How to Tell If Your Email Has Been Hacked
The clearest sign your email has been hacked is activity you did not do: emails in your sent folder you never wrote, password reset confirmations you never requested, or login alerts from places you have never been. Check your sent folder first — if there are messages there from times you were not at your computer, someone else has access. Look at your login history next, usually found in account settings under "Security" or "Recent activity". Most email providers show the device type, location, and time of each login. If you see logins from cities you have never visited or devices you do not own, your account is compromised.
A second set of signs appears in your account settings themselves. If your recovery email address or phone number has changed without your action, someone has already moved to lock you out. If two-factor authentication is turned on but you never set it up, or turned off but you never disabled it, your account has been accessed. Check your connected apps and devices too — in Gmail this is "Connected apps & sites", in Outlook it is "Manage your devices". If you see unfamiliar apps or devices with permission to read your email, that is active unauthorized access.
A third category is indirect: people tell you they received strange emails from you, your contacts report spam, or you get password reset emails for accounts you do not use. These mean your email is being used to send messages or reset other accounts, even if you can still log in normally. This happens because hackers often keep access running in the background while you use the account normally.
Key Takeaways
- Check your sent folder and login history first — emails you did not write or logins from unknown locations are the strongest proof of a breach.
- Look at your recovery email, phone number, and two-factor authentication settings; if these changed without your action, someone has admin-level access.
- Review connected apps and devices in your security settings to spot unauthorized tools that can read your messages.
- If contacts report receiving spam from you or you get password resets for accounts you do not use, your email is being used to attack other accounts.
- Act within hours of noticing these signs — hackers use email access to reset passwords on banking, social media, and shopping accounts.
Check Your Sent Folder and Email History
Open your email and go directly to the Sent folder. Look for messages with dates and times when you were definitely not at your computer. Pay attention to the recipient addresses — hackers often send to random addresses or to your own contacts. If you find even one email you did not write, stop and assume your account is compromised. Do not delete these emails yet; they are evidence you may need if you contact your email provider's support team.
Next, look at your login history. In Gmail, go to your account, select "Security" on the left, scroll to "Your devices", and click "Manage all devices". In Outlook, go to "Security", then "Recent activity". In Yahoo Mail, go to "Account info", then "Security". These pages show every login with the date, time, device type, and location. If you see a login from a city you have never visited, a device you do not own, or a time when you were asleep, that is a hacker. Write down the dates and locations — you will need them if you contact support.
Review Your Account Settings for Unauthorized Changes
Hackers often change your recovery email or phone number first, so you cannot reset your password if they lock you out. Go to your account settings and find the section for recovery information. In Gmail it is under "Security" and labeled "How you sign in to Google". In Outlook it is under "Security" and called "Security info". Check that the recovery email address is one you recognize and control. If it shows an email you do not own, change it back when ready. Do the same for your phone number — if it is not your number, update it.
Next, check two-factor authentication. This is a security feature that requires a code from your phone when you log in from a new device. If you never turned this on but it is active, a hacker set it up to lock you out. If you turned it on but it is now off, someone disabled it to make future logins easier for them. Go to your security settings and verify the status matches what you remember doing. If your phone number is listed for two-factor codes but it is not your number, change it or turn the feature off and back on with your correct number.
Look for Connected Apps and Devices with Unauthorized Access
Email providers let you connect other apps — like your phone, a calendar app, or a password manager — so they can read your email and send messages on your behalf. Hackers do the same thing. Go to your connected apps section. In Gmail, this is under "Security" and labeled "Third-party apps with account access". In Outlook, go to "Security" and select "App permissions". In Yahoo Mail, go to "Account info", then "Security", then "Connected apps & services". Look at every app listed. If you see something you do not recognize — especially apps with names like "Mail Backup" or "Cloud Sync" that sound generic — that is likely a hacker's tool.
