My business email's been hacked. What now?

If your business email has been hacked, the first hour matters most: change the password and sign out every session, turn on multi-factor sign-in, check for forwarding rules the thief left behind, and tell your clients and suppliers that your bank details have not changed. If money has moved, ring your bank before anything else.

This happens to careful people, and it is fixable. The steps below follow the Australian Cyber Security Centre's advice, in order.

What it often looks like

A client texts you: "Just paid the new account like your email said." You never sent that email. You look in your Sent folder and there's nothing there, because whoever is in your mailbox deleted it after sending.

Do this in the next hour, member or not

  1. If money has moved, ring your bank now. Use the number on the back of your card or on their official website, not one from an email. Ask them to try to recall the payment. The sooner you call, the better the chance.
  2. Change your email password. Use a long passphrase you haven't used anywhere else, such as four or more random words. If you think the computer itself might be infected, do this from a different device you trust. Locked out because the password's already been changed? Use your email provider's account recovery from a device you trust, and if that fails, ring the provider or whoever set up your email.
  3. Sign out of every session. In your email account's security settings, sign out of all devices. That shuts out anyone still signed in with your old password.
  4. Turn on multi-factor sign-in. Signing in then needs a code from your phone as well as your password, so a stolen password alone won't get anyone back in. The government's guide walks you through it.
  5. Check forwarding and inbox rules. Thieves often add a rule that quietly copies your mail to them, or moves replies from certain clients out of sight. Delete any rule or forwarding address you don't recognise. In Outlook on the web, they're under Settings, Mail, Rules and Forwarding. In Gmail, under Settings, See all settings, Filters and Forwarding.
  6. Check your recovery details. Remove any backup email address or phone number that isn't yours, or the thief can reset your password again.
  7. Look through Sent, Drafts and Deleted items. Note anything you didn't write and who it went to. Those people are your first calls.
  8. Warn clients and suppliers. Ring the people who were emailed first, then send a short note to everyone else: your email was accessed, your bank details have not changed, and any message saying otherwise is fake. Ask them to ring you on a number they already have before paying anything new.
  9. Report it. Report to the Australian Cyber Security Centre through ReportCyber at cyber.gov.au, or ring the 24/7 hotline on 1300 CYBER1 (1300 292 371). If money was lost, report it to Scamwatch as well.

Once the hour is over, change the password on any other account that used the same one, and turn on multi-factor sign-in there too.

Making it much less likely next time

  • Multi-factor sign-in on every account that matters: email, banking, accounting software.
  • A different password for each account, kept in a password manager, so one leak doesn't open everything.
  • A standing rule for your business: bank details never change by email. Say so on your invoices.

If you'd rather it was simply done

Picture that empty Sent folder again. On Cyber Plus and Cyber Max your mailbox is backed up, so we bring back what the thief deleted and you can see exactly what went out in your name. And when an invoice that looks off lands in your own inbox, it's one forward away from a person telling you whether it's real. WISECLICK is a cybersecurity membership for Australian businesses of one to five people, from $59 a month.

  • A second opinion before anyone pays. Members forward any email or invoice that looks off, and a person checks it and replies the same business day.
  • Alerts that reach a team. Security software runs on each computer and a phone, and every alert comes to our team as it happens. We work out what happened, then fix it, and the fix is part of the membership.
  • Your mailbox backed up. On Cyber Plus and Cyber Max, your Microsoft 365 email, OneDrive, SharePoint and Teams are backed up. If a thief deletes mail to cover their tracks, ask, and we restore it for you.

AUD, GST included. Cancel any time.

See membership plans

Or start with your Cyber Report Card

Questions

How did they get in?

Most often with a password that was reused somewhere else or typed into a fake sign-in page. Multi-factor sign-in is what stops that working next time.

Will my bank get the money back?

Sometimes, if you call quickly. It isn't guaranteed, which is why the bank is step one.

Do I have to tell my clients?

Telling them protects them, and it protects your invoices. The Australian Cyber Security Centre recommends alerting customers, colleagues and suppliers so they ignore fake emails about changed bank details.

Who's behind it

WISECLICK (wise.click) is a cybersecurity membership for Australian businesses of one to five people. WISECLICK Pty Ltd is a Sydney company at 56 Pitt Street, built by people who have run IT for Australian businesses since 2004.

Sources

Last reviewed 28 October 2026. The client's text message is an illustration, not a member's case.

Related