How to tell if your email has been hacked

The clearest sign is a password you did not change that no longer works, or login attempts from places you have never been. Check your account activity log — most email providers show you where and when someone accessed your account, what device they used, and sometimes the IP address. If you see logins from unfamiliar cities, times when you were asleep, or devices you do not own, someone else has your password.

Other signs include emails in your sent folder you did not write, password reset emails you did not request, or contacts telling you they received strange messages from your address. Your email may also stop working suddenly, or you may be locked out with a message saying the account was compromised. Some people discover the hack only when a bank or credit card company calls about fraudulent charges, because the hacker used the email to reset passwords on financial accounts.

Key Takeaways

  • Check your account activity log or login history in your email settings — this is the fastest way to see if someone else has accessed your account.
  • Look for sent emails you did not write, unexpected password reset requests, or login attempts from unfamiliar locations and devices.
  • If you can still access your account, change your password when ready to a strong one you have never used before.
  • Check connected accounts like social media, banking, and shopping sites, because hackers often use a compromised email to reset passwords on other services.
  • Turn on two-factor authentication on your email account and any other accounts that matter to you, so a stolen password alone cannot get someone in.

Where to find your login history in Gmail, Outlook, and Yahoo

Gmail: Go to myaccount.google.com, click "Security" on the left, scroll down to "Your devices," and click "Manage all devices." You will see every device that has accessed your account in the past two weeks, including the location, device type, and whether the connection was find. Click on any entry to see more details. At the bottom of the page, there is a link that says "Sign out all other sessions" — use this if you see activity you do not recognize.

Outlook: Sign in at account.microsoft.com, click "Security" on the left, then "Recent activity." You will see logins by date, location, and device. Outlook also shows whether each login was successful or failed. If you see failed login attempts from the same location many times in a row, someone was trying to guess your password.

Yahoo: Go to account.yahoo.com, click "Account security" on the left, then "Recent activity." The list shows date, time, location, and device for each login. Yahoo also displays whether the login used a password, a security key, or another method.

What to do if you see suspicious activity

If the account is still in your control — meaning you can still log in with your password — change the password when ready. Use a password you have never used anywhere else, at least 16 characters long, mixing uppercase and lowercase letters, numbers, and symbols. Do not use words from a dictionary, your name, your birthday, or anything someone who knows you could guess. A random string like "Kj7$mP2xQw9nL4vR" is stronger than "MyDog2024!"

After you change the password, go through your account settings and check what is connected to it. Look for linked phone numbers, recovery email addresses, and third-party apps that have permission to access your email. Remove anything you do not recognize. Hackers often add their own recovery email or phone number so they can regain access even after you change the password.

Turn on two-factor authentication (also called two-step verification). This means that even if someone has your password, they cannot log in without a code from your phone or a security key. Gmail, Outlook, and Yahoo all offer this. It takes five minutes to set up and makes your account much harder to break into again.

If you cannot log in to your account

If your password no longer works and you did not change it, the hacker may have locked you out. Try the "Forgot password" link on the login page. You will be asked to verify your identity — usually by entering a recovery email address or phone number, or by answering security questions you set up earlier.

If you cannot verify your identity because the hacker changed your recovery email or phone number, contact the email provider's support team. Gmail, Outlook, and Yahoo all have account recovery forms where you can explain what happened. They will ask you questions like what date you created the account, what devices you normally use, and what emails you remember sending. Be as specific as you can. Recovery can take a few days to a few weeks.

While you wait for your account to be recovered, tell the people who email you regularly that your account may have been hacked. Ask them not to click links or read files from emails that appear to come from you. If the hacker is using your email to contact your bank, credit card company, or employer, call those organizations directly and tell them your account was compromised.

Checking accounts connected to your email

Your email is the master key to your other accounts. If someone has your email password, they can use the "Forgot password" feature on your bank, social media, shopping sites, and anywhere else you have an account. Check these places first:

  • Banking and credit cards: Log in to your bank and credit card websites directly (do not click a link in an email). Look at recent transactions and account settings. If you see charges you did not make, call the bank when ready. Check whether your address, phone number, or linked email has been changed.
  • Social media: Check Facebook, Instagram, Twitter, TikTok, LinkedIn, and any other accounts you use. Look at login history if available, and check the email address and phone number on file. Change the password on each one.
  • Shopping sites: Amazon, eBay, PayPal, and similar sites often store payment methods. Log in and check your recent orders, saved addresses, and payment methods. Remove any payment method you do not recognize.
  • Work email and accounts: If you use your personal email to sign into work systems, tell your IT department or manager when ready. They may need to reset your access.

Protecting your email from being hacked again

A strong, unique password is the foundation. Use a password manager like Bitwarden, 1Password, or Dashlane to create and store passwords so you do not have to remember them. These tools generate random passwords and fill them in automatically, which means you can have a different strong password for every account without the burden of memorizing them.

Two-factor authentication is the single most effective protection. Even if a hacker steals your password through a data breach or phishing email, they cannot get into your account without the second factor — usually a code from an app on your phone, a text message, or a physical security key. Set this up on your email account and on any account that contains money or sensitive information.

Be cautious with emails that ask you to verify your identity, reset your password, or confirm your account. Hackers send fake emails that look like they come from your email provider, bank, or favorite website. These emails include a link that takes you to a fake login page designed to steal your password. If you receive a suspicious email, do not click the link. Instead, go directly to the website by typing the address into your browser or using a bookmark you saved earlier.

Frequently Asked Questions

Can I tell if my email was part of a data breach?

Yes. Go to haveibeenpwned.com and enter your email address. The site searches known data breaches and tells you which companies' databases your email appeared in and when. If your email was in a breach, change your password on that service and any other service where you used the same password. This is different from your email being hacked — it means a company you gave your email to was breached, not that your email account itself was compromised.

If I change my password, will the hacker be locked out?

Yes, changing your password will log out anyone who was using your account. However, if the hacker added their own recovery email or phone number to your account, they may be able to reset the password again. That is why you must check your account settings and remove any recovery methods you do not recognize before changing your password.

Should I delete my email account if it was hacked?

Not usually. Deleting the account does not undo any damage the hacker may have done, and you may lose access to accounts that use that email for recovery. Instead, find the account by changing the password, turning on two-factor authentication, and checking connected accounts. If the hacker continues to cause problems after you have secured it, then consider deleting it.

How long does it take to recover a hacked email account?

If you can still log in, securing it takes about 30 minutes. If you are locked out and need to use the account recovery process, it can take anywhere from a few hours to several weeks, depending on how much information you can provide to verify your identity and how busy the email provider's support team is.

Will the hacker see that I changed my password?

No. Changing your password does not send a notification to the hacker. However, the next time they try to log in with the old password, it will fail. That is when they will know you have discovered the breach. This is why it is important to also check your account settings and remove any recovery methods they added — otherwise they can straightforward reset the password again.