How to Tell If Your Email Has Been Hacked and What to Do

Last updated: October 8, 2026

Envelope with a warning badge beside a checklist of six warning signs that an email account has been hacked

Your email account is the master key to almost everything else you own online. Bank alerts, shopping receipts, social media logins and "forgot password" links all land in your inbox. If someone else gets into it, they can often reset the passwords of your other accounts too. That is why spotting a hacked email account quickly matters so much.

This guide shows the common warning signs, how to check whether someone has really been in your account, and what to do, in order, if they have. It covers Gmail, Outlook, Yahoo and iCloud Mail, with links to each provider's official help page.

Common Signs Your Email May Have Been Hacked

No single sign proves a break-in, but several together are a strong hint. Watch for these:

Friends say they received strange messages from you. Links, "urgent" requests for money or odd attachments sent to your contacts are a classic pattern.
Sent folder items you did not write. Sometimes attackers delete them, but often they forget.
Password reset emails you did not request. Someone may be trying to take over other accounts linked to your address.
Security alerts about new sign-ins. Notices from your provider about a login from a new device or place that you do not recognize.
Settings you did not change. A different recovery phone number or recovery email, a new signature, or a changed display name.
Missing emails. Messages disappearing, or bank and security alerts you expected never arriving, can mean filters are hiding them.
You are locked out. Your password suddenly stops working.

An occasional spam message is not a sign of a hack. Spammers often fake the "From" name on emails without ever touching your account. The difference: with a real hack, the messages appear in your own Sent folder or your provider shows unknown sign-ins.

Quick Reference: What Each Sign Means and What to Do First

Sign	What it may mean	First action
Strange messages sent to your contacts	Someone is sending mail from your account, or spoofing your name	Check your Sent folder and recent sign-in activity
Security alert about a new sign-in	Someone may have your password	Change your password and sign out other sessions
Recovery phone or email changed	An attacker is preparing to keep access	Restore your own details right away
Expected emails never arrive	A filter or forwarding rule is hiding or copying mail	Review filters, forwarding and delegation
Reset emails for other sites	Someone is using your inbox to take over other accounts	Secure your email first, then those accounts
Password no longer works	The account has been taken over	Use your provider's official recovery page

Step 1: Check Whether You Can Still Sign In

Open your provider's official sign-in page by typing the address yourself, or by using a bookmark you trust. Do not click a link in an email. If your password still works, go straight to Step 2 and change it right away. If it does not work, skip to the recovery section further down.

Step 2: Change Your Password Immediately

Create a new password that you have never used anywhere else. Make it long, ideally a passphrase of several unrelated words. If you need help, see our guide on creating a strong password you can actually remember. After changing it, look for an option in your account security settings to sign out of all other devices or sessions. The name varies by provider, but most have one. This kicks out anyone still logged in with the old password.

Step 3: Review Recent Account Activity

Most email providers let you see recent sign-ins:

Gmail: scroll to the bottom of your inbox and look for the "Last account activity" text with a "Details" link. Your Google Account's security section also lists your devices and recent security events. If an event was not you, Google's help page says to choose "No, it wasn't me" and follow the on-screen steps.
Outlook / Microsoft accounts: your Microsoft account's security area has a page for recent sign-in activity.
Yahoo and others: look for a "recent activity" or "devices" page in the account security settings.

Look for devices, locations or times that do not fit your life. A VPN can make your own location look odd, so one unusual city is not proof. Sign out of any device you do not recognize. Our guide on checking which devices and apps have access to your account walks through this for the major services.

Step 4: Look for Hidden Forwarding Rules and Filters

This is the step many people miss. A clever attacker may not lock you out at all. Instead they quietly set up a rule that forwards a copy of every incoming email to their own address, or automatically hides messages from your bank.

What to Check in Your Email Settings

Open your email settings and find the section about forwarding. In Gmail this is under the settings for "Forwarding and POP/IMAP". Remove any forwarding address you did not add.
Open the section for filters or rules. Delete any that automatically delete, archive or forward mail, unless you created them.
Check delegated access, the setting that lets another person read and send mail from your account. Google lists "Mail delegation: people with access to your Gmail" among the settings to correct if you see unfamiliar changes, and its delegation help page says a delegate can read, send and delete emails in your account. In Gmail, look under Accounts and Import → Grant access to your account, and remove anyone you do not know.
Check your signature and "reply-to" address for changes.
In Gmail, Google also suggests checking scheduled emails, the vacation responder, the name shown on your mail, blocked addresses, IMAP/POP access and labels. Our hacked Gmail recovery guide covers that full list.

