I changed my social password, but someone may still read my recovery email. What next?
The short answer
Treat the mailbox as a separate compromised account. Changing an Instagram or Facebook password does not secure Gmail or Outlook.com. Use a trusted device and the email provider’s security process, then resume official social-account recovery.
What this answer is based onWhat to do
Prepare your mailbox address, your recovery methods and a private record of suspicious settings. Never share passwords or codes. If a partner may be monitoring you, consult the safety-planning guide before changes that could alert them.
- Open the provider directly on a trusted device. If you cannot sign in, start with recovery in its official help page. Do not pay for promised verification bypasses. If malware is suspected, use another trusted device and the device-containment guide. Microsoft recommends checking the PC for malware before changing its password.
- Follow the compromised-account checklist. For Google, review security events, devices, recovery contacts and apps with access; correct unfamiliar changes and strengthen sign-in protection. Set a new unique password. Prepare your own replacement before removing your only working recovery method.
- In Gmail on a computer, open Settings → See all settings. Review Forwarding and POP/IMAP (or Forwarding), disable unwanted forwarding and save. Separately review Filters and Blocked Addresses for rules that forward, hide or delete security mail; remove unauthorised rules. For Outlook.com, follow Microsoft’s checks for connected accounts, forwarding and automatic replies. Resume official social-account recovery with a mailbox you control. If settings return, revisit the provider’s security process.
The situation
A reset email disappears from your inbox. A filter could explain it, but this alone does not prove hacking. Check the mailbox instead of repeatedly requesting codes.
The situation and an improvement
Keep resetting the social password while the mailbox remains exposed.
Check mailbox access and mail rules, then continue official social-account recovery.
More examples
Forwarding survives the password change
An unfamiliar forwarding address remains.
What to do
Record it privately, remove unauthorised forwarding and finish the security checklist. A password change alone is not a complete check.
The mailbox stays inaccessible
The provider cannot verify you with available methods.
What to do
Continue through its official recovery help. For the social account, see the lost-recovery-contact guide. No alternative verification route is guaranteed here.
What this answer is based on
Google Account Help · Secure a compromised accountsupport.google.comGmail Help · Automatic forwardingGmail Help · Manage filtersMicrosoft Support · Recover a compromised personal accountPrimary source readReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Public Google account, Gmail forwarding/filter and Microsoft recovery documentation read on 10 November 2026. Specific settings concern personal Gmail and Outlook.com. No mailbox, recovery submission or Meta account was accessed or tested. The order of checks is practical guidance, not proof of safety or recoverability.
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development