Provider email account hacked? What to do

The National Cyber Security Centre (NCSC), the UK government's cyber security body, lists these common signs: you can't log in; your security settings have changed; messages you don't recognise have been sent from your account; there are logins from unfamiliar places or at odd times; or there are payments or purchases you didn't make.

BT adds strange messages in your Sent folder, repeated login errors, error messages in BT webmail or the BT Email app, and repeated login failures in apps such as Outlook. Virgin Media says the usual signs are someone else accessing your account or spam being sent from your address.

"My contacts are getting emails from me that I didn't send"

This is spoofing: messages that appear to come from your address even though you didn't send them. BT says spoofing "usually means your account details have been accessed", and that scammers may then use your contacts to send more fake messages. So assume your password is known to someone else and work through the steps below.

Your provider has blocked or reset the account

Sometimes the first sign comes from the provider. BT says it blocks a BT email account immediately when it detects suspicious activity. TalkTalk blocks mailboxes where activity looks suspicious. Virgin Media may send a "Compromised Mailbox" alert and temporarily block your webmail. Sky says it might reset your Sky account password to keep it safe, and TalkTalk says it may reset email passwords from time to time for security reasons. In each case, the way back in is the provider's official password reset, covered provider by provider below.

These steps follow the NCSC's guidance on recovering a hacked account. BT and Virgin Media both say to scan your devices first; the NCSC adds that forwarding rules should be removed before you change the password, because attackers use them to get copies of your mail and reset your other passwords. The provider sections further down keep each provider's own order.

1. Scan the devices you use for email. BT and Virgin Media both put this first. Virgin Media says that if a scan finds nothing, someone has probably used your username and password. Our guide on what to do when your provider says a device is infected covers cleaning up computers, phones and smart devices.
2. Use your provider's own recovery process, from its help or support pages, as the NCSC advises. Type the provider's website in yourself rather than using a link in a message. For BT, Sky and TalkTalk mailboxes that recovery route is a password reset, so you may already have a new password at this point.
3. Remove forwarding rules you didn't create. A forwarding rule automatically sends copies of your incoming mail to another address. The NCSC says attackers often set one up to get copies of your mail and reset your other passwords, and to remove unwanted rules before changing your password.
4. Set a fresh password once unwanted rules are gone, and change it anywhere else you used the same one. If you reset the password in step 2 and then found a rule you didn't create, this second change is the one the NCSC's order points to.
5. Log out of all devices and apps, then sign back in on your own devices.
6. Turn on two-step verification where it's offered. Two-step verification (2SV, also called two-factor authentication or 2FA) means signing in needs a second thing, such as a code texted to your phone, as well as your password. The NCSC says to prioritise email and banking. Where an account offers a passkey, the NCSC describes it as a sign-in protected by your device's own unlock method, such as fingerprint, face check or passcode, and recommends using passkeys wherever they're offered.
7. Update your devices, ideally with automatic updates on.

The NCSC also points to haveibeenpwned.com, which shows whether your address has appeared in public data breaches; change the password anywhere you reused one that leaked. If the leak came from your provider itself, see our guide to what to do after a broadband provider data breach.

BT's help page on insecure email accounts sets out a clear order.

1. Scan your devices. BT says Cyber Threat Protect is included with BT broadband: in the My BT app go to Security, turn it on, then follow the steps in the Cyber Threat Protect app.
2. Change your BT email password by logging in at bt.com and selecting Email on the top bar (you may be asked to create a BT ID). Then update the password on every device and app that collects your BT mail, or apps like Outlook will keep failing to log in.
3. Work through BT's security checks, below.

Afterwards, BT recommends Cyber Threat Protect, Web Threat Protect and Hub Threat Protect, a different strong password for each site, avoiding public Wi-Fi for email and signing out on shared computers. BT ID logins use two-factor authentication: BT says 2FA is set up when you create your BT ID and can't be removed, with a passcode sent to your mobile or email. To change where the passcode goes, log in to My BT, select Your Details, then Edit two-factor authentication (BT help, checked October 2026). It's worth checking that destination after a hack: if the passcode goes to the very email address that was compromised, sending it to your mobile instead means a second code doesn't land in a mailbox someone else may have seen. If a passcode doesn't arrive, BT suggests checking your email junk folder and that the mobile number is correct. If you clicked a link in a fake email first, BT also says to contact your bank if you entered financial details and check your BT account activity. More on BT as a provider is on our BT broadband deals page.

