Yahoo

Before You Start

Is it safe to do this now?

Before making changes, consider whether the other person might notice. Changes to your Yahoo account can trigger:

• Email notifications to your recovery email address
• Text messages to your recovery phone number
• Login alerts if you sign in from a new device or location

If someone monitors your email, phone, or devices, you may want to wait until you have a safe window. Consider changing settings when:

• You’re on a device they don’t have access to
• You’re somewhere they can’t see your screen
• You have at least 30 minutes of uninterrupted time

Important: If you change your password, Yahoo will sign you out of all other devices. The other person may notice they’ve been logged out.

What you’ll need

• Access to your Yahoo Mail account (via browser or app)
• Access to your current recovery email or phone (for verification)
• A new, secure recovery email address (recommended)
• A phone number only you can access
• Approximately 30-45 minutes of uninterrupted time

Consider doing first

• Setting up a completely new email address that only you know about
• Checking your phone isn’t being monitored (see our mobile guides)
• Using a private or incognito browser window
• Clearing your browser history after you’re done

Quick Contacts

What to say if you need to contact Yahoo support:

“I believe someone else has access to my account without my permission. I need to secure my account and remove their access.”

If you need to explain more:

“I’m in a difficult personal situation and need to make sure only I can access my email account.”

Note: Yahoo primarily offers self-service support through their Help Centre. For compromised accounts, they have specific recovery processes but limited phone support.

Check Who Has Access

Recent activity and sign-in history

Yahoo keeps a record of recent sign-ins to your account. This is one of the most important things to check:

1. Go to login.yahoo.com/account/security
2. Sign in if prompted
3. Click Recent activity
4. Review the list of sign-ins

What to look for:

• Locations you don’t recognise
• Devices you don’t own (check device names and types)
• Sign-ins at times when you weren’t using your account
• Multiple sign-ins from different locations at similar times

Understanding the activity log:

• Each entry shows the device type, location, and time
• Locations are approximate based on IP address
• Mobile data can show unusual locations even when it’s you

Check email forwarding

A common way to monitor someone’s email is to set up automatic forwarding. Every email you receive gets sent to another address without you knowing.

To check forwarding in Yahoo Mail:

1. Open Yahoo Mail
2. Click the Settings icon (gear/cog) in the top right
3. Click More Settings
4. In the left menu, click Mailboxes
5. Look for Forwarding settings
6. Check if any forwarding addresses are listed

If you find an address you don’t recognise:

• Note down the address (it may be useful evidence)
• Remove it by clicking the delete/remove option
• Change your password immediately after

Check filters and rules

Filters can be set up to automatically move, delete, or forward specific emails—potentially hiding messages from you.

To check filters:

1. Open Yahoo Mail
2. Click the Settings icon (gear/cog)
3. Click More Settings
4. Click Filters in the left menu
5. Review all active filters

What to look for:

• Filters that forward emails to another address
• Filters that delete emails from specific senders
• Filters that move emails to folders you don’t check
• Any filters you don’t remember creating

Check connected apps and app passwords

Other apps and services may have permission to access your Yahoo account.

To check connected apps:

1. Go to login.yahoo.com/account/security
2. Scroll to Connected apps
3. Review the list of apps with access

To check app passwords:

App passwords are special passwords that allow apps to access your account even with two-factor authentication enabled.

1. Go to login.yahoo.com/account/security
2. Look for Generate app password or App passwords
3. Review any existing app passwords

What to look for:

• Apps you don’t recognise or don’t use
• App passwords you didn’t create
• Old email clients or apps you no longer use

Remove Unwanted Access

Sign out of all devices

This will immediately log out anyone else who might be signed in to your account:

1. Go to login.yahoo.com/account/security
2. Click Recent activity
3. Look for Sign out of all devices or review individual sessions
4. Click to sign out of specific devices or all devices

Important: This will also sign you out, so you’ll need to sign back in on your own devices.

Remove connected apps

1. Go to login.yahoo.com/account/security
2. Click Connected apps
3. Click on any app you want to remove
4. Click Remove access or Revoke

Delete app passwords

1. Go to login.yahoo.com/account/security
2. Find the App passwords section
3. Delete any app passwords you didn’t create or no longer need

Note: After deleting app passwords, any apps using them will stop working. You can create new app passwords later if needed.

