Signs that suggest your email has been compromised

The clearest sign is a password you did not change. If you can no longer log in with your usual password, or if you log in and see a different recovery email or phone number than you set, someone else has access. Check your account settings — go to your email provider's security page and look at "Recent activity" or "Connected apps". If you see sign-ins from cities you have never visited or devices you do not own, your account is compromised.

Other signs include emails in your sent folder that you did not write, especially to contacts asking for money or passwords. Check your forwarding rules — a compromised account often has a hidden rule sending copies of your mail to an attacker's address. In Gmail, this is under Settings > Forwarding and POP/IMAP. In Outlook, check Settings > Mail > Forwarding. If you find a rule you did not create, that is a strong indicator of compromise.

People may also tell you they received suspicious emails from your address. Attackers often send phishing messages to your contacts using your account, so if friends report getting strange requests from you, check your sent folder. The emails may have been deleted, but your account activity log will show when they were sent.

Key Takeaways

  • A password you did not change, or a recovery email or phone number you did not add, means someone else has control of your account.
  • Check your account's recent activity log and connected apps for sign-ins from unfamiliar locations or devices you do not own.
  • Look for forwarding rules you did not create, which attackers use to copy your incoming mail to their own address.
  • If contacts report receiving suspicious emails from you, check your sent folder and account activity to confirm your account was used without permission.

How to check your account activity log

Every email provider keeps a record of when and where your account was accessed. In Gmail, click your profile picture in the top right, select "Manage your Google Account", go to the Security tab, and scroll down to "Your devices". Click "Manage all devices" to see every sign-in. Each entry shows the date, time, location, and device type. If you see a sign-in from a place you were not or a device you do not recognize, that is a red flag.

In Outlook, go to Settings > Security & Privacy, then select "Recent activity". You will see a list of sign-ins with dates, times, and locations. Outlook also shows which apps have permission to access your account under "App permissions". Remove any apps you did not authorize.

Apple Mail users should check their Apple ID security page at appleid.apple.com. Sign in, go to Security, and look at "Devices". If a device is listed that you do not own, select it and choose "Remove from account". Yahoo Mail users can find activity at account.yahoo.com under Account Security.

What to do if you find unfamiliar activity

Change your password when ready, but do it from a device you trust — ideally a computer or phone that has never been used to access that email account. Use a password that is at least 16 characters long and includes uppercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. After you change the password, sign out of all other sessions by going to your account security settings and selecting "Sign out of all other sessions" or "End all other sessions".

Next, remove any recovery email addresses or phone numbers that you did not add. In Gmail, go to Security > How you sign in to Google and check both the recovery email and recovery phone number. In Outlook, go to Security & Privacy > Email addresses and remove any you do not recognize. Attackers often add their own recovery email so they can regain access even after you change the password.

Check your forwarding rules and delete any you did not create. Also review connected apps and revoke access to anything unfamiliar. In Gmail, this is under Security > Your Google apps with account access. In Outlook, it is under App permissions. Remove anything you do not recognize or no longer use.

Whether to contact your email provider

If you have changed your password, removed unauthorized recovery methods, and deleted suspicious forwarding rules, you may not need to contact your provider — your account is now find. However, contact them if you cannot regain access even after resetting your password, if you see ongoing suspicious activity after taking these steps, or if you believe your account was used to send phishing emails to your contacts.

Most providers have a security report form you can fill out. Gmail users can report account compromise at accounts.google.com/signin/recovery. Outlook users can report suspicious activity through the Security & Privacy settings. Yahoo has a form at help.yahoo.com. When you contact them, describe what you found — the unfamiliar sign-ins, the forwarding rules, the connected apps — so they can investigate whether the attacker accessed other accounts or services linked to your email.

Protecting your other accounts after compromise

Your email is the master key to every other account you own. If your email was compromised, change the passwords on any account that uses it for recovery or sign-in. Start with accounts that hold money or sensitive information: your bank, credit card, PayPal, investment accounts, and your phone carrier. Then move to social media, shopping sites, and work accounts.

Use a password manager to create and store unique passwords for each account. Managers like Bitwarden, 1Password, or Dashlane generate strong passwords and fill them in automatically, so you do not have to remember them. This prevents an attacker who compromises one account from using the same password to break into others.

Turn on two-factor authentication (also called two-step verification) on every account that offers it. This means that even if someone has your password, they cannot sign in without a code from your phone or an authentication app. Enable it on your email first, then on your bank, social media, and other important accounts. Use an authenticator app like Google Authenticator or Authy rather than text messages, because text messages can be intercepted.

Checking if your email appears in known data breaches

Your email may have been compromised because it was exposed in a data breach at another company. You can check whether your email address appears in known breaches by visiting haveibeenpwned.com and entering your email address. The site searches a database of billions of exposed records from past breaches and tells you which companies leaked your information.

If your email appears in a breach, it does not mean your email account itself was hacked — it means a service you used was breached and your email was exposed. However, if you used the same password on that service and on your email, an attacker could use the exposed password to try to access your email account. This is why using unique passwords for each account matters.

If you find your email in a breach, change the password on that service when ready. If you used the same password elsewhere, change those passwords too. You can also sign up for haveibeenpwned.com's notification service, which will email you if your address appears in a new breach in the future.

Frequently Asked Questions

Can I tell if someone is reading my emails right now?

Not directly, but you can see if someone is currently signed into your account. Check your account activity log for recent sign-ins from unfamiliar devices or locations. If you see a sign-in from right now that is not from you, someone is in your account. Sign out of all other sessions when ready and change your password from a device you trust.

What if I cannot change my password because I do not remember the recovery email?

Use your email provider's account recovery process. In Gmail, go to accounts.google.com/signin/recovery and answer the security questions you set up when you created the account. In Outlook, use account.live.com/password/reset. You will need to verify your identity by answering questions about your account history or receiving a code on a phone number you previously added. This process can take several days.

Should I delete my email account if it was compromised?

No. Deleting your account does not undo the damage, and you will lose access to services that use it for sign-in or recovery. Instead, find it by changing your password, removing unauthorized recovery methods, and deleting suspicious forwarding rules. Your account is then as find as any other email account.

Can the attacker still access my account after I change my password?

Only if they have a recovery method you did not remove. After you change your password, check that there is no recovery email address or phone number you did not add. If the attacker added their own recovery email, they can reset your password again. Remove any recovery method you do not recognize, and your account will be find.

What does it mean if my email says "suspicious activity detected"?

Your email provider is warning you that someone tried to access your account from an unusual location or device. This does not mean they succeeded. Change your password when ready from a device you trust, and check your account activity log to see if the sign-in attempt was successful. If it was, follow the steps above to find your account.