--- title: "Email hacked? A free Canadian checklist ยท Jeyki Security" description: "Step-by-step checklist for a hacked email account in Canada: secure it, protect your money, call credit bureaus, report it. Free and printable." url: "https://jeyki.ca/guides/email-hacked-canadian-checklist" --- 1. [Home](https://jeyki.ca/) 2. [Guides](https://jeyki.ca/guides) 3. Email hacked? A free Canadian checklist Interactive checklist # Email hacked? A free Canadian checklist If your email has been hacked, do these in order: change the password from a device you trust, sign out every other session, turn on two-step verification, then look for forwarding rules you did not set up. After that, call your bank, ask Equifax and TransUnion for a fraud alert, and report it to the Canadian Anti-Fraud Centre. The checklist below keeps your place. Last reviewed September 28, 2026. Written by Jeyki Security, free to use and print. [Email this to a parent](mailto:?subject=Email%20hacked%3F%20A%20free%20Canadian%20checklist&body=Hi%2C%20I%20thought%20this%20free%20guide%20would%20help%20you%3A%0A%0AEmail%20hacked%3F%20A%20free%20Canadian%20checklist%0Ahttps%3A%2F%2Fjeyki.ca%2Fguides%2Femail-hacked-canadian-checklist%0A%0AIt%20is%20written%20for%20people%20in%20Canada%20and%20takes%20a%20few%20minutes.)Share or copy linkPrint this guide ## If you can't sign in at all Use the "Forgot password" link on your email provider's own sign-in page and follow its account recovery steps. Use a phone or computer you have signed in from before, if you can. Then come back and start the checklist from the top. Don't pay anyone who says they can get it back for you, and never give a stranger a password or a code. ## The checklist Tick each step as you go. Your ticks are saved on this device, so you can close the page and come back. You can print it and work from paper. Print checklistStart over Your ticks are saved in this browser only. Nothing is sent anywhere. ### 1 1\. Secure the email account Do this first, from a phone or computer you trust. If you think that device is infected, use someone else's for now. - Change the password. Make it long and different from every other password you use. A password manager can make and remember it. - Sign out every other session and device. Look for "where you're signed in", "your devices" or "sign out everywhere" in the account's security settings. - Turn on two-step verification. An authenticator app or a passkey is stronger than a text message code. Never read a code out to anyone who contacts you. - Check the recovery phone number and recovery email. Remove any you do not recognise. Hackers add their own so they can get back in. - Look for forwarding, filters and rules. Delete any that forward mail to another address, or that hide, move or delete messages you did not set up. Also check for delegated access and connected apps. - Read your sent and deleted folders. Note what the hacker sent and which messages they deleted. This tells you who to warn and what they may have seen. - Update your phone or computer and run a security scan. Do this if you clicked a link or installed something before the hack. ### 2 2\. Change passwords elsewhere Anything that sends its reset link to this email can be taken over from it. - Change the password on any account that used the same password as your email. - Change your online banking and credit card passwords first, then shopping, cloud storage and other email accounts. Sign in to each site yourself by typing its address. Do not follow links in emails. - Check your Apple or Google account and your phone company account. Look at the recent sign-ins and connected devices. ### 3 3\. Protect your money - Call your bank and credit card companies. Use the number on the back of your card. Tell them your email was hacked and ask what they recommend. - Go through recent transactions and report any you do not recognise. - Check your Interac e-Transfer settings and contacts in your banking app. Remove recipients you do not recognise and review your auto-deposit settings. - Ask about a replacement card if card numbers were in your email. ### 4 4\. Check your government accounts Only if you use them. Sign in by typing the address yourself. - Sign in to your CRA My Account and look for changes you did not make. Check your address, phone number and direct deposit details. If you cannot sign in or something has changed, call the CRA on 1-800-959-8281. [CRA My Account](https://www.canada.ca/en/revenue-agency/services/e-services/digital-services-individuals/account-individuals.html) - Sign in to your My Service Canada Account and look for records you do not recognise. If your Social Insurance Number was in the email, call Service Canada on 1-800-O-Canada (1-800-622-6232). [Service Canada: SIN fraud and data breaches](https://www.canada.ca/en/employment-social-development/services/sin/fraud-data-breaches.html) - Change the password for your GCKey or the bank sign-in you use for government services. Do this if it matches or is similar to your email password. - Note which ID scans were stored in your email. If a passport, driver's licence or health card scan was in there, contact the office that issued it and ask what they