How to tell if your email has been hacked

Common signs your email has been hacked

• Friends or customers tell you they got strange emails or links from you
• Emails in your Sent folder that you didn't write
• Emails going missing, or replies you never see
• New forwarding rules or filters you didn't create
• Sign-in alerts from places or devices you don't recognise
• Password reset emails for other accounts that you didn't request
• Your password suddenly stops working

Any one of these is worth checking. Two or more together usually means someone else has been in the account.

Signs that are often a false alarm

Not every odd email means you've been hacked. Scammers can forge the sender name so a message looks as if it came from you, without ever touching your account. If those emails aren't in your Sent folder, that may be what's happening.

Breach notices are another one. If a company you use was breached, your email address may be on a list somewhere, but that doesn't mean your mailbox has been opened. You can check whether your address appears in known breaches at Have I Been Pwned (opens in a new tab). If it does, change the password for that service and any account that used the same password.

Recovery checklist

If you think someone has been in your account, work through this in order. Use a different device you trust, like your phone, in case the computer itself has a problem.

1. 1Change the email password to a new, long one you haven't used anywhere else.
2. 2Turn on multi-factor authentication, so a password alone isn't enough to sign in.
3. 3Sign out of all other sessions. Most providers have an option for this in the security settings.
4. 4Check forwarding settings and inbox rules, and delete any you didn't create.
5. 5Check the recovery phone number and backup email address are yours.
6. 6Review connected apps and remove any you don't recognise.
7. 7Look through Sent and Deleted items to see what was sent while someone had access.
8. 8Tell your contacts, so they ignore anything suspicious that came from you.
9. 9Change passwords on other accounts that used the same password, or that send resets to this email.
10. 10Run a security scan on your computer to rule out anything that captured the password.

If you're locked out completely, use your email provider's official account recovery. I can guide you through it, but I can't bypass a provider's own security checks, and neither can anyone else honestly.

If it's a business email account

A hacked business mailbox can cost real money. A common trick is to watch your emails quietly, then send an invoice or a message with changed bank details to a customer or supplier at the right moment.

If your business email may have been accessed, ring regular customers and suppliers on numbers you already have and tell them not to act on any change of bank details by email. Let your bank know, and consider reporting it through ReportCyber (opens in a new tab).

If you use Microsoft 365, an administrator can also check sign-in logs and reset sessions. My Microsoft 365 support page covers what's involved, and the small business cyber security checklist explains how to make this less likely next time.

When to get help

Getting help is worth it if you can't find the forwarding rules, the account keeps getting accessed after you change the password, or it's a business account with customer information in it.

My email support page explains how I help secure an account once you're back in. If you think the computer itself may be compromised, start with computer security help.

Common questions