How to Tell If Your Email Has Been Hacked (and What To Do)
Your email account is more important than it looks. It holds years of messages, and it’s also the key to almost everything else you do online, because password reset links for your bank, your shopping accounts and your social media all arrive in your inbox. If someone gets into your email, they can often get into those too. That’s why it pays to know the signs of a break-in, and what to do right away.
Warning Signs Your Email May Be Hacked
Friends or family say they got strange messages from you, like odd links or requests for money.
Your Sent folder has emails you didn’t write.
You get password reset emails or verification codes you didn’t ask for. Someone may be trying to get in.
You see “new sign-in” alerts from a device or place you don’t recognize.
You can’t sign in, even though you’re sure you’re using the right password.
Your settings have changed. Your signature, your recovery phone number or email, or a new forwarding address or filter you didn’t set up.
Messages are missing, or emails you never opened show as read.
Strange notices from other accounts, like a bank or shopping site.
Any one of these doesn’t prove you were hacked, but several together, or one that you can’t explain, is worth acting on.
How To Check Quickly
Gmail on a computer: scroll to the very bottom of your inbox. At the bottom right, you’ll see “Last account activity.” Click Details to see a list of recent sign-ins, with the places and types of devices. If you see something you don’t recognize, take action.
Google account: go to myaccount.google.com, open Security, and look at Your devices. Sign out of any that you don’t know.
Apple Account: on an iPhone, open Settings and tap your name. Scroll down to see the devices signed in to your account, and remove any you don’t recognize.
Forwarding and filters: hackers sometimes set up a hidden forwarding address so they receive copies of your emails, or a filter that deletes warnings. In Gmail, click the gear icon, then See all settings, and check the Forwarding and POP/IMAP tab and the Filters and Blocked Addresses tab. Remove anything you didn’t set up.
Other email providers (Outlook, Yahoo, AOL and others) have similar areas, usually called Recent activity, Security, Forwarding or Rules.
What To Do If You Think It’s Been Hacked
Use a device you trust, ideally one that you know is clean, like your own phone or computer.
Change your password right away. If you can’t sign in, use the “Forgot password” option on the official site. Choose a new passphrase that you’ve never used anywhere else.
Sign out of all other devices. Changing the password often does this, and you can also check the security settings.
Turn on two-step verification. This is one of the best protections against it happening again.
Check your settings, including forwarding, filters, your signature, and your recovery phone number and email, and fix anything you don’t recognize.
Change passwords on other accounts, especially any that used the same password, starting with your bank, then shopping and social media. Watch your statements closely.
Run a security scan on your computer. On Windows, use Windows Security. Delete any apps you don’t recognize from your phone.
Warn your contacts. Send a short message from another channel, like a text, saying: “My email was hacked. Please don’t click links in any strange messages from me.”
Was Your Email in a Data Breach?
A free, well-known site called Have I Been Pwned (haveibeenpwned.com) lets you type in your email address to see if it has appeared in known data breaches. It will never ask for your password. Be careful to type the address exactly, since copycat sites exist. If your email shows up, change the passwords on the accounts that used it.
Be Careful Where You Look for Help
If you’re locked out and search for a customer support number, be careful. Scammers pay to place fake numbers in search results, and they pretend to be the company to get your information. Use the recovery options on the company’s official website.
How To Make It Less Likely
Use a strong, unique password for your email.
Turn on two-step verification.
Don’t click links or open attachments from messages you didn’t expect.
Keep your devices updated.
Check your recovery phone number and email once a year, and keep them current.
If you’re worried about your account right now, a Kendera Global session can sit with you and check your email’s security settings step by step.
