my email account got hacked, hacker is deleting emails, no 2fa — should i just set it up from scratch?

google's recovery process is actually fast happened to me too, they restored it in 2 hours. just do this: go to my account security checkup enable 2fa change password. done. btw but also run a virus scan on your computer...

you can quickly check for account takeover using the google security api. check the last login date, active sessions, and connected apps. use google authenticator or authy for 2fa (more secure than sms). also check all saved passwords in chrome password manager to see if there was a leak.

gmail's recovery mechanism is great don't worry. go there change your password enable 2fa. and also run a malware scan, because if they know your password there might be malware on your computer too. people say install an antivirus product but windows defender is usually enough...

note: I wrote this based on my own experience, it might not apply to everyone.

the email hack could be due to a weak password or password reuse. check your email address on have i been pwned (haveibeenpwned.com) to see which breaches you were in. if you appear, you need to change passwords on those services too. after enabling 2fa, store your backup codes in a safe place (password manager or safe).

don't worry bro, google takes this seriously, they'll help. they'll send an account recovery link to another email or phone number. but you need to: 1) set a new password (16 chars), 2) enable 2fa, 3) install the authenticator app on a few devices, save backup codes, 4) log out all connected apps.

just because some emails were deleted, does that mean it was hacked? there might be auto-delete rules in gmail, or maybe you moved them to the wrong folder yourself? it's a bit early to say, we'll know for sure after a full security checkup.

Thanks a lot I'll try it today. Don't rely on a single measure; go layer by layer.

This is my opinion, I'm not claiming it's absolute truth.

Let me summarize the topic, since several different answers were given. Just because everyone does it doesn't mean it's right.

The answer varies greatly by industry; there is no one-size-fits-all rule. That's all, sorry if I went on too long.

Just a heads-up. If you don't write this down from the start, it leads to arguments later.

Taking measures without an inventory leaves doors you haven't seen open. Correct me if I'm wrong.

Just a heads-up. Taking notes for two weeks yields better results than a six-month estimate.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. This is my opinion, I'm not claiming it's absolute truth.

We need to take it step by step. Everyone rushing into my email account was compromised gets stuck at the same point.

Hope this helps.

I agree, and I'd like to emphasize that. Start with a small trial; don't commit to everything at once.

Noted thanks. btw just because everyone does it doesn't mean it's right.

Correct me if Im wrong.

I didn't know that.

Let me write how it's done in practice. When making a decision, first look at what data you have on hand.

we experienced almost the exact same thing last year then btw just because everyone does it doesnt mean its right.

hope this helps.

There are three things to check when doing this. Everyone rushing into my email account was compromised gets stuck at the same point.

If 2FA is on, a stolen password alone is useless. Good luck with that.

This approach has a cost, which isn't discussed. Your time to detect an issue directly determines its cost.

Proven by experience.