We had to change our old domain. guideora.net is our new and only official domain. Never trust any fake domain using the GUIDEORA name, or similar names pretending to be GUIDEORA.

GUIDEORA

identity theft guide

Getting an Email Account Back After a Takeover

Sam OkonkwoSam Okonkwo· Security Researcher· Updated March 21, 2025· 11 min read

Some links on this page may earn GUIDEORA a commission. Disclosure

Quick take

Account takeover of email is how password resets become theirs. Use the provider's account-recovery flow from a clean device. Then rotate passwords with a vault, kill SMS 2FA where you can, freeze credit if they started applying. Aura is the monitoring example this site uses after the inbox is yours again.

They do not need your bank password yet

With the inbox, they click 'forgot password' everywhere. Containing email is the incident. Everything else is cleanup.

A VPN does not get the inbox back. An antivirus may if malware stole the cookie — run that on a clean machine after. Do not mix the jobs.

From the record

Recover email from a device you trust. Then the vault. Then the banks. Not the other way around.

GUIDEORA rule for takeovers

Provider flow, then sessions

Google, Microsoft, Apple all have takeover recovery. Follow them. Sign out other sessions. App passwords. Forwarding rules they added. Check filters that hide their mail.

A locked-out email screen at night
The inbox is the castle. Everything else is a village.

Email

The castle

Clean device

Required

Vault

After

Freeze

If credit moved

  • Clean device, provider recovery, then 2FA that is not SMS if you can.
  • Rotate unique passwords starting with email and finance.
  • Assume shopping sites are next.
  • IdentityTheft.gov if money or new credit appeared.

Monitoring is the later radar

Aura currently alerts on credit-file and dump-style events as they document them. Useful after you have the inbox. Useless as a replacement for Google's recovery. We mention Aura because it is this site's household bundle — Bitwarden is the vault example elsewhere.

A bundle will not press Google's recover button. Confirm live extras.

Pros

  • +A clear order beats panicking in five apps
  • +A vault stops the next stuffing
  • +Credit alerts catch the loan they filed while you were locked out

Cons

  • −Provider recovery can take days
  • −A dirty PC will just leak again
  • −SMS 2FA remains a weak link

Castle, then villages

Get email back first. Then vault. Then freeze if needed. Aura is the later radar this site uses. GUIDEORA does not recover inboxes.

Editor take

Inbox, then money

Provider recovery on a clean device. Then unique passwords. Aura is the monitoring example after. Confirm live. IdentityTheft.gov if funds moved.

See Aura's current plan