Has my email been hacked? 9 signs, and exactly what to do

Your email account is probably the most important account you own. Almost every other account, from your bank to your social media, lets you reset its password through email. Whoever controls your inbox can, in time, control most of your online life.

That's why it's worth knowing the difference between a real break-in and something that only looks like one, and what to do in the first hour if it's real.

First: hacked, or just spoofed?

The most common reason people think they've been hacked is that a friend says, "I got a weird email from you." That doesn't necessarily mean anyone got into your account. Email's "From" line can be faked by anyone, a trick called spoofing, so a scammer can send a message that looks like it's from you without touching your account.

The quick test: look in your Sent folder. If the strange emails are there, someone used your account. If they aren't, your address was probably spoofed, which is annoying but doesn't mean your account is compromised. (Our guide on how email works explains why spoofing is possible.)

9 signs your email really has been hacked

1. Emails in your Sent folder that you didn't write, often spam, links or requests for money sent to your contacts.
2. Your password suddenly doesn't work, and you didn't change it.
3. Security alerts about a new sign-in, a new device or a changed password that you don't recognise.
4. Emails marked as read that you haven't opened.
5. Missing emails, especially security alerts or password reset messages from other services. Attackers delete these to hide their tracks.
6. New forwarding rules or filters you didn't create. This is the sneakiest sign, and the one most people never check. A hidden rule can quietly forward all your mail to an attacker, or send certain messages straight to trash, and it keeps working even after you change your password.
7. Changed recovery details: a phone number or backup email address you don't recognise.
8. Password reset emails from other services you didn't request, which can mean someone is using your inbox to take over other accounts.
9. Unknown devices or locations in your account's sign-in history.

How to check your account activity

Gmail

On a computer, scroll to the bottom of your inbox and click Details next to "Last account activity". This shows recent access, with the type of access, IP address and approximate location. For a fuller picture, go to your Google Account, open Security, and check Your devices and Recent security activity.

Outlook, Hotmail and Microsoft accounts

Sign in to your Microsoft account online, open Security, and choose Sign-in activity. It lists successful and failed sign-ins with location and device.

Keep in mind that locations are approximate and based on internet addresses. A sign-in that appears to be in a nearby city might simply be your mobile network. A sign-in from another continent at 3 a.m. is a different matter.

What to do if you've been hacked: the recovery checklist

Work through these in order. The first four are urgent.

1. Get back in

If your password still works, sign in and change it immediately. If it doesn't, use your provider's official account recovery page (Google: g.co/recover; Microsoft: the "Forgot password" link on the sign-in page). Answer as accurately as you can, from a device and location you've used before, as this improves your chances.

2. Set a new, unique password

Use a long password you've never used anywhere else. A password manager makes this painless. If you'd used the old password on other sites, change it there too, starting with banking and shopping.

3. Sign out every other session

Changing your password doesn't always sign out someone who's already logged in. In your Google Account, go to Your devices and sign out of anything unfamiliar. In your Microsoft account's security settings, use the option to sign out everywhere.

4. Check forwarding and filters

This is the step most guides forget, and the one attackers rely on.

• Gmail: Settings → See all settings → Forwarding and POP/IMAP (remove any forwarding address you don't recognise) and Filters and blocked addresses (delete any filter you didn't make).
• Outlook: Settings → Mail → Forwarding and Rules.

5. Check recovery details

Make sure the recovery phone number and backup email are yours. Attackers change these so they can take the account back later.

6. Remove unknown connected apps

Some attacks don't steal your password at all. They trick you into granting an app permission to read your email. In your Google or Microsoft account security settings, review third-party apps with account access and remove anything you don't recognise. Also delete any app passwords you don't use.

7. Turn on two-step verification

This is the single most effective protection. Even if someone steals your new password, they can't get in without the second step. An authenticator app or a passkey is stronger than SMS codes.

8. Secure accounts linked to this email

Look for password reset emails in your inbox and trash from the time of the break-in. For each service, especially banking, payments, shopping and social media, change the password and check recent activity.

9. Warn your contacts

If scam emails went out from your account, send a short message to the people who received them: your account was hacked, don't click the links, and ignore any requests for money. Friends are the people most likely to trust a message from you.

10. Scan your devices

If you can't work out how the attacker got your password, run a full security scan on your computer and phone, and update everything. Malware that records keystrokes can steal the new password too.

How it usually happens

Accounts are rarely "hacked" through clever technical attacks. The common causes are ordinary:

• A reused password that leaked when another website was breached. Criminals automatically try leaked passwords on email accounts. See how to check if your email was in a data breach.
• A phishing email that led to a fake login page. Our step-by-step method for checking whether an email is real helps here.
• Signing in on a shared or public computer and forgetting to sign out.
• Malware on a device, usually from a pirated download or a malicious attachment.

Protect yourself before it happens

• Turn on two-step verification today, and save the backup codes somewhere safe.
• Use a password manager and a unique password for your email.
• Keep your recovery phone and email up to date. They're how you'll get back in.
• Check your sign-in activity and forwarding settings every few months.
• Keep your main address off sites you don't trust. A temporary email for one-time sign-ups means fewer places where your address and password can leak from.

Recovering a hacked email account is stressful, but it's very often possible, especially if you act quickly. Once you're back in, the steps above make it much less likely to happen again.