Author: Thomas Campbell

If someone broke into your email, changing the password is essential—but it may not undo changes they already made. This friendly checklist helps you regain control of Gmail or Outlook and spot hidden settings that can keep causing trouble.

First: If this is a work or school account, notify your IT administrator immediately. If you suspect your computer is infected, use a different trusted device to secure the account.

10 things to check after your email is hacked

1. Change your password. Open the official Gmail, Microsoft, or company sign-in site yourself—not a link from a suspicious email. Choose a unique password and replace it anywhere else you reused it.
2. Sign out unfamiliar devices and sessions. In your account’s security settings, review recent activity and sign out devices you do not recognize. Your workplace IT team may need to revoke Microsoft 365 sessions centrally.
3. Turn on or reset two-factor authentication (2FA). Remove unknown verification methods, verify your own recovery phone and email, and register a passkey or authenticator when available. Never approve a sign-in request you did not start.
4. Check inbox rules and filters. Attackers sometimes make incoming messages skip the inbox, go to Trash/Deleted Items, get marked read, or forward elsewhere. Remove rules or filters you did not create. In Outlook on the web, open Settings → Mail → Rules (menu names vary). In Gmail on a computer, open Settings → See all settings → Filters and Blocked Addresses.
5. Check forwarding. Look for an unknown forwarding address. In Outlook on the web, check Settings → Mail → Forwarding. In Gmail on a computer, check Settings → See all settings → Forwarding and POP/IMAP. Business administrators should also check mailbox-level forwarding and mail flow rules, which may not appear in the user’s settings.
6. Review connected apps. An outside app may have permission to read mail even after you change your password. Review third-party connections or app permissions in your Google or Microsoft account, and revoke anything unfamiliar. Ask an administrator for help with workplace app permissions.
7. Check who can access your mailbox. Look for unfamiliar delegates, shared access, or Send As permissions. These can be managed in account settings or by your organization’s administrator; Gmail delegation is under Settings → Accounts and Import on supported accounts.
8. Check Sent, Deleted Items/Trash, and archive folders. See whether anyone sent fraudulent messages from your account or hid incoming mail. If an unexpected rule sent mail to Deleted Items or Trash, the messages may still be there. Check recovery options before emptying anything; retention periods and recovery availability vary.
9. Review account activity and security changes. Look for suspicious successful sign-ins, unfamiliar devices, new recovery methods, and account changes. A location by itself can be misleading, so look at device and time details too.
10. Warn affected contacts and watch for repeat activity. Tell people who may have received suspicious messages not to open links or enter passwords. Monitor the account for new rules, forwarding changes, unfamiliar sessions, and unexpected mail for the next several days.

Where to find the settings

Gmail / Google account

Go directly to Google Account Security to review devices, sign-ins, and two-step verification. In Gmail on a computer, open the gear icon → See all settings to inspect filters, forwarding, and account delegation (where supported). You can find Google’s instructions at Secure a hacked Google Account.

Outlook.com / Microsoft 365

Open your normal Outlook webmail directly. Use Settings to inspect Rules and Forwarding, and your Microsoft account’s security page to review authentication and recent activity. On a workplace Microsoft 365 account, some settings—including server-side forwarding, mailbox permissions, OAuth app grants and session revocation—require help from IT. Microsoft’s account recovery guidance is a useful starting point for personal Microsoft accounts.

Extra checks for Microsoft 365 administrators

If you’re the IT administrator responding to a compromised mailbox, preserve appropriate evidence and review: Entra sign-in and audit logs; active sessions and registered authentication methods; inbox rules (including hidden or suspicious rules); mailbox and transport-level forwarding; Full Access, Send As and Send on Behalf permissions; enterprise app consent and service principals; suspicious sent mail and message trace; and whether a phishing campaign affected other users. Revoke sessions and unauthorized grants and confirm remediation with fresh sign-in activity.

Important: An empty forwarding setting or delegate list does not prove the account is clean. Review other access paths too, and follow your organization’s incident-response process.

What if your missing email is in Deleted Items?

Do not empty that folder. Remove the unwanted rule or filter first, then move legitimate messages back to the Inbox. If messages are no longer there, check the provider’s recovery feature or ask IT about retention and restore options. Recovery is not always possible.

The bottom line

Secure the login, then check what the attacker changed. A malicious inbox rule can keep hiding email after the hacker is locked out. Checking rules, forwarding, app access, delegated access and deleted messages can reveal problems that a password reset alone will miss.

Related guides: Clicked a Scam Link? · Dangerous Email Attachments · How to Spot a Scam Email.

Quick answer: A Facebook ad can look professional, use a familiar company logo, and even say “Sponsored” — and still be a scam. “Sponsored” means someone paid to show the ad. It does not mean Facebook guarantees the seller is trustworthy.

Maybe you have seen a familiar store advertising an unbelievable clearance sale, a famous person recommending an investment, or a warning that your Facebook account needs attention. Before you click or pay, use these simple checks.

7 warning signs of a fake Facebook ad

1. The price seems too good to be true

A $200 appliance for $19.99? A well-known brand with an “everything must go” sale? Scammers regularly copy product photos and logos to advertise deals that do not exist. Compare the price on the company’s real website, reached by typing its address yourself.

2. The ad pressures you to act immediately

Watch out for countdown clocks, “only two left,” or warnings that you must act within minutes. Real sales can be time-limited, too, but pressure is a reason to slow down — not speed up.

3. The page name looks almost right

A scammer might create a page with a familiar logo and a name such as “Brand Official Deals” or a misspelled store name. A logo, a large number of likes, or even a familiar-looking page is not proof of legitimacy.

