Business email hacked? The first steps

If you think your business email has been hacked, change the password from a device you trust, sign the account out of every other device, and then look for the two things intruders leave behind: a forwarding setting and hidden filters. Turn on two-step sign-in before you do anything else in the account. Then warn your customers, because the real damage from a hacked business mailbox is usually a fake invoice sent in your name. All of this takes about an hour, and the order matters.

Signs that someone else is in your mailbox

Not every strange email means a hack. Spammers can fake your address on mail they send without ever touching your account. These are the signs that someone is actually inside:

A customer asks about an invoice or "new bank details" you never sent.
Your Sent folder has messages you did not write, or messages you did write are missing from it.
Replies arrive to emails you never sent, or bounce-backs from hundreds of addresses you do not know.
Mail you expect never arrives, especially from customers or your bank. It may be going elsewhere.
Your provider warns you about a sign-in from a new device or another country.
Your password stopped working, and you did not change it.

If a customer is the one who noticed, ask them to forward the suspicious message to you, without clicking anything in it.

The first hour, in order

Do these steps on a computer you trust, not one you suspect.

1. Change the password

Sign in at gmail.com for Google Workspace, at outlook.com or office.com for Microsoft 365, or at your provider's webmail. Change the password to a long one you have never used anywhere, three or four unrelated words together works well. If you cannot sign in, use the provider's account recovery right away; for a business account, the person with admin rights can reset it for you.

If you used the same password for other things, such as your bank, your domain registrar or your website, change those too, starting with the money.

2. Sign out every other device

A new password does not always throw out someone already signed in.

Google: in your Google Account, open Security, find your devices, click Manage all devices and sign out of every device you do not recognize, or all of them except the one you are using. A Workspace admin can also sign the user out from the Admin console.
Microsoft 365: a Microsoft 365 admin can open the user in the admin center and choose to sign them out of all sessions. Your own account's security page also lists recent sign-ins.

You will need to sign in again on your own phone afterward. That is expected.

3. Check forwarding

Intruders often set your mail to be quietly copied to them, so they keep reading after you change the password.

Gmail: click the Settings gear, then See all settings, then the Forwarding and POP/IMAP tab. If mail is forwarded to an address you do not know, remove it and save.
Outlook on the web: open Settings, then Mail, then Forwarding. Turn off anything you did not set.

4. Check filters and rules

This is the step most people skip. A hidden rule can move every message containing "invoice" or "payment" to the trash or an obscure folder, so you never see the customer asking why you changed banks.

Gmail: in See all settings, open Filters and Blocked Addresses. Delete any filter you did not make, especially ones that forward, delete, or mark mail as read.
Outlook on the web: in Settings, then Mail, open Rules. Delete any rule you did not create.

While you are in Gmail settings, also look at the Accounts and Import tab for a "Send mail as" address or "Grant access to your account" entry you do not recognize, and at the General tab for a changed signature or an auto-reply.

Two-step sign-in means a password alone is no longer enough: a code or a prompt on your phone is needed too. It is the single change that stops most repeat break-ins. Turn it on for your own account first, then for everyone with a mailbox. Two-factor authentication for your domain and email shows the setup in plain steps.

Warn your customers about fake payment requests

Assume the intruder read your recent conversations and may already have sent someone a believable message: a real job, a real amount, and "please use our new bank account".

Make a short list of customers and suppliers you exchanged quotes, invoices or payment details with in the last few months.
Call the ones with open invoices. A phone call is harder to fake than an email.
Send everyone else a short note from your account, once it is secured. Something like: "Our email was accessed by someone else this week. We have not changed our bank details. If you get any message asking you to pay a different account, please call us at our usual number before paying."
Tell your bank if a customer may already have paid a fake account. The faster they hear, the better the chance of stopping the money.

If money was lost, report it at the FTC's site and to the FBI's Internet Crime Complaint Center, and keep copies of the fake messages. For anything involving customers' personal data, talk to your attorney about what you need to tell them.

How it usually happens

Knowing the cause helps you close the door behind you:

A fake sign-in page. An email that looks like it comes from Microsoft, Google or a shipping company asks you to "verify" your account. Phishing emails about your domain or website shows the common disguises.
A reused password from another site that was leaked.
A shared login. A former employee, a helper or an old web designer who still knows the password.
An old app or device that still has access, such as a tablet you sold.

After the first hour

Over the next few days:

Review who has admin rights on your email account and remove anyone who no longer needs them.
Check your domain registrar account too. The domain controls where your mail goes, and whoever takes over your mailbox can use it to reset other passwords. Keeping your website and domain logins safe has the checklist.
Give each person their own mailbox and password instead of one shared login.
Watch for bounced mail or a spam warning. If the intruder sent bulk mail, your messages may land in spam for a while; why your business emails go to spam explains how to check.

What to do this week

Change the password and sign out all other devices.
Remove unknown forwarding, filters, rules and "send mail as" addresses.
Turn on two-step sign-in for every mailbox.
Check your recovery phone and email.
Call customers with open invoices; email the rest a short warning.
Change any reused passwords, starting with the bank and the domain.
Make sure your website's contact form and listed address still reach the right inbox.

If your website shows an old address or was set up by someone you have lost touch with, you can see your site rebuilt first with the contact details you now control.