Sky's email is Sky Yahoo Mail, reached by signing in at sky.com with your Sky iD. We didn't find a Sky article dedicated to hacked Sky Yahoo Mail accounts, so this uses Sky's password, two-step verification and mail settings pages.

Reset the password

Use Sky's reset page (skyid.sky.com/resetpassword/skycom) and enter your email or username. If you still can't get in, contact Sky.

Set up two-step verification

Sky calls two-step verification the best way to make sure you're the only one with access to your Sky Yahoo Mail. You set it up when you sign in; after that, a one-off code is texted each time someone tries to sign in. You need a valid UK or Republic of Ireland mobile number.

Set-up also gives you a recovery code, which Sky says to keep somewhere safe and not in your emails; you need it if you lose access to your mobile number. After a hack that matters: a code saved in a draft inside the mailbox is exactly what an intruder could read. Write it down or keep it in a password manager.

To change the number or get a new recovery code, go to My Details > Manage Sky ID > Manage two-step verification. If you've lost both the recovery code and the registered number, contact Sky.

Check forwarding, carefully

Sky says new automatic forwarding can no longer be set up, but existing forwarding still works. Look under Settings > Accounts > your Sky Yahoo Mail account > Access your Sky Yahoo Mail elsewhere > Forward. If mail is going to an address you don't recognise, untick Forward and save. Once removed, forwarding can't be set up again, so if you'd deliberately forwarded mail to another address of your own, check it really is yours before changing anything.

If you decide to stop using the address, note that Sky suspends and then deletes Sky Yahoo Mail accounts that aren't signed in to for five months or more, after warning emails. Sky also offers Sky Broadband Shield, which it says helps protect against phishing and malware-infected sites. See our Sky broadband deals page for more on Sky.

Virgin Media has a help page specifically for hacked email. Its three steps:

1. Scan your devices for malware with Virgin Media Advanced Security, a free online scanner from F-Secure or ESET, or a scanner from your device's app store.
2. Secure your My Virgin Media account. Virgin points to its Virgin Media O2 ID help: you manage the ID in My Virgin Media under Account settings and can sign in with, for example, a password or a passkey (see step 6 above for what a passkey is). Virgin Media O2 may lock the ID if it suspects unusual activity; you're told when you sign in and shown how to unlock it.
3. Check Auto Forward at mail.virginmedia.com: Settings cog > Email > Auto forward. Delete forwarding to any address you don't recognise.

Virgin's wider checklist adds: once devices are clean, use a different password for each online and email account, change passwords in third-party apps that use Virgin Media Mail, check Essential Security (on by default, Virgin says), confirm your contact email in Account Settings, and reset your My Virgin Media password and security question.

Email apps use a separate app password

If you read Virgin Media Mail in Outlook or a phone mail app, it uses an app password generated in the My Virgin Media app (Account settings > Account details > Virgin Media Mail), because the IMAP and POP connections those apps use don't support multi-factor authentication. A new app password has to be entered in every app. If an app then won't send, our guide to email that won't send on home broadband may help.

What Virgin's alerts mean

• Compromised Mailbox alert: Virgin suspects a third party is using your address to send spam. The senders using your address are temporarily blocked from the account so they can't change anything.
• Email Spambot Alert (letter or email): spam has been reported coming from a device on your home network. Virgin says you're unlikely to be at fault, but it breaches its Acceptable Use Policy and continued activity could lead to your broadband being suspended or cancelled.

The Junara change is a ready-made scam story

Virgin Media is handing its email service to Junara, a paid service. Virgin says its emails about this contain no sign-up link and never ask for personal or payment details, and it says not to pay for anything via phone or emailed links. So treat any "Virgin Media" message about the change that contains a sign-up link as fake, and sign up only through Virgin's help page or Junara.com. Our guide to keeping your email address when you switch covers the move. For Virgin Media broadband, see our Virgin Media broadband deals page.