Remove email forwarding

1. Go to Yahoo Mail Settings → More Settings → Mailboxes
2. Under Forwarding, remove any addresses you didn’t add
3. Save your changes

Delete suspicious filters

1. Go to Yahoo Mail Settings → More Settings → Filters
2. Delete any filters you don’t recognise
3. Save your changes

Change your password

This is essential—do this after removing other access:

1. Go to login.yahoo.com/account/security
2. Click Change password
3. Enter your current password
4. Create a new, strong password

Choosing a secure password:

• Use at least 12 characters
• Mix uppercase and lowercase letters, numbers, and symbols
• Don’t use personal information (names, birthdays, addresses)
• Don’t use passwords you’ve used before
• Don’t use passwords the other person might guess
• Consider using a password manager

Lock Down Your Account

Enable two-step verification (2FA)

Two-step verification means that even if someone knows your password, they can’t log in without also having access to your phone.

To enable two-step verification:

1. Go to login.yahoo.com/account/security
2. Click Two-step verification
3. Click Enable two-step verification
4. Choose your verification method:
   • Text message (SMS): A code is sent to your phone
   • Authenticator app: Use an app like Google Authenticator or Authy
5. Follow the prompts to complete setup

Which method is safer?

• Authenticator app is more secure than SMS (text messages can potentially be intercepted)
• However, SMS is still much better than no two-factor authentication
• Choose whichever method you can reliably access

Important: Make sure the phone number used is one that only you have access to. If the other person has access to your phone or can intercept your texts, two-step verification won’t protect you.

Consider Yahoo Account Key

Yahoo Account Key is a passwordless login method. Instead of typing your password, you approve sign-ins through the Yahoo app on your phone.

Advantages:

• No password to remember or type
• Each sign-in requires your approval
• You’re notified of every sign-in attempt

Disadvantages:

• Requires the Yahoo app on your phone
• If someone has access to your phone, they could approve sign-ins
• May not be suitable if your phone is monitored

To enable Account Key:

1. Download the Yahoo Mail app on your phone
2. Sign in to your Yahoo account in the app
3. Go to login.yahoo.com/account/security
4. Click Account Key
5. Follow the prompts to enable it

Consider carefully: Only enable Account Key if you have complete control over your phone. If the other person has access to your phone or could unlock it, this feature could make things worse rather than better.

Review and update recovery options

Recovery email and phone numbers are used to reset your password if you get locked out. If someone else has access to your recovery options, they could reset your password and take over your account.

To review recovery options:

1. Go to login.yahoo.com/account/security
2. Look at Account security section
3. Review your recovery email addresses and phone numbers

What to do:

• Remove any email addresses or phone numbers that the other person has access to
• Add a new recovery email that only you can access
• Add a phone number that only you control

Important considerations:

• If you remove all recovery options, you may struggle to get back into your account if you forget your password
• Consider setting up a new, private email address first to use as your recovery email
• Make sure your recovery phone number is one the other person can’t access

Review account information

Check that your personal information hasn’t been changed:

1. Go to login.yahoo.com/account/personalinfo
2. Review your name, birthday, and other details
3. Update anything that’s incorrect

Get Confidential Support

Yahoo’s support options

Yahoo primarily offers self-service support through their Help Centre at help.yahoo.com. They have guides for:

• Securing a compromised account
• Recovering account access
• Understanding security features

For compromised accounts:

1. Go to help.yahoo.com
2. Search for “compromised account” or “account hacked”
3. Follow the steps in the guide
4. You may need to verify your identity

Limitations of Yahoo support

Unlike some services, Yahoo has limited live support options. Most issues need to be resolved through:

• Self-service security tools
• Automated account recovery processes
• Help Centre articles

If you’re unable to secure your account yourself, you may need to consider starting fresh with a new email address (see “Starting Fresh” below).