Also check your connected devices. In Gmail this is the same "Manage all devices" page where you checked login history. In Outlook it is under "Security" and labeled "Devices". Look for phones, tablets, or computers you do not own. A hacker might connect an old phone or a virtual device so they can access your email anytime. If you see a device you do not recognize, click it and select "Remove" or "Sign out". Do this for every unfamiliar device and app before you change your password.
Ask Your Contacts If They Received Spam From You
Sometimes you will not notice your email is hacked because the hacker is careful. They might send spam only to a portion of your contacts, or only at night when you are asleep. The first sign often comes from a friend or family member who tells you they got a strange email from you. If this happens, take it seriously — it means your email is actively being used to send messages.
You can also check this yourself by looking at your sent folder again, but this time search for common spam words like "click here", "verify", "confirm", or "urgent". If you find emails with these words that you did not write, your account is being used for phishing attacks. Phishing emails try to trick people into giving up passwords or personal information. The fact that they came from your email address makes them more convincing to your contacts, which is why hackers target email accounts.
Check for Password Resets on Other Accounts
Hackers use compromised email accounts to reset passwords on other services. If you receive emails saying "Your password was reset" or "Confirm your identity" for accounts you do not remember changing, your email has been breached. These emails might come from your bank, social media, shopping sites, or streaming services. Each one means a hacker tried to take over that account using your email address.
Go through your email inbox and look for password reset confirmations from the last few weeks. If you find any you did not request, that is proof someone has access to your email. Do not ignore these — they mean hackers are actively trying to break into your other accounts. This is why changing your email password is not enough; you also need to check and find every account that uses your email for recovery.
What to Do when ready After You Confirm a Breach
If you have found signs of a hack, act quickly. First, change your email password from a different device — a phone or tablet, not the computer where the hack may have started. Use a password that is at least 16 characters long and includes numbers, uppercase letters, lowercase letters, and symbols. Do not use a password you have used before. Second, turn on two-factor authentication if it is not already on, and make sure the phone number is yours. Third, remove all unfamiliar connected apps and devices from your security settings.
Fourth, go through your other important accounts — banking, social media, shopping, email backup services — and change their passwords too. Use a different strong password for each one. Fifth, check your email recovery settings one more time to make sure the backup email and phone number are yours. Sixth, consider running a malware scan on your computer using a tool like Malwarebytes, because some hacks start with malware that logs your keystrokes. If you cannot regain control of your email, contact your email provider's support team with the dates and locations of unauthorized logins you found.
Frequently Asked Questions
Can a hacker read my emails if I change my password?
Not if you change your password and remove their connected apps and devices. Changing your password logs out all active sessions, including the hacker's. But if you do not remove the apps and devices they connected, they can log back in using those tools. That is why checking your connected apps section is as important as changing your password.
What if I cannot log into my email at all?
This usually means the hacker changed your password and recovery information to lock you out. Go to your email provider's login page and look for "Can't sign in?" or "Forgot password?". You will be asked to verify your identity using recovery information — an old password, a recovery email, or security questions. If you cannot answer these, contact your email provider's support team with proof of identity like a driver's license or a credit card statement.
Should I delete the unauthorized emails from my sent folder?
Not when ready. Keep them as evidence in case you need to contact your email provider or report the hack to law enforcement. Take screenshots of the sender, recipient, date, and subject line. After you have documented them, you can delete them. Deleting them right away removes proof that your account was compromised.
If my email was hacked, does that mean my computer has a virus?
Not necessarily. Hackers can breach email accounts through weak passwords, phishing emails, or data breaches at other websites where you reused your password. But it is possible malware on your computer logged your keystrokes or captured your password. Run a malware scan using Malwarebytes or Windows Defender to be safe. If malware is found, remove it and change all your passwords again from a different device.
How often should I check my login history to catch a hack early?
Check it once a month as part of regular account maintenance. Look for logins from unfamiliar locations or devices. If you travel frequently, you will recognize your own logins from different cities. But if you see a login from a country you have never visited, that is a sign of a breach. Monthly checks catch most hacks within a few weeks of when they start.