Interactive checklist
Email hacked? A free Canadian checklist
If your email has been hacked, do these in order: change the password from a device you trust, sign out every other session, turn on two-step verification, then look for forwarding rules you did not set up. After that, call your bank, ask Equifax and TransUnion for a fraud alert, and report it to the Canadian Anti-Fraud Centre. The checklist below keeps your place.
If you can't sign in at all
Use the "Forgot password" link on your email provider's own sign-in page and follow its account recovery steps. Use a phone or computer you have signed in from before, if you can. Then come back and start the checklist from the top.
Don't pay anyone who says they can get it back for you, and never give a stranger a password or a code.
The checklist
Tick each step as you go. Your ticks are saved on this device, so you can close the page and come back. You can print it and work from paper.
1. Secure the email account
Do this first, from a phone or computer you trust. If you think that device is infected, use someone else's for now.
2. Change passwords elsewhere
Anything that sends its reset link to this email can be taken over from it.
3. Protect your money
4. Check your government accounts
Only if you use them. Sign in by typing the address yourself.
5. Ask the credit bureaus for a fraud alert
You have to contact each one separately. A fraud alert is free.
6. Report it
7. Tell your contacts
8. Watch for follow-up scams
This part goes on for a few weeks.
What the hacker may already have
Old emails can hold more than you think: bank statements, reset links for other accounts, scans of ID and messages from family. That is why the checklist goes beyond the email itself. You don't need to do everything today, but the first section and your bank call are the ones that matter most.
If money has already been sent, call your bank first, then the Canadian Anti-Fraud Centre on 1-888-495-8501.
Common questions
Should I change my password or sign out other devices first?
Change the password first, from a device you trust. Then sign out all other sessions so anyone still logged in is kicked out. Do both in the same sitting.
Do I need a fraud alert if only my email was hacked?
It is worth asking for one if your email held banking messages, ID numbers or scans, or if you are not sure what the hacker saw. A fraud alert is free, and you have to ask Equifax Canada and TransUnion Canada separately.
How do I know if the hacker set up forwarding?
Open your email settings and look for forwarding addresses, filters or rules, and for delegated access or connected apps. Delete any you did not set up. Hackers often use them to keep reading your mail after you change the password.
Do I have to report a hacked email to the police?
Reporting to the Canadian Anti-Fraud Centre and to your local police is recommended. A police report number can be useful if a bank or credit bureau asks for one. Use your local police non-emergency line, not 911, unless someone is in danger.
Should I pay someone to get my account back?
No. Use the recovery steps on your email provider's own sign-in page. Anyone who asks for payment, a password or a login code to get an account back is running a second scam.
Sources
- Report cybercrime and fraud, National Cybercrime and Fraud Reporting System
- How to report fraud and scams in Canada, Competition Bureau of Canada
- Contact us, Equifax Canada
- Fraud victims resources, TransUnion Canada
- Ask a consumer reporting agency to issue a fraud alert, Steps to Justice
- SIN fraud and data breaches, Service Canada
- My Account for individuals, Canada Revenue Agency
Want a second pair of eyes on your accounts?
If you would rather not do this alone, I can secure your devices and accounts with you, check for signs of access and hand you a written list of who to notify. It is a flat C$179.