4. The website address is strange

Look at the actual website address before entering anything. A fake store may use a long address with extra words, unusual spelling, or a different ending from the real company’s website. A padlock or https only means the connection is encrypted; it does not prove the company is legitimate.

5. A celebrity is making an unbelievable promise

Scammers use edited videos, stolen photos, and AI-generated voices to make celebrities appear to promote investments, giveaways, or miracle products. Never trust a financial offer simply because a famous person seems to endorse it.

6. The seller demands an unusual payment method

Be especially suspicious if you are told to pay using gift cards, cryptocurrency, wire transfers, or a payment app sent to an individual. A credit card generally offers better options to dispute a purchase when something goes wrong.

7. The ad asks you to sign in to fix a problem

An ad or message claiming your Facebook account, bank account, or computer is locked may lead to a fake sign-in screen. Do not enter passwords or verification codes through that link. Open the app or visit the service’s official website yourself.

A simple 30-second check before you buy

1. Stop. Don’t buy straight from the ad.
2. Search. Look up the business separately. Try its name plus “scam,” “complaint,” or “reviews.”
3. Compare. Visit the real store’s website and see whether the same offer exists.
4. Check. Read the full web address and confirm who is receiving the payment.
5. Skip it if unsure. Missing one sale is better than losing your money or account.

What if you already clicked the ad?

If you only opened the website: Close the page. Opening a link does not automatically mean your account was stolen, but do not download files, allow notifications, or provide information. If you downloaded something, avoid opening it and run your device’s built-in security scan.

If you entered a password: Open the real website or app directly and change that password immediately. Change it anywhere else you reused it. Turn on two-factor authentication, review recent logins, and sign out unfamiliar devices or sessions. Never give anyone a security verification code.

If you entered a credit card: Contact your card issuer using the number printed on the card or in its official app. Explain what happened, ask about freezing or replacing the card, and review transactions. Dispute fraudulent charges promptly.

If you paid by another method: Contact the payment provider or bank as quickly as possible and ask whether the payment can be stopped or recovered. Save screenshots, receipts, and messages.

If someone asks for personal identity information: Visit IdentityTheft.gov for recovery steps appropriate to what was shared.

How to report a suspicious Facebook ad

1. Find the advertisement in your Facebook feed, if it is still available.
2. Tap or click the three dots (⋯) near the ad.
3. Select Report ad or the closest reporting option shown.
4. Choose a reason such as scam, fraud, or misleading content, and follow the prompts.

Menus can vary depending on your version of Facebook. You can also report suspected fraud to the Federal Trade Commission.

Remember: “Sponsored” is not a safety seal

The FTC warns that scammers can buy advertisements on social media, including ads pretending to represent real businesses. Facebook’s parent company, Meta, says it actively removes scam ads and takes action against deceptive advertisers, but no screening system catches every scam. That is why a little independent checking matters.

The NoPanicTech rule: If an ad makes you excited, frightened, or rushed, take a minute and check it outside Facebook before you click, sign in, or pay.

For more help spotting fake sign-in pages, read our guide: That Email Attachment Might Be a Trap.

Trusted sources

• FTC: Are social media ads checked for scams?
• FTC: How to spot scams that start on social media
• Meta: Scam prevention and safety basics

Some parking lots let you pay by texting a code or scanning a QR code. The exact steps depend on the parking operator, but this guide covers the basics.

Before paying

1. Read the official sign in the lot and confirm the posted parking operator, zone and instructions.
2. Check the website address shown on the sign. Stickers pasted over a real sign can sometimes send you to a scam page.
3. Enter the lot or zone number, vehicle license plate and desired parking time as instructed.
4. Review the parking price, service fees and expiration time before paying.
5. Keep the confirmation message or receipt.

How do I extend parking time?

Use the extension link from a genuine confirmation message, or return to the parking provider’s official website or app. Look for Extend, Add Time, or your active parking session. Not every lot allows extensions, and some require you to extend before your current time expires.

What if I receive a suspicious text?

Do not tap a payment link just because the text says you owe a parking fine. Instead, visit the parking operator’s official website using an address you found independently, or use the instructions on the physical sign. Never enter banking details on a site whose legitimacy you cannot verify.

Tip: Set a phone reminder a little before your parking session ends, especially if you will be away from the car.

It can feel like new apps and advertisements appear on your phone every day. Often, several different things are being confused: an app, an ad inside an app, a notification, and a website shortcut.

First, identify what you are seeing

An installed app opens when you tap its icon. An advertisement appears inside a website, game, or another app. A notification appears as an alert or banner. A website shortcut looks like an app icon but opens a page in a browser.

Reduce notifications on iPhone

Open Settings > Notifications. Choose the app sending alerts and change or disable its notification permissions. For Safari website pop-ups, open Settings, search for Safari, and enable the pop-up blocking option when available. Some ads are built into free apps and cannot all be removed through a single phone setting.

Remove unfamiliar apps carefully

Press and hold an iPhone app icon, then tap Remove App > Delete App. On Android, touch and hold the app or go to Settings > Apps and choose Uninstall. If an app is unfamiliar, check what it does before deleting it. Removing an app may not cancel an existing subscription.

Do I need antivirus?

Keep your operating system and apps updated, use official app stores, and avoid suspicious links. Modern phones have built-in security protections, but no product can make you perfectly safe. If a browser page announces that your phone is infected and asks you to call a number or pay immediately, it may be a fake virus warning. Close the page, and do not call the number.

Quick check

1. Is it an ad or a real installed app?
2. Which app or website is showing it?
3. Can you turn off its notifications?
4. Is there a paid subscription you also need to cancel?