How to Tell If Your Email Has Been Hacked

Your email account has likely been hacked if you see login activity you don't recognize, receive password reset emails you didn't request, or notice sent messages in your folder that you didn't write. The most reliable sign is a login notification from an unfamiliar location or device — most email providers send these automatically. Check your account activity log (usually under Security or Account Settings) to see where and when someone accessed your account, what device they used, and from which country.

Other strong indicators include friends telling you they received spam or phishing messages from your address, your password no longer working, or a recovery email or phone number you don't recognize attached to your account. If your email is linked to banking, social media, or shopping accounts, check those too — a hacked email is often the first step to accessing everything connected to it.

Key Takeaways

  • Check your login activity log for sign-ins from unfamiliar locations, devices, or times when you were not using your account.
  • Look in your Sent folder for emails you did not write, and ask friends if they received suspicious messages from your address.
  • Review the recovery email and phone number on your account — if either one is wrong, someone may have changed it to lock you out.
  • Change your password when ready from a different device, and enable two-factor authentication to prevent the hacker from logging back in.
  • Check any accounts linked to your email (banking, social media, shopping) because a hacked email often leads to compromised accounts elsewhere.

Check Your Login Activity and Recent Access

Every major email provider keeps a record of when and where your account was accessed. In Gmail, click your profile picture, select "Manage your Google Account," go to the Security tab, and scroll to "Your devices" — this shows every device currently signed in. Below that, click "Manage all devices" to see a complete history with dates, times, locations, and device types.

In Outlook, go to Account.microsoft.com, select "Security," then "Recent activity." You will see a list of sign-ins with dates, times, and locations. If you see a city or country you have never visited, a device you do not own, or a time when you were asleep or at work, that is a strong sign someone else accessed your account. Pay special attention to entries labeled "suspicious activity" — the provider flags these automatically.

Write down any unfamiliar entries with their exact date and time. You will need this information if you contact your email provider's support team later.

Look for Sent Emails You Did Not Write

Open your Sent folder and scroll through recent messages. A hacker often sends phishing emails or spam from your account because your address is trusted by your contacts. Look for emails you do not remember writing, especially ones sent at odd hours or to addresses you do not recognize.

The hacker may have deleted these emails from your Sent folder to hide the evidence, so also check your Trash or Deleted Items folder. If you find messages you did not send, note the dates and recipients — this confirms the breach and shows how long the hacker had access.

Contact a few people from your recent email list and ask if they received unusual messages from you in the past week or two. They may have received phishing links, requests for money, or malware attachments. This is often how people first discover their email is compromised.

Verify Your Recovery Email and Phone Number

A hacker's first move is often to change your recovery email or phone number so you cannot regain control of the account. Go to your account settings and check what recovery email and phone number are listed. If either one is not yours, the hacker has already locked you out of your own account.

In Gmail, go to "Manage your Google Account," select the Security tab, and look for "How you sign in to Google" and "Recovery email." In Outlook, go to Account.microsoft.com, select "Security," then "Advanced security options," and check "Additional security info." If the recovery details are wrong, change them when ready — but do this from a device the hacker does not have access to, such as a phone or computer you know is clean.

Check for Unusual Password Reset Requests

Email providers send notifications when someone requests a password reset, even if the request is denied. Check your inbox for these notifications — they usually say something like "Someone tried to reset your password" or "Confirm this was you." If you see multiple reset requests you did not make, especially recent ones, someone is actively trying to break into your account.

These notifications often include a link to review the activity or confirm it was you. Click the link and mark the request as "Not you" or "Suspicious." This tells the provider to block that attempt and may trigger extra security checks on your account.

Review Connected Apps and Devices

Hackers often connect their own devices or apps to your email account so they can access it even after you change your password. In Gmail, go to "Manage your Google Account," select Security, and scroll to "Your connected apps and sites." Look for apps or devices you do not recognize. In Outlook, go to Account.microsoft.com, select "Security," then "App passwords" or "Devices," and review what is listed.

Remove anything unfamiliar when ready by clicking the X or Delete button next to it. This disconnects that device or app from your account. If you see a device with a name like "iPhone" or "Chrome" but you do not own that device, that is a strong sign of a breach.

Check Accounts Linked to Your Email

Your email is the master key to every other account that uses it for login or password recovery. If your email is hacked, check your banking, social media, shopping, and work accounts for unfamiliar activity. Look for changed passwords, new payment methods added, address changes, or login notifications from places you have never been.

Start with accounts that hold sensitive information: your bank, credit card company, PayPal, Amazon, or any account with a saved payment method. Then check social media (Facebook, Instagram, Twitter), work email, and any subscription services. If you find suspicious activity in any of these, change the password when ready and contact the company's support team.

Frequently Asked Questions

What should I do right now if I think my email is hacked?

Change your password when ready from a different device — one you know is clean. Use a strong password with at least 16 characters, mixing uppercase, lowercase, numbers, and symbols. Then enable two-factor authentication so the hacker cannot log back in even with your new password. Do this before doing anything else.

Can I still change my password if the hacker changed my recovery email?

Yes, but it is harder. Try signing in with your current password. If that works, go directly to your password settings and change it before the hacker locks you out completely. If you cannot sign in, use your email provider's account recovery process — you will answer security questions or verify your identity through a phone number or backup email you set up earlier.

Should I tell my contacts that my email was hacked?

Yes, send a brief message to people in your recent contact list. Tell them your email was compromised and to delete any suspicious messages from you without clicking links or downloading attachments. You do not need to explain details — just a quick "My email was hacked; please ignore any messages from me asking for money or clicking links."

Will changing my password stop the hacker from accessing my account?

Changing your password stops them from logging in with the old password, but only if they have not changed your recovery email or added their own device to your account. That is why you must also remove unfamiliar devices and apps, and verify your recovery email is correct. Two-factor authentication adds another layer — even with your password, they cannot get in without your phone.

How long does it take to fully find a hacked email account?

Changing your password and enabling two-factor authentication takes about 10 minutes. Removing unfamiliar devices and apps takes another 5 to 10 minutes. Checking and updating passwords on linked accounts (banking, social media, shopping) can take 30 minutes to an hour depending on how many accounts you have. Do the email account first, then work through the others.