If You’re Locked Out

Using the Sign-in Helper

If you can’t sign in to your Yahoo account:

1. Go to login.yahoo.com/forgot
2. Enter your Yahoo email address
3. Yahoo will offer recovery options based on your account:
   • Text a code to your recovery phone
   • Email a code to your recovery email
   • Answer security questions (if set up)

If your recovery options are controlled by someone else

This is a difficult situation. Options include:

1. Try all available recovery methods - Yahoo may offer multiple options
2. Use the automated account recovery - This may take time and require identity verification
3. Consider creating a new email account - Sometimes starting fresh is the safest option (see “Starting Fresh” below)

If someone has changed your password

1. Go immediately to login.yahoo.com/forgot
2. Try to recover your account before they change the recovery options
3. If successful, immediately:
   • Change your password again
   • Enable two-step verification
   • Review and update all recovery options
   • Sign out of all devices

Starting Fresh

Sometimes the safest option is to create a completely new email account. This is especially true if:

• You’re not sure what access the other person has
• They may have set up access you can’t find
• You want a clean start without any hidden surveillance
• You can’t recover your old account

When to create a new account

Consider a new email if:

• Your current email has been monitored for a long time
• You’re not confident you’ve removed all access
• The other person knows your email address and might try to recover access
• You want an email address the other person doesn’t know about

Setting up a new Yahoo account safely

1. Use a private browser - Open an incognito/private browsing window
2. Go to login.yahoo.com
3. Click “Create an account”
4. Choose a new email address - Pick something that doesn’t include your name or obvious personal details
5. Use a phone number only you control - This is important for recovery
6. Use a strong, unique password - Different from any password you’ve used before
7. Enable two-step verification immediately after creating the account
8. Don’t link it to your old account - Keep it completely separate

Transitioning to a new email

When moving to a new email:

• Be strategic about what you update - changing your email address on some accounts might trigger notifications
• Prioritise bank accounts, government services, and other critical accounts
• Consider timing - you may want to update accounts gradually or all at once depending on your situation
• Don’t forward your old email to the new one (this could reveal the new address)

Keeping your new email private

• Don’t tell anyone who might share it with the other person
• Use it only for important accounts, not newsletters or shopping
• Consider using a different name or pseudonym if your situation requires it
• Don’t access it on shared devices

Red Flags That Suggest Compromise

Watch for these warning signs that someone may have access to your email:

Signs of monitoring

• Someone knows about emails you’ve received before you’ve mentioned them
• Someone references private conversations from your emails
• Important emails seem to “disappear”
• You find emails marked as read that you haven’t opened

Signs of account access

• Password reset emails you didn’t request
• “New sign-in” alerts from locations or devices you don’t recognise
• Your password suddenly stops working
• Security settings have been changed without your knowledge
• New recovery email addresses or phone numbers you didn’t add
• Emails in your “Sent” folder that you didn’t send

Signs of forwarding or filtering

• You stop receiving emails from certain people
• Important emails end up in spam or unusual folders
• Someone responds to emails before you’ve had a chance to

What to do if you see these signs

1. Don’t alert the other person that you’ve noticed
2. Document what you find (screenshot if safe to do so)
3. Follow the steps in this guide to secure your account
4. Consider whether it’s safer to secure your existing account or start fresh
5. Reach out to support services if you need help planning your next steps

Additional Support

Yahoo resources

• Yahoo Help Centre: help.yahoo.com
• Yahoo Account Security: login.yahoo.com/account/security
• Sign-in Helper: login.yahoo.com/forgot

External support

These organisations can provide advice and support:

• National Domestic Abuse Helpline: 0808 2000 247 (24hr, free, hidden on phone bills)
• Refuge: refuge.org.uk - Includes Tech Safety resources
• Women’s Aid: womensaid.org.uk
• Paladin National Stalking Advocacy Service: paladinservice.co.uk
• The Cyber Helpline: thecyberhelpline.com - Free cyber security advice for individuals

Technology safety resources

• Refuge Tech Safety: Information about technology-facilitated abuse and how to stay safe
• National Network to End Domestic Violence (Safety Net): Resources on technology safety

Last verified: December 2025

If anything on this page is out of date, please contact us.