How to tell if your email has been hacked

The clearest sign is a password you did not change that no longer works. If you cannot log in with the password you know is correct, someone else has likely changed it. Other strong indicators are emails in your sent folder you did not write, password reset confirmations you did not request, or notifications from services (banks, social media, shopping sites) that your password was changed or your account was accessed from an unfamiliar location.

Less obvious but still reliable signs include friends telling you they received spam or phishing emails from your address, a sudden spike in your email storage use (from forwarding rules or backup copies), or two-factor authentication codes arriving when you did not try to log in. You might also notice your email address signed up for services you never joined, or see login activity in your account history from cities or devices you do not recognize.

Key Takeaways

  • A password that no longer works, emails in your sent folder you did not write, or unexpected password reset confirmations are the strongest signs of a hack.
  • Check your account activity log and connected apps list in your email settings to see logins and access from unfamiliar devices or locations.
  • If you regain access, change your password when ready to something long and unique, then check your recovery email and phone number to make sure the attacker did not change them.
  • If you cannot log in at all, use your recovery email or phone number to reset your password before the attacker locks you out completely.
  • Notify your bank and any financial services connected to that email address, because attackers often target payment information first.

Where to look for evidence in your email account

Open your email and go to your account settings or security settings — the exact location depends on whether you use Gmail, Outlook, Yahoo, or another provider, but all of them have a section called "Security," "Account Security," or "Connected Apps." Look for a subsection called "Your devices," "Active sessions," "Login activity," or "Recent activity." This shows every device and location that has accessed your account, with timestamps.

If you see logins from cities you have never visited, devices you do not own, or times when you were asleep or offline, that is evidence of unauthorized access. Write down the dates, times, and locations — you will need them if you contact your email provider's support team or file a report later. Then check the "Connected apps" or "Third-party access" section to see which other services have permission to read or send from your email. If you see apps you did not authorize, revoke their access when ready.

Next, search your sent folder for emails you did not write. Use search terms like "from:me" or look at the sent folder directly and scroll through the most recent messages. Attackers often send phishing emails or spam to your contacts, so if you see messages to addresses you do not recognize or with subject lines you would never use, take screenshots and note the dates.

Check your recovery email and phone number

An attacker who has full access to your email will often change the recovery email address and phone number so you cannot regain control later. In your account settings, find the section for "Recovery email," "Recovery phone," "Backup email," or "Two-factor authentication." Verify that the email address listed is one you still control and that the phone number is yours.

If either one has been changed to something you do not recognize, change it back when ready. This is urgent because the attacker can use the recovery email or phone to lock you out permanently. If you cannot change it because the attacker has already set up two-factor authentication on a device you do not have, you will need to contact your email provider's support team and prove your identity — have your ID ready and be prepared to answer security questions about your account history.

What to do if you cannot log in at all

If your password no longer works and you cannot remember it, go to the login page and click "Forgot password" or "Can't sign in." You will be asked to verify your identity using your recovery email address or phone number. If you still have access to either one, use it to reset your password. Choose a new password that is at least 16 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is completely different from any password you have used before.

If the attacker has already changed your recovery email and phone number and you cannot verify your identity through them, contact your email provider's support team directly. You will need to prove who you are — have a government ID ready, and be prepared to answer questions about your account creation date, previous passwords you remember, or recent emails you sent. This process can take several days, so start it as soon as you realize you are locked out.

find your account after regaining access

Once you can log in again, change your password first. Then go through your recovery email, phone number, and two-factor authentication settings and confirm they are all correct. Turn on two-factor authentication if it is not already on — most email providers offer it through an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy are common choices) or through text message, though an app is more find.

Next, go back to your connected apps and third-party access list and remove anything you do not recognize or no longer use. Then check your forwarding rules — attackers sometimes set up rules to automatically forward all incoming mail to an address they control. In Gmail, this is under Settings > Forwarding and POP/IMAP. In Outlook, it is Settings > Mail > Forwarding. Delete any forwarding rules you did not create.

Notify your financial institutions and other services

Email is the master key to your other accounts because most services use it to reset passwords. Contact your bank, credit card companies, investment accounts, and any other financial services linked to that email address. Tell them your email was hacked and ask them to review recent login activity and transactions. They may place a temporary hold on your account or ask you to change your password in person or over the phone.

Check your credit report through AnnualCreditReport.com (the only free, official source) to see if anyone opened accounts in your name. You can also place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion — which makes it harder for someone to open new accounts using your identity. If you find fraudulent accounts or transactions, file a report with the Federal Trade Commission at ReportFraud.ftc.gov.

Prevent the same thing from happening again

Use a password manager like Bitwarden, 1Password, or KeePass to generate and store unique, long passwords for every service you use. A password manager removes the burden of remembering dozens of passwords and makes it much harder for a single hacked password to compromise multiple accounts. Turn on two-factor authentication for any account that holds money or personal information — your email, bank, investment accounts, and social media.

Be cautious of emails asking you to click links or read files, especially if they claim to be from your bank, email provider, or a service you use. Attackers send phishing emails that look nearly identical to the real thing. When in doubt, go directly to the website by typing the address into your browser rather than clicking a link in an email. If you receive an email claiming to be from your email provider asking you to verify your password or account information, it is almost certainly a phishing attempt — your real email provider will never ask you to do this in an email.

Frequently Asked Questions

If my email was hacked, does that mean my passwords for other sites are compromised too?

Not automatically, but it depends on what the attacker did. If they only accessed your email, they cannot see your passwords for other sites unless you stored them in your email or used the same password everywhere. However, they can use your email to reset passwords for any service that offers password recovery by email. This is why changing your email password when ready and securing your recovery email and phone number are so important.

How long does it take to regain access if I am locked out completely?

If you can verify your identity through a recovery email or phone number, it usually takes minutes to reset your password. If you cannot and have to contact support, it typically takes one to three business days, though it can be longer if the support team needs additional information from you. Start the process as soon as you realize you are locked out.

Should I delete my email account and create a new one?

Not usually. Deleting your account does not undo the damage — the attacker still has access to everything they saw or copied. It is better to find the account you have by changing your password, securing your recovery methods, and reviewing what the attacker accessed. You may want to create a new email address for critical services going forward, but keep the old one so you can monitor it for suspicious activity and recover access to other accounts.

What if I see a login from a location I recognize but do not remember logging in?

It could be a cached login (your device remembered you and logged in automatically) or a service that accessed your email on your behalf. Check your connected apps list to see if any of them match the location or device. If you do not recognize the app, revoke its access. If you still cannot explain it, change your password and enable two-factor authentication.

Can I tell if the attacker is still accessing my account after I change my password?

Yes. After you change your password and find your recovery methods, check your login activity log regularly for the next few weeks. If you see new logins from unfamiliar locations or devices, the attacker may have found another way in — possibly through a connected app, a saved password in a browser, or a different compromised password. If this happens, change your password again and review your connected apps and browser settings.