Bank email changed without permission: what to do

An email address changed without your permission can be a sign of account takeover. Treat it as urgent even if no money has left the account yet, because contact details are used for alerts, password resets and security communication.

Secure the bank login and the email account together

If a criminal controls your email, resetting only the banking password may not be enough. Change the email password from a trusted device, sign out other sessions where the provider allows it and enable strong multi-factor authentication.

At the bank, ask whether the email change was made through online banking, by phone or another channel, and whether any other profile details - mobile number, address, payees or card controls - changed at the same time.

Use the official app to freeze cards if you still have safe access, or ask the bank to block them. Tell the bank if you see unfamiliar transfers, new payees or authentication prompts.

Do not move money to a 'safe account' because someone calls after the change. Fraudsters can create a real problem and then impersonate the bank to 'solve' it.

A useful first step is to put four facts on one line: the time you first noticed the change, the last login you recognise, whether your phone number or recovery details also changed and whether any payment limits or beneficiaries look unfamiliar. That small record prevents the most common mistake in this situation, which is acting on an assumption before the current status is clear. Use the provider's live information for anything that can change, and keep the figures you actually relied on.

Final verification for an unauthorised change to the email on a bank account: before you treat this step as complete, compare the provider's confirmation with the next real account event. This keeps the follow-up focused on the unresolved fact under "Secure the bank login and the email account together" rather than reopening every part of the issue.

Preserve the evidence and review payment access

Take screenshots of the email-change alert, unusual login notices and transaction list. Write down when you first noticed the problem and every contact with the bank. Do not include one-time codes in screenshots you later share.

Check the email account's forwarding rules and recovery addresses. Attackers sometimes add a hidden forwarding rule so they continue receiving bank messages after you change the password.

Look for changes to savings withdrawals, card limits, personal details and linked devices. Also check whether the compromised email is used for shopping, mobile-phone or cloud accounts that could be used to reset banking credentials again.

If a SIM swap or phone takeover is suspected, contact the mobile provider. A bank security reset is fragile if the attacker still controls the number used for codes.

A worked scenario makes the risk easier to see. you receive a bank alert at 14:10 saying the registered email was changed, but you made no profile change. Use a known bank number or the app you opened independently, lock payment capability if available, then secure the email account from a clean device before deleting any alerts. The important point is the sequence, not the exact number. Use your own amount and dates, then leave enough margin for a delay, a verification check or a posting difference instead of planning to the last pound or the last minute.

Check linked products and recovery details

Report payments you did not authorise and give the bank the timeline of the profile change. The bank will investigate under the applicable payment and fraud rules. If its handling is poor, keep the complaint reference and final response.

The goal in the first hour is containment, not attribution. You do not need to know exactly how the attacker got in before you ask the bank and email provider to close the access route.

After securing the bank, review the email provider's recovery phone, backup email, app passwords and authorised devices. Attackers sometimes leave a secondary route so they can regain access after you change the main password.

Also review other financial accounts that use the same email. A compromise that reached one bank can be used to target savings, investments or payment apps through password-reset messages.

Build a small audit trail: screenshots of the profile change, security-alert emails, login-history entries, unfamiliar beneficiary details, device notifications and the bank's case or fraud-reference number. You do not need a large dossier, but you do need enough to show what was expected, what actually happened and when you contacted the provider. That distinction is especially important when an automated status, pending item or verbal assurance later changes.

Escalate unexplained changes as a security incident

An email address is part of the recovery path for many banking accounts. If it changes without your permission, do not treat it as a harmless profile error. Contact the bank through the number in its app, on your card or on its official website, and tell it that a personal detail changed without authorisation. At the same time, secure the email account that was previously linked to the bank: change its password, end unknown sessions and strengthen sign-in protection.

Then review recent banking activity and other profile changes. A fraudster who has altered the email may also have tried to change a telephone number, add a payee or reset security credentials. Even if no money has moved, ask the bank to record the incident and confirm which contact details it now holds. The absence of a fraudulent payment is good news, but it is not proof that the attempted takeover has ended.

Treat a profile change you did not authorise as more than an address-book error. If money has moved, report the exact transactions immediately; if no money has moved, still ask the bank to restore the correct contact details and confirm whether any other security settings were changed. Close the loop by checking the next statement, confirmation or account status after the action. If the expected result does not appear, contact the provider with the evidence already assembled rather than starting the explanation from zero.

Sources and verification

• NCSC - Phishing guidance
• FCA - Consumer information
• Financial Ombudsman - Frozen accounts and blocked payments

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.