Signs Your Email Has Been Hacked
How to tell if someone has access to your email: messages you did not send, strange rules, security alerts, missing emails and password resets. What to check and what to do next.
Some email takeovers are loud: the password stops working and friends call about strange messages. Others are quiet: someone reads your email for weeks, watching for invoices, password resets and bank details. Here are the signs to look for, from obvious to subtle.
Obvious signs
- Your password no longer works and you did not change it.
- Friends receive messages you did not send, often asking for money or containing links.
- Security alerts about sign-ins from new devices or places.
- Password reset emails from other services you did not request.
Quieter signs
- Emails in your sent folder you do not recognise, or a sent folder that has been emptied.
- Missing emails, especially from banks, payment services or your email provider.
- New forwarding or filter rules, sending mail elsewhere or deleting it. See malicious email rules.
- Changed recovery phone or email, or a changed signature or auto-reply.
- Unfamiliar connected apps or devices in your account settings.
- Read emails you have not opened.
Spoofing vs hacking: if contacts receive spam "from you" but it is not in your sent folder and your account activity looks normal, the sender address may simply have been faked. Still, check your security settings to be sure.
How to check properly
- Sign in through the official app or website, not a link.
- Review recent security activity: sign-ins, devices, locations.
- Check settings: forwarding, filters, recovery details, connected apps. See checking sessions and connected apps.
- Look at your sent and deleted folders.
- Check breach services to see if your address appears in known leaks. See how to check.
If you find signs
- Change your password from a trusted device.
- Turn on two-step verification.
- Sign out of all sessions and remove unknown devices and apps.
- Remove unknown rules and fix recovery details.
- Warn your contacts through another channel.
- Change passwords for accounts that reset through this email.
If you are locked out, see how to recover a hacked email account.
Got a strange message from a friend's email? Paste it into CyberWatch AI Scan for a free check, and let them know their account may be compromised.
For more, read our guide to identity theft and account security.
Frequently asked questions
My contacts got spam from my address. Am I hacked?
Possibly. Check your sent folder and recent sign-in activity. If the spam is not in your sent folder, the sender address may have been faked (spoofed) without access to your account.
Can someone read my email without me knowing?
Yes, if they have your password and there is no two-step verification, or through a forwarding rule or connected app. That is why checking sessions, rules and apps matters.
What should I do first if I think my email is hacked?
Change the password from a trusted device, turn on two-step verification, sign out of all sessions, and check forwarding rules and recovery details.
Sources
- How To Recover Your Hacked Email or Social Media Account, US Federal Trade Commission
- Recovering a hacked account, UK National Cyber Security Centre
- Have I Been Pwned, Troy Hunt
