Proton Mail temporarily locked my account for security reasons

Proton Mail’s security systems automatically detect and flag suspicious behavior that might indicate an attacker is trying to access your account. 

If we think it necessary, Proton Mail may take additional measures to block the potential attacker:

1. We may prevent all sign-ins to your account until you can prove your identity with a verification code sent to your recovery email address or phone number.

2. We may require you to change your password once you have logged in to your account. You will be unable to read or send emails until you do this, although emails will still be received into your account.

Depending on the circumstances, we may put one or both of these restrictions in place. 

How was my account compromised?

An attacker may get your password through one of these methods:

• Leaked shared password: If you used your Proton Mail password with a different service, your password might have been leaked or sold if the other account was breached. Your password can’t be leaked from Proton Mail because Proton Mail never stores your password.
• Phishing: You entered your password on a website designed to look like Proton Mail.
• Keylogger: Your computer or your mobile phone was compromised by malware.

It is also possible for our automated systems to lock you out of your account in error. This can happen if you use another VPN service (not Proton VPN), Tor, or if you are on the same network as someone who has been blocked by Proton for violating our terms and conditions (for example, if you use your work or college WiFi). 

How to unlock your account

1. Verification code

Before logging in to your account, you may be asked to enter a code sent to your recovery email address or phone number. This will only happen if:

• You have set a recovery email address or phone number(nuova finestra) and
• You have not enabled two-factor authentication(nuova finestra)

To log in to your account, simply enter the 6-digit verification code you were sent, and click Verify account. 

Once logged into your account, you will need to change your password (see below).

2. Change your account password

When you log in to your account at mail.proton.me(nuova finestra), we will prompt you to change your password if we think it has been compromised. This happens whether or not you were asked to enter a verification code before logging in.

Changing your password will log you out of all your other sessions, so the attacker will no longer be able to access your account.

You should change your password as soon as you see the warning above, or you risk allowing the attacker to change your password and completely lock you out of your account. Please get in touch with our Customer Support team(nuova finestra) if this happens. 

Until you change your password, you will not be able to read emails in your inbox or send emails.

To unlock your account:

1. Click Settings → All settings → Account → Account and password → Passwords → Password → Change password.

2. Enter your old password in the Old password field.

3. Enter your new password in the New password and Confirm new password fields and click Save.

Change your password to a strong password(nuova finestra) that you haven’t used before with Proton Mail or any other accounts.

Do not reuse your Proton Mail password with other services, and be careful of phishing attacks(nuova finestra). 

Note that all legitimate emails from Proton will have an Official badge. If an email claims to come from us and doesn’t have this badge, it is likely a phishing attempt.

To strengthen your account security, we recommend that you also enable two-factor authentication(nuova finestra).

Use Proton Mail’s security checklist (nuova finestra)for new account owners to maximize your account security. You can also set account recovery methods in case you forget your Proton password.