How to Tell If Your Email Has Been Hacked

The clearest sign is a password that no longer works, or login attempts from places you don't recognize. Check your account activity log — most email providers show you where and when someone accessed your account, what device they used, and sometimes the location. If you see logins from cities you've never visited or devices you don't own, your account has been compromised. You can usually find this in your account settings under "Security" or "Connected apps and sites."

Other strong indicators include emails you didn't send in your Sent folder, password reset confirmations you didn't request, or contacts telling you they received strange messages from your address. If your recovery email or phone number was changed without your action, someone else has control of your account. These changes appear in your account settings and are harder to miss than a single suspicious login.

Key Takeaways

  • Check your account activity log for logins from unfamiliar locations or devices — this is the fastest way to confirm a breach.
  • Look for emails in your Sent folder you didn't write, or password reset requests you didn't make.
  • If your recovery email or phone number changed without your action, someone has administrative access to your account.
  • Weak passwords and reused passwords across multiple sites are the most common reasons accounts get hacked.
  • Changing your password when ready and enabling two-factor authentication stops most attackers from regaining access.

Where to Find Your Login Activity

Gmail shows your account activity in the lower right corner of the inbox — click "Details" next to "Last account activity." You'll see a list of all recent logins with the date, time, device type, and location. Outlook and Yahoo have similar features under account settings. Look for any entry that doesn't match your normal pattern: a login at 3 a.m. when you sleep, or from a country you've never visited.

These logs typically show the last 30 to 90 days of activity. If you see suspicious logins from weeks ago but nothing recent, the attacker may have already lost access or moved on to other accounts. Even so, change your password and enable two-factor authentication when ready — they may still have your password written down somewhere.

Signs in Your Email Folders and Settings

Open your Sent folder and scroll through recent messages. If you see emails you didn't write, especially to addresses you don't recognize, your account was used to send spam or phishing messages. Attackers often send these at night or when they know you're not watching. Check your Deleted folder too — some email clients move sent messages there automatically.

Look at your account settings for changes you didn't make. Your recovery email address, phone number, and security questions should all be exactly as you set them. If your recovery email changed, the attacker can lock you out by resetting your password and sending the confirmation to their own email. If your phone number changed, they can intercept two-factor codes. These are the most dangerous signs because they mean the attacker is trying to keep you out permanently.

What Happens When Someone Uses Your Account

Hackers use compromised email accounts for several purposes. They send spam or phishing messages to your contacts, trying to trick those people into clicking malicious links or sending money. They use your account to reset passwords on other services — your bank, social media, shopping sites — because email is usually the master key to everything else. They may sell your email address to other criminals or use it to sign up for services in your name.

Some attackers set up forwarding rules so that emails sent to you automatically go to their address instead. This is harder to spot than a single suspicious login because you may not notice you're missing emails. Check your forwarding settings in your email provider's settings menu. Gmail calls this "Forwarding and POP/IMAP" under Settings. If you see a forwarding address you didn't create, delete it when ready and change your password.

Why Passwords Get Compromised

Most hacked accounts result from passwords that are either weak or reused across multiple websites. A weak password uses only common words, birthdays, or straightforward number patterns — these can be guessed in minutes by automated tools. A reused password means that if one website gets breached, attackers try that same password on Gmail, Outlook, and every other major service. If it works on even one, they're in.

Phishing emails and fake login pages also steal passwords. An email that looks like it came from your bank or email provider asks you to "verify your account" by clicking a link and entering your password. The link goes to a fake website that looks identical to the real one, and your password goes straight to the attacker. These emails are often convincing because they use official logos and language. Never click a link in an unexpected email — instead, go directly to the website by typing the address yourself.

when ready Steps to find Your Account

Change your password to something you've never used before and that you don't use anywhere else. Make it at least 16 characters long and include uppercase letters, numbers, and symbols. Do not use words from the dictionary or patterns like "Password123" — these are the first things attackers try. Use a password manager like Bitwarden or 1Password to generate and store a truly random password.

Enable two-factor authentication when ready after changing your password. This requires a second form of proof — usually a code from an app like Google Authenticator or Authy, or a text message to your phone — before anyone can log in. Even if an attacker has your new password, they can't get in without this second factor. Turn on two-factor authentication in your account settings under "Security" or "Two-step verification."

Review your connected apps and devices. In Gmail, go to "Connected apps and sites" and remove anything you don't recognize. In Outlook, check "Your devices" and sign out of sessions you didn't start. If you use your email to sign into other services — Spotify, Netflix, social media — change those passwords too, because the attacker may have used your email account to reset them.

What to Do If You Can't Log In

If your password no longer works and you can't recover your account, the attacker has likely changed your password and your recovery email. Start the account recovery process through your email provider's help page. Gmail has a "Can't access your account?" link on the login page. You'll be asked security questions, your recovery phone number, or to verify you own the account through other means.

This process can take several days or longer if the attacker changed your recovery information. In the meantime, contact your bank, social media accounts, and any other important services to let them know your email may be compromised. Ask them to require a password change the next time you log in. If the attacker used your email to make purchases or open accounts, report those to the companies involved and consider placing a fraud alert with the credit bureaus.

Frequently Asked Questions

Can I tell if someone is reading my emails right now?

Not directly from your inbox, but your account activity log shows all current sessions. If you see a login from an unfamiliar device or location that's still active, someone is likely reading your emails. Sign out all other sessions when ready in your account settings, then change your password. This forces the attacker to log out.

What if I see a login from a place I've never been?

This almost always means your account was hacked. Change your password when ready and enable two-factor authentication. Check your Sent folder for emails you didn't write and your settings for changes you didn't make. If the suspicious login is recent, the attacker may still have access.

Does a hacked email mean my bank account is at risk?

Yes, because most people use their email to reset passwords on banking websites. If the attacker has your email, they can reset your bank password and lock you out. Contact your bank when ready and ask them to add extra security to your account. Many banks offer phone-only password resets or security questions that can't be changed online.

Should I delete my email account if it's been hacked?

Not usually. Deleting it doesn't undo the damage already done, and you'll lose access to password resets for other services. Instead, change your password, enable two-factor authentication, and review what the attacker did while they had access. Delete only if you can't regain control after multiple recovery attempts.

How do I know if my password was in a data breach?

Use haveibeenpwned.com, a free website that checks whether your email address appears in known data breaches. Enter your email address and it will tell you which services were breached and when. If your email appears, change your password on that service when ready, especially if you used the same password elsewhere.