How to Check if Your Email Has Been Hacked

Step by step

1. 3 min

   Check your sent folder for unfamiliar messages

   Open your email's Sent folder and scan recent messages for emails you didn't send. Look for spam, phishing attempts, or messages to your contacts requesting money or personal information. Hackers often use compromised accounts to send malicious emails to your contact list.

   Note: Sort by date to quickly identify recent activity. Check the last 30 days thoroughly.
2. 3 min

   Review recent login activity

   Access your email provider's security settings to view recent login locations and devices. In Gmail, go to Manage your Google Account > Security > Recent security activity. For Outlook, visit Security dashboard > Sign-in activity. Look for unfamiliar locations, devices, or login times when you weren't using your email.

   Note: Note the IP addresses and cross-reference them with your actual locations using an IP lookup tool.
3. 2 min

   Examine account recovery and forwarding settings

   Navigate to your account settings and check recovery email addresses and phone numbers. Verify that email forwarding rules haven't been added to redirect your messages elsewhere. In Gmail, check Settings > Accounts and Import > Send mail as and Settings > Forwarding and POP/IMAP.

   Note: Hackers often add forwarding rules to receive copies of your incoming emails, including password reset requests.
4. 2 min

   Monitor connected apps and permissions

   Review third-party applications with access to your email account. In Gmail, go to Manage your Google Account > Security > Third-party apps with account access. Remove any unfamiliar applications or services you don't recognize. Check when each app last accessed your account.

   Note: Revoke access for any app you haven't used in the last six months as a security precaution.
5. 2 min

   Check for password changes and security alerts

   Look for security notifications in your inbox about password changes, new device logins, or account recovery attempts you didn't initiate. Search your email for messages from your email provider containing terms like 'security alert,' 'password changed,' or 'new device.' These often indicate unauthorized access attempts.

   Note: Check your spam folder too—hackers sometimes move security alerts there to hide their activity.
6. 2 min

   Verify your email address on breach databases

   Visit Have I Been Pwned (haveibeenpwned.com) and enter your email address to check if it appears in known data breaches. This service tracks major security incidents where email addresses and passwords were compromised. Review any listed breaches and their dates.

   Note: Sign up for notifications to get alerts if your email appears in future breaches.
7. 2 min

   Change your password and enable two-factor authentication

   Create a strong, unique password for your email account immediately. Enable two-factor authentication (2FA) through your provider's security settings. Use an authenticator app rather than SMS when possible. Sign out all other sessions to force re-authentication on all devices.

   Note: Use a password manager to generate and store a complex password you won't forget.