You signed in to check your inbox and something felt off. Maybe a friend mentioned strange messages they got from your address, or your security page is showing logins from places you have never been. A hijacked Yahoo Mail account is unsettling because it often holds the keys to your other logins, your contacts, and years of personal correspondence.
The good news is that you can take back control if you move quickly and work through the right sequence of fixes. When you reset credentials, use a random password generator rather than inventing a variation of the old password. Random passwords generated locally in the browser are far harder to crack or guess.
This guide walks you through confirming the breach, locking the intruder out, undoing the changes they made, and hardening the account so it does not happen again. Work through the steps in order, since each one builds on the last.
Telltale Signs Your Account Was Compromised
Before you start changing settings, make sure you are actually dealing with a hack and not a temporary glitch. A handful of warning signs can indicate that an account has been taken over.
You are not receiving any emails. Your Yahoo Mail is sending spam to your contacts. You see logins from unexpected locations on your security page. An unfamiliar location can also result from incorrect device location detection or your internet provider using a proxy server. Your account info or mail settings were changed without your knowledge.
If one or more of these apply to you, treat the account as compromised and move straight into the steps below. Acting on the assumption of a breach is far safer than waiting to be certain.
Fix 1: Change Your Password Right Away
Your first move is to secure the account by setting a new password. While you are signed in, head to the Yahoo Account security page at login.yahoo.com/account/security. This is the central hub for everything related to securing your account.
- 1.Under "Ways of signing in," click Password.
- 2.Click Continue.
- 3.Follow the on-screen prompts to set a new password.
If you have Account Key enabled, you need to disable it before you can set a new password. Change your password immediately, so do not skip this step.
Fix 2: Reset Your Password If You Are Locked Out
Sometimes the attacker changes your password before you do, leaving you shut out entirely. In that case, you cannot sign in to reach the security page, so you will use Yahoo's Sign-in Helper instead.
Go to login.yahoo.com/forgot to start the recovery flow. Enter your recovery email address or click Use recovery phone number. Click Next. Follow the on-screen instructions to regain access.
Once you are back in, return to Fix 1 and set a strong new password before continuing with the rest of this list.
Fix 3: Delete App Passwords You Do Not Recognize
App passwords are a sneaky way for an intruder to keep access even after you reset your main password. That is because app passwords can stay active even when the primary password changes, so you have to revoke them by hand.
On the Yahoo Account security page, under "External connections," click the app passwords. Click Delete next to any app password you do not recognize, then click Delete to confirm. Review the full list carefully before you finish here.
Fix 4: Find and Remove Unusual Account Activity
Next, you want to see exactly who and what is connected to your account so you can boot out anything suspicious. The security page lets you review where the account is signed in, which third-party apps are connected, and the most recent changes made to the account.
Work through each of these areas. Under "Current sign-ins," click any device you do not recognize, then click Sign out. Under "External connections," click App passwords, select any app you did not authorize, and select Delete app password.
Fix 5: Update Your Recovery Email and Phone Number
Attackers often swap in their own recovery details so they can quietly reclaim the account later. Confirm your recovery options are current, and give this step real attention.
On the Yahoo Account security page, under "Ways of signing in," add a recovery email or phone number that you control. Then remove any recovery email or phone number you do not recognize, confirming each removal as you go. Make sure the only recovery methods left are ones that belong to you.
Fix 6: Turn On Two-Step Verification
Two-step verification is your strongest defense against a repeat takeover, since it requires a code in addition to your password whenever you sign in from a new device or browser. Even if someone learns your password again, they cannot get in without that second factor.
Sign in to your Account security page, then under "Ways of signing in," click 2-step verification. Choose a verification method: Push notification, Your phone number, or Authenticator app. Follow the on-screen prompts for your chosen method. To see Authenticator app, you need at least two recovery methods on your account.
If you currently use Yahoo Account Key, you need to disable it first so you can enable two-step verification. If the option is missing, make sure you have created a password.
Fix 7: Reverse the Mail Settings an Attacker May Have Changed
Once someone has access, they often quietly alter your mail settings to keep intercepting messages or impersonating you. Check the commonly changed settings and revert anything you did not set yourself.
Check email filters. Check the sending name. Check the email signature. Check the reply-to address.
Check the send-only address. Check the vacation response. Check the default sending address. Check blocked addresses.
Check the auto-forwarding address. Go through each one and restore it to what you expect. Unfamiliar filters and a changed reply-to address are especially common tricks, so do not rush this review.
Fix 8: Shut Down Unauthorized Auto-Forwarding
Auto-forwarding deserves its own step because it lets an intruder keep reading your incoming mail long after you have changed your password. Open your Yahoo Mail settings and look for the forwarding section under your mailbox options.
If you find a forwarding address you did not set up, remove it and save your changes. A forwarding entry you do not recognize is a strong red flag, so do not assume it is harmless. Removing it closes off one of the quietest ways an attacker can keep watching your inbox.
Habits That Keep Your Account Locked Down
Securing the account once is good, but staying secure is what keeps the hacker from coming back. These ongoing best practices are worth building into your routine.
Use a strong, unique password and change it regularly. Keep a current, secure recovery email and mobile number on file. Make sure antivirus software is installed and kept updated. Always sign out when using shared or public computers.
Avoid clicking uncertain links, even when they come from friends. One rule is worth committing to memory: Yahoo never asks for your password in emails or phone calls. Any message that does is a scam, full stop. If you still cannot regain access after working through these steps, turn to Yahoo's official help resources for further assistance.
Frequently Asked Questions
How do I know for sure my Yahoo Mail was hacked?
Look for Yahoo's listed warning signs: you stop receiving emails, your account sends spam to your contacts, your security page shows logins from unexpected locations, or your account info and mail settings were changed without your knowledge. An unfamiliar location can also result from incorrect device location detection or your internet provider using a proxy server. If you suspect unauthorized access, secure the account using the steps above.
Why do I need to delete app passwords after changing my main password?
App passwords can stay active even after you change your main password, so changing your password alone does not always revoke them. To fully cut off access, open the Yahoo Account security page, go to the section for managing app passwords, and delete any app password you do not recognize.
What should I do if I cannot sign in at all?
Use the Sign-in Helper at login.yahoo.com/forgot. Enter your recovery email or recovery phone number, continue to the next screen, and follow the instructions to regain access. Once you are back in, change your password and continue securing the account.
Will two-step verification stop a future hack?
Two-step verification adds a strong layer of protection because it requires a code in addition to your password whenever you sign in from a new device or browser. Even if someone obtains your password again, they cannot sign in without that second code. If you use Yahoo Account Key, you need to disable it first to enable two-step verification.
Should I check for auto-forwarding even after changing my password?
Yes. Auto-forwarding can let an intruder keep reading your incoming mail long after a password change, so open your Yahoo Mail settings and review the forwarding section. If you find a forwarding address you did not set up yourself, remove it and save your changes.