Step 5: Check Recovery Information

Confirm that the recovery phone number and recovery email address are yours. Attackers sometimes replace them so they can get back in later. Fix anything that looks wrong, and make sure any backup or recovery codes you saved are still valid and stored safely.

Step 6: Turn On Two-Factor Authentication

Two-factor authentication (2FA) asks for a second proof, such as a code from an app, when you sign in. Even if someone learns your password, they cannot get in without that second step. An authenticator app or a hardware security key is generally stronger than a text message code. Our article on two-factor authentication explains the differences.

A password manager such as Bitwarden, Proton Pass or 1Password can generate and store a unique password for every account, so one leak cannot open other doors. See our comparison of the best free password managers if you are choosing one.

Step 7: Check the Accounts Connected to This Email

Think about which important accounts use this email address: banking, online shopping, cloud storage, social media, your phone company, and work tools. For each one, change the password and check for unfamiliar activity. Start with the most valuable, such as bank and payment accounts. If you see charges you do not recognize, contact your bank using the phone number on the back of your card.

You can also check whether your email address has appeared in a known data breach using the free service Have I Been Pwned (haveibeenpwned.com). A "found" result does not mean you were personally targeted. It means your details were included in a leak from some company, which is a good reason to make sure that password is not used anywhere now. Our guide to what to do when your email shows up in a data breach explains the next steps.

Step 8: Scan Your Devices

If your email was accessed because of malware, such as a keylogger that records what you type, changing your password from the same infected device will not help. Update your operating system and browser, then run a scan with a reputable security program. Built-in tools like Microsoft Defender are a sensible baseline, and tools such as Malwarebytes can be used as a second opinion.

Step 9: Warn Your Contacts

If scam messages went out from your account, send a short note from a secure account or another channel: tell people not to open the recent message and not to click any links. This protects them and limits the damage. If your Facebook account is also acting strangely, follow our steps to recover a hacked Facebook account.

What If You Are Locked Out?

Use your provider's official account recovery page. You will usually be asked for a previous password, a recovery email or phone, or details like when you created the account. Try recovery from a device and location you have used before, since that often helps. Answer as accurately as you can, and do not hurry. Be careful of anyone online who offers to "recover your account for a fee". These are frequently scams. The FTC's guide to recovering a hacked email or social media account has more detail.

Official Recovery Pages by Provider

Gmail / Google: start at Google's account recovery page, accounts.google.com/signin/recovery. Our Gmail recovery guide has Google's own tips for getting through it.
Outlook, Hotmail and other Microsoft accounts: Microsoft's guide to recovering a hacked or compromised Microsoft account starts with a malware scan, then a password reset, then a check of forwarding and automatic replies. If you cannot reset the password, Microsoft has an account recovery form at account.live.com/acsr. Its help page for the form says to fill it in from a device and location you normally use, that results are sent within 24 hours to a working email address you provide, and that you can try again up to two times per day if it fails.
Yahoo Mail: Yahoo's page on recognizing and securing a hacked account lists the steps: change your password, delete app passwords you do not recognize, update recovery options, revert changed mail settings and turn on two-step verification.
iCloud Mail / Apple Account: Apple's page If you think your Apple Account has been compromised explains how to change or reset the password and remove unknown devices. If you cannot reset it, Apple says to start account recovery at iforgot.apple.com, which includes a waiting period.

How to Reduce the Chance It Happens Again

Use a different password for every account.
Enable 2FA everywhere it is offered, starting with email.
Do not enter your password after clicking a link in an email or message. Go to the site directly. Our list of signs of a phishing email shows what to look for.
Keep your devices and apps updated.

Frequently Asked Questions

Can someone read my email without me knowing?

Yes, it is possible. If an attacker forwards your mail, has been added as a delegate, or stays signed in on another device, you might see no obvious sign. That is why checking activity, forwarding rules, delegation and connected devices is important.

Does getting spam mean I was hacked?

No. Spam usually comes from mailing lists that include your address. Being hacked means someone accessed your account.

Is it enough to change my password?

Not always. You should also sign out other sessions, remove forwarding rules and check recovery details. Otherwise an attacker may keep access.

Should I delete my email account?

Usually not. Deleting it can make things worse, as you would lose access to accounts tied to it. Secure it and keep it.

Should I pay someone to recover my account?

No. Use only the official recovery process of your email provider. Google, for example, says it does not work with any service that claims to provide account or password support.

Related Guides

Conclusion

A hacked email account feels alarming, but a calm, step-by-step response works. Change your password, sign out other devices, remove forwarding rules, filters and unknown delegates, verify recovery details, turn on 2FA, then secure the accounts linked to that address. Do these checks now, even if you only suspect a problem.

Search This Blog

Safe Sign In