Yahoo Mail Account Hacked: Recovery and Damage Control

moderate ⏱ 30–60 minutes Updated 2026-08-18

Official Yahoo page for this problem: help.yahoo.com — we link it because the official flow is always the real path; this guide exists to help you get through it.

Discovering that someone else has been inside your Yahoo Mail account is alarming, and speed genuinely matters — every hour the attacker keeps access, they can reset passwords on your other accounts and harvest personal data. The honest ground rules: if you can still sign in, or the Sign-in Helper still recognizes a phone number or email you control, you can almost always take the account back. If the attacker has fully replaced your recovery options and any grace period on the old ones has lapsed, recovery is often impossible, because Yahoo has no human-review recovery form and no support team that adjudicates ownership of free accounts. Act now, in the order below.

Before you start

• Use a device you trust. If you suspect malware (unexpected pop-ups, a “helper” someone convinced you to install, a cracked download), work from a different device — changing your password from an infected machine hands the new password to the attacker.
• Have your recovery phone with you and access to your recovery email address.
• Make a quick list of high-value accounts tied to this Yahoo address: banking, payment apps, shopping, social media, government services. You will need it in Step 5.
• Note anything odd you have seen — sent mail you did not write, password-reset emails you did not request. This tells you what the attacker was doing.

Step 1: Try to sign in and change the password immediately

If your password still works, you have the fastest path. Sign in at login.yahoo.com, go straight to the Account Security page, and change your password to something long, unique, and never used anywhere else. This alone ends most compromises, because it invalidates the attacker’s stolen credential.

If your password no longer works, the attacker changed it. Go to Step 2 without delay.

Step 2: Reclaim access with the Sign-in Helper

On the sign-in page, choose the forgotten-password / trouble-signing-in option to launch Yahoo’s Sign-in Helper.

1. Yahoo shows masked recovery options on file. Look carefully: even if the attacker added their own, your original phone or email may still be listed, and Yahoo may honor previously-verified options for a period after changes.
2. Choose an option you control. Yahoo may ask you to confirm the full phone number before sending a code.
3. Enter the verification code and set a new password immediately.

If the helper shows only recovery options you do not recognize, the attacker has replaced them. Retry from a device and network you have historically used with this account — familiarity can affect what the system offers — but if nothing you control appears, skip to “If nothing works.”

Step 3: Evict the attacker

Changing the password is not enough on its own. From the Account Security page:

1. Review recent sign-in activity for sessions, devices, and locations you do not recognize.
2. Sign out of all other sessions and devices. This forcibly disconnects the attacker anywhere they are still logged in.
3. Remove any recovery phone number or email address you did not add. This is critical — a planted recovery option is a back door for re-entry.
4. Check app passwords and connected third-party apps, and revoke anything unfamiliar.
5. Turn on two-step verification if it was not already on, using a phone number or authenticator method you control.

Step 4: Undo the attacker’s changes inside the mailbox

Attackers commonly set traps that outlive the password change. In Yahoo Mail settings, check:

• Filters: delete any rule you did not create, especially ones that auto-delete or move password-reset and security emails.
• Forwarding: turn off any auto-forwarding to an address you do not recognize. This is the most common persistence trick.
• Vacation/auto-reply: clear any message the attacker set.
• Signature and reply-to address: restore them if altered.
• Blocked addresses: attackers sometimes block security senders so you never see alerts.

Also look through Sent and Trash. If the attacker deleted mail you need, check Trash first (deleted mail sits there for a limited period). For mail already purged, you can submit a restore request through Yahoo’s help site, which asks Yahoo to roll your mailbox back to an earlier point. It generally only works within about 7 days of the loss, is all-or-nothing back to that point, and is not guaranteed — but it is free and legitimate, so file it promptly if you need it.

Step 5: Contain the blast radius

Your email account is the master key to everything else. Assume the attacker searched your mailbox for “password,” bank names, and account statements.

1. Change passwords on every important account that uses this Yahoo address for login or recovery, starting with banking and payment services.
2. Check those accounts for password-reset emails, new devices, or changed contact details dated during the compromise window.
3. If financial accounts were touched, contact your bank and consider a credit freeze or fraud alert.
4. Warn your contacts to ignore strange recent emails from you.
5. If you reused the stolen Yahoo password anywhere else, change it there too, and stop reusing passwords — a password manager makes this practical.
6. Run a reputable malware scan on the devices you use for email.

What NOT to do

• Do not hire a “hacked account recovery” service. Every service advertising guaranteed Yahoo recovery for a fee is either a scam or offering to hack, which can destroy your remaining chance of legitimate recovery. There is no insider access for sale.
• Do not call any phone number claiming to be Yahoo support. Yahoo’s free support has no inbound phone line for free accounts; only Yahoo Plus paid subscribers have a support channel, and even it cannot bypass identity verification. Numbers surfaced by search ads are fraud operations — often run by the same people who hack accounts.
• Never read a verification code to anyone, for any reason. A caller asking for “the code we just sent to verify you” is executing a takeover in real time.
• Do not fire off rapid repeated recovery attempts. Bursts of activity trigger security locks that slow you down when speed matters most.

If nothing works

If the attacker replaced every recovery option and the Sign-in Helper offers you nothing you control, be realistic: the account is likely gone. Yahoo has no manual ownership-dispute process for free accounts, does not accept identity documents, and no third party can force the issue. Keep retrying the Sign-in Helper occasionally from familiar devices in case options change, but plan as if it will not.

Move to containment and rebuilding. Complete Step 5 fully — that is where the real damage happens, not in the mailbox itself. Create a new email account with strong, unique credentials and two-step verification from day one, and migrate your services to it. Note Yahoo’s inactivity policy: accounts unused for roughly 12 months may be deactivated and deleted, so the hijacked account and its contents may eventually disappear regardless. Finally, if the attacker committed fraud in your name, keep records and file a report with law enforcement or your country’s cybercrime portal — not to recover the mailbox, which they cannot do, but to protect yourself in disputes that follow.

recover.email is not affiliated with Yahoo. This guide is informational and cannot guarantee recovery.