recommend. ### 5 5\. Ask the credit bureaus for a fraud alert You have to contact each one separately. A fraud alert is free. - Contact Equifax Canada on 1-800-465-7166 and ask for a fraud alert. [Equifax Canada contact page](https://www.equifax.ca/personal/contact-us/) - Contact TransUnion Canada on 1-800-663-9980 and ask for a fraud alert. [TransUnion Canada fraud victims resources](https://www.transunion.ca/assistance/fraud-victims-resources) - Ask each bureau for your credit report and read it for accounts or enquiries you do not recognise. ### 6 6\. Report it - Report to the Canadian Anti-Fraud Centre online, or by phone on 1-888-495-8501. [reportcyberandfraud.canada.ca](https://reportcyberandfraud.canada.ca) - Call your local police non-emergency line and ask for a report number. A bank or credit bureau may ask for it. Do not use 911 unless someone is in danger. - Keep a note of the dates, what you did and any report or reference numbers. Write them on this page or on paper. ### 7 7\. Tell your contacts - Warn the people in your address book from a different channel, such as a text. Tell them your email was hacked and not to open links or attachments from it, or send money. - If you used this email for a club, school or volunteer group, tell them too. ### 8 8\. Watch for follow-up scams This part goes on for a few weeks. - Ignore password reset emails and codes you did not ask for, and tell nobody the code. They mean someone is still trying. - Ignore anyone who offers to get your account back for a fee. Use only the recovery steps on your email provider's own sign-in page. - Check your bank accounts and credit reports again in a month and in three months. ## What the hacker may already have Old emails can hold more than you think: bank statements, reset links for other accounts, scans of ID and messages from family. That is why the checklist goes beyond the email itself. You don't need to do everything today, but the first section and your bank call are the ones that matter most. If money has already been sent, call your bank first, then the Canadian Anti-Fraud Centre on [1-888-495-8501](tel:+18884958501). ## Common questions ### Should I change my password or sign out other devices first? Change the password first, from a device you trust. Then sign out all other sessions so anyone still logged in is kicked out. Do both in the same sitting. ### Do I need a fraud alert if only my email was hacked? It is worth asking for one if your email held banking messages, ID numbers or scans, or if you are not sure what the hacker saw. A fraud alert is free, and you have to ask Equifax Canada and TransUnion Canada separately. ### How do I know if the hacker set up forwarding? Open your email settings and look for forwarding addresses, filters or rules, and for delegated access or connected apps. Delete any you did not set up. Hackers often use them to keep reading your mail after you change the password. ### Do I have to report a hacked email to the police? Reporting to the Canadian Anti-Fraud Centre and to your local police is recommended. A police report number can be useful if a bank or credit bureau asks for one. Use your local police non-emergency line, not 911, unless someone is in danger. ### Should I pay someone to get my account back? No. Use the recovery steps on your email provider's own sign-in page. Anyone who asks for payment, a password or a login code to get an account back is running a second scam. ## Sources 1. [Report cybercrime and fraud, National Cybercrime and Fraud Reporting System](https://reportcyberandfraud.canada.ca/) 2. [How to report fraud and scams in Canada, Competition Bureau of Canada](https://competition-bureau.canada.ca/en/fraud-and-scams/tips-and-advice/how-report-fraud-and-scams-canada) 3. [Contact us, Equifax Canada](https://www.equifax.ca/personal/contact-us/) 4. [Fraud victims resources, TransUnion Canada](https://www.transunion.ca/assistance/fraud-victims-resources) 5. [Ask a consumer reporting agency to issue a fraud alert, Steps to Justice](https://stepstojustice.ca/steps/debt-and-consumer-rights/3-ask-consumer-reporting-agency-issue-fraud-alert/) 6. [SIN fraud and data breaches, Service Canada](https://www.canada.ca/en/employment-social-development/services/sin/fraud-data-breaches.html) 7. [My Account for individuals, Canada Revenue Agency](https://www.canada.ca/en/revenue-agency/services/e-services/digital-services-individuals/account-individuals.html) ## Related guides - [How to spot a scam text message in Canada](https://jeyki.ca/guides/how-to-spot-a-scam-text-message-canada) A short quiz with realistic Canadian examples, then the red flags and what to do. - [Recovering a hacked Facebook, Instagram, or Meta account](https://jeyki.ca/guides/recover-hacked-facebook-instagram-meta-account) Official recovery steps for a taken-over Facebook, Instagram, or Threads account, plus practical ways to secure it once access is restored. ## Want a second pair of eyes on your accounts? If you would rather not do this alone, I can secure your devices and accounts with you, check for signs of access and hand you a written list of who to notify. It is a flat C$179. [See how cleanup works](https://jeyki.ca/after-a-scam)