TalkTalk checks the likelihood of a hack each time a mailbox is accessed. If activity looks suspicious it blocks the mailbox with the message "For security reasons, we have blocked your account due to suspicious activity on your account", followed by a prompt to reset your password. TalkTalk says this can appear even when the username and password you typed are correct, because there's a chance the mailbox has been accessed by a hacker. Its help page says:

• you can't use the mailbox in webmail (talktalk.co.uk/mail) or an app until you change the password, and there's no other way to unblock it;
• you reset the password with your recovery details (a mobile number or alternative email) or through My Account;
• incoming mail is still stored, and your contacts aren't told the mailbox is blocked;
• a blocked mailbox not accessed again within 6 months is permanently deleted.

Without valid recovery details you have to contact TalkTalk. Once you're back in, set them: in webmail open the menu (the cog on mobile), choose "Update your reset details", add a mobile and/or alternative email, and save.

The account holder can also change any mailbox's password in Mailbox Manager (select the mailbox, then Change Password). TalkTalk's rules: 12 characters in total, including a symbol, a number, and upper and lower case letters, and not one of your last 5 passwords.

The TalkTalk help pages we checked don't cover forwarding or filter checks, or two-step verification for TalkTalk Mail. Following the NCSC's general advice, look through your webmail settings for forwarding or rules you didn't create, and ask TalkTalk if unsure.

TalkTalk and BT

TalkTalk went into administration and BT bought its consumer and wholesale (PXC) businesses out of administration on 5 October 2026. The Competition and Markets Authority is reviewing the deal under a public-interest intervention notice and is due to report by 19 October 2026; until then BT and TalkTalk are run separately and nothing changes for TalkTalk customers (BT, ISPreview, checked October 2026). BT also says neither TalkTalk nor BT will ever ask for your password or bank details. TalkTalk also says its move of some mailboxes to Everymail doesn't affect current broadband customers. Expect scammers to use both stories; neither needs you to give anyone a password or card details, and if a message worries you, contact TalkTalk through its own website rather than the details in the message. See our TalkTalk broadband deals page for more.

Warn your contacts

The NCSC advises telling contacts to treat recent messages from your account with suspicion. An example you could adapt: "My email was hacked this week. If you got a message from me asking for money or to click a link, ignore it."

Check your money and shopping accounts

Check bank statements and shopping accounts using official channels (the app, or the website typed in yourself), not links in messages. Change the password on every account that shared your email password, starting with those whose reset emails go to the hacked address.

Report phishing and fraud

Citizens Advice says Report Fraud gives you a crime reference number. Its consumer helpline (0808 223 1133, free from mobiles and landlines, Monday to Friday 9am to 5pm) can help too; that contact page is Citizens Advice's advice for England. BT's, Sky's and Virgin Media's help pages still linked to Action Fraud when we checked in October 2026; the NCSC and Citizens Advice now point to Report Fraud. For scams that use broadband as the hook, see our guide to broadband scam calls and emails.

If the intruder changed your recovery details, or you've lost both phone and recovery code, keep trying the provider's official route and support line. If the service won't restore access, the NCSC says to open a new email account, tell your contacts the old one is abandoned, and update your bank, utility and shopping accounts with the new address.

Think about where that new address lives. A provider address stays with the provider: Virgin Media usually closes email for people who no longer have its services, and TalkTalk says email users without its broadband lose their address unless they pay for its mail service. ISPreview advises using an email service separate from your broadband provider for that reason. Our guide to moving to an email address you keep when you switch walks through moving accounts across.

• Is my mailbox blocked or locked, and exactly what do I need to do to unblock it?
• Which recovery details do you hold for me, and can I update them now?
• Do you offer two-step verification for my email login as well as my account login, and where are the codes sent? (At BT, you can see and change the passcode destination in My BT.)
• Has my connection been flagged for sending spam?
• If I stop using this address, how long will it stay open?

The NCSC's top tips: a strong, separate password for your email; 2-step verification wherever offered; the latest software and app updates; a password manager to create and remember a different password for every account; and backups of important data.

Use the protection your provider includes too: BT's Cyber Threat Protect, Web Threat Protect and Hub Threat Protect, Sky Broadband Shield, or Virgin Media's Essential Security. Our guide to securing your home router and Wi-Fi covers the router settings worth checking.

If a hack has you thinking about a new provider, sort your email address out first, then look at what each provider offers on our broadband providers page and compare deals at your postcode.