication prompts you didn't start.
04
Missing emails
Replies, invoices, or alerts disappear, sometimes because a rule is hiding them from you.
Step by step
The first steps after a business email account is hacked
Work through these in order. They are safe whether or not you have an IT provider.
Call 310.331.81191. Lock the account
From a different, trusted device, change the password and sign the account out of all sessions.
2. Remove what the attacker added
Check for inbox rules, forwarding addresses, and connected apps you don't recognize, and remove them.
3. Check multi-factor authentication
If it was off, turn it on. If it was on, check whether the attacker registered their own sign-in method.
The next 24 hours
What to check after you regain control
A hacked mailbox is often used to trick others. These checks limit the damage.
Money
Payments
Confirm recent payment-change requests by phone
Contact your bank right away if money was sent
Review invoices sent from the account
Warn vendors to verify payment details
People
Contacts
Tell staff not to act on recent emails from the account
Warn clients who may have received fraudulent messages
Check whether other accounts used the same password
Keep a record of what happened and when
Systems
Your accounts
Review sign-in history for other accounts
Check Microsoft 365 security settings
Confirm backups of email and files
Plan training so staff spot the next attempt
Report business email compromise to the FBI's Internet Crime Complaint Center (IC3), and see Microsoft's guide to responding to a compromised email account.
If money was sent
What if money was already sent to a fraudster?
Call your bank right away and ask them to try to stop or recall the transfer, then report it to the FBI's IC3. Speed matters, because the bank has a better chance of stopping a transfer the sooner it is told. Also notify your cyber insurer and attorney. If an employee clicked a phishing email first, see what to do after a phishing click.
Incident response →How SupportMax helps
How SupportMax helps after an email account is hacked
01
Lock
We secure the account, reset passwords, and sign out every session.
02
Clean up
We remove malicious rules, forwarding, and unknown sign-in methods.
03
Check
We review sign-ins and other accounts for signs the problem spread.
04
Protect
We strengthen multi-factor authentication, email filtering, and staff training.
Working with SupportMax
One accountable team, clear next steps
Calm, plain-English help after an email account is hacked
Call during business hours, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We help clients and non-clients lock down the account and limit the damage.
Questions
Business email hacked: common questions
Have a question that isn't here? Call 310.331.8119 or schedule a free consultation.
How did the attacker get into our email?
Usually through a phishing email that captured a password, a password reused from another site, or a sign-in prompt someone approved. Multi-factor authentication makes each of these much harder.
Is changing the password enough?
No. Also sign the account out everywhere and remove any inbox rules, forwarding, and sign-in methods the attacker added, or they may keep access.
Should we tell our clients?
If your account may have sent them fraudulent messages, warn them, especially about payment changes. Talk to your attorney about any formal notification obligations.
What is business email compromise?
It's when an attacker uses a real or look-alike business email account to request payments, change bank details, or steal information.
Can you tell what the attacker saw?
Sign-in and mailbox activity records can show some of what happened. We review what is available, and a forensic firm may be needed for a full investigation.
Can SupportMax help if we're not a client?
Yes. Call 310.331.8119 during business hours, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific.
Think your business email was hacked?
Call 310.331.8119, Monday–Friday, 9:00 a.m.–6:00 p.m. Pacific. We'll help you lock down the account and limit the damage, in plain English. Looking for general IT support in Los Angeles? Start there.
Prefer to call? 310.331.8119 · Mon–Fri, 9–6