Why a warning matters
When someone takes over your email or social account, they often use it to message the people who trust you most. A note from a friend asking for a quick favor, or a link with the line “is this you in this video?”, is far more likely to be opened than an obvious junk message. If your contacts click, send money, or share their own codes, the damage spreads outward from your account.
A short warning cannot undo what has happened, but it can help stop the next person from being tricked. It is also considerate. Most people appreciate the notice, and many will say they have done the same.
Secure the account first
Before you warn anyone, make sure the attacker is no longer in your account. Otherwise they may read your warning, delete it, or send a false “all clear.” The steps in the first-hour response to a hacked account come first: change the password, sign out other sessions, and check your recovery details. Once you are confident you are back in control, you can contact people.
Find out who received messages
Look at your sent folder, outbox or message history. Note:
- Which contacts received messages
- What the messages said and whether they included links, attachments or requests
- When they were sent
Not all attackers leave a trace. Some delete sent items, so absence of evidence is not proof that nothing was sent. If you cannot tell, a general warning is a reasonable approach. Some platforms also let you see recent activity for the account.
Choose the right channel
Use a channel the attacker does not control. If your email was hijacked, do not rely on that email for the warning until you have secured it. Options include:
- A message from a different, secure account
- A text message or phone call to people close to you
- A post or story on a social profile, if the account was social and you have regained it
- A short note to your team through your workplace chat or IT contact
For close contacts, a personal message works best. For a broad audience, a public status update is quicker. Do not reply directly to the spam; that may reach the attacker.
What to say
Keep the warning short, calm and clear. For example:
“My email account was hacked, and some messages were sent from it between Monday and Tuesday. If you received something unusual from me, please do not click links, open attachments or send money. Delete it. I have secured the account. Thank you, and sorry for any trouble.”
Useful points to include:
- What happened, in plain terms.
- What to look for, such as a type of message or subject line, if you know it.
- What to do, which is to ignore and delete it. Suggest they report it as phishing messages through their mail provider.
- What to do if they already clicked or replied, such as changing their password and watching their statements.
Avoid long explanations, blame, or dramatic language. You do not need to share more detail than is helpful.
Warn work or school contacts through the right people
If a work or school account was used, tell the IT or security team first. They may need to block the sender address, remove messages from other inboxes, or check for wider problems. Business email carries particular risks, such as fake payment requests, which is why executive impersonation emails are a recognized problem; staff should confirm unusual requests by another channel.
Do not try to contact everyone individually before the proper team has been told. Their guidance may be a single message sent to the right people.
Help contacts who responded
If someone replied or clicked, stay supportive. Ask them to:
- Change the password on any account they entered credentials into
- Contact their bank immediately if they sent money or card details
- Run a scan if they opened an attachment
- Watch for follow-up scam attempts
Do not scold. They were reacting to what looked like a message from someone they trust. Remember that some contacts will worry or feel embarrassed, and a kind tone helps.
Reduce the chance of a repeat
Two-step sign-in is one of the most effective protections for an email account. A unique password also matters, and the pattern of how password reuse spreads breaches is a common cause of the situations described here. If your address book has been exposed, expect contacts to see more fake messages “from you” for a while, as spammers sometimes forge sender addresses without needing your account at all. In that case, the cause is not a hack, and spam email filtering on their side is the usual remedy.
Keep a record and move on
Note who you contacted and when. If a contact tells you they lost money or data, suggest they report it to their bank and to local authorities. After a few weeks of quiet, you can reasonably consider the incident closed, while keeping your usual caution going forward.