How to Recover Your Yahoo Mail Account After Being Hacked

Reach your security settings from the device that's still signed in:

1. Open the Yahoo Mail app and tap your profile icon to open Accounts
2. Tap Manage accounts, then Account info under your account
3. On the Account screen, tap Security
4. Confirm with your fingerprint or face when prompted — that passkey is what proves it's you, so you get in even if the password was changed

You're in your account — now reset your password so the attacker's copy stops working:

1. On Account security, under Ways of signing in, tap Password
2. Enter a strong, unique new password and tap Continue

Because the app already verified you, it won't ask for the old password. Changing it locks the attacker out of the front door.

Changing your password doesn't always end the attacker's existing sessions, so force them out:

1. On the same Security page, scroll down to Current sign-ins
2. Tap any session you don't recognise — Yahoo flags unfamiliar ones as Unrecognised — then choose Sign out and confirm
3. Repeat for every session that isn't yours, leaving only your current device

While you're there, check the listed locations and devices for anything unfamiliar.

Before you go near the recovery page, pick up a device and browser you've signed in with before — ideally on your home Wi-Fi or your usual mobile data. Yahoo trusts familiar devices, browsers and networks far more, and that can be the single biggest factor in getting back in.

Recover the account and prove it's you with any recovery option you still have — the more you can reach, the better your odds:

1. Go to login.yahoo.com/forgot and enter your Yahoo address, then Continue
2. Pick whichever option you can still access — a code by text (SMS) to your recovery phone, a code to your recovery email, or a Yahoo Account Key prompt on the app
3. Enter the code (check spam and junk for the emailed one) and continue

A successful code signs you straight back in — Yahoo drops you on your homepage rather than forcing a password reset, so you'll change your password yourself in the next step.

If you turned on two-step verification (2FA), the Sign-in Helper may offer a different set of options — such as an authenticator-app code or a sign-in prompt — rather than just SMS and email. Use whichever second factor you set up; if you've lost access to that too, work through the fallback below.

You're back in — but don't stop here. The Sign-in Helper let you in without resetting your password, so the attacker may still know the old one. While you're still signed in, change it before anything else:

1. Click your profile icon (top-right) and choose Manage your account
2. On the Overview page, under Looking for something else?, click Change password
3. Enter a strong new password and click Continue

Make it long (16+ characters), unique to this account, and saved in a password manager — a fresh password the attacker doesn't know locks them out of the front door.

Finally, kick out any sessions the attacker still has open:

1. From your account Overview, under Looking for something else?, click View current sign-ins
2. Find any session you don't recognise — Yahoo flags unfamiliar ones as Unrecognised — and click Details
3. Click Sign out, leave I don't recognise this session ticked, and confirm with Sign out of session

Repeat for every session that isn't yours, leaving only the devices you trust.