Knowing how to tell if your email has been hacked can prevent a suspicious login from becoming a stolen identity, drained payment app, or compromised social account. The good news is that you do not need technical training to investigate. A few unusual messages, account settings, and login alerts can reveal what happened, while a calm response can limit the damage.
Warning signs your email account may be compromised
The clearest clue is activity you did not create. Check your Sent folder and Drafts for messages you never wrote, especially emails asking contacts for money, gift cards, passwords, or urgent favors. Also look for deleted messages that appear to have been removed after sending. An intruder often tries to hide evidence or use your address to target people who trust you.
Unexpected password-reset emails deserve attention, particularly when they mention services such as Amazon, PayPal, Apple, Microsoft, or your bank. One message can be a harmless mistake, but several alerts in a short period could mean someone is testing which accounts connect to your email.
Other warning signs include a changed signature, unfamiliar forwarding rules, missing contacts, new recovery information, or a notice that your password was changed. Friends may tell you they received strange messages from your address. You might also be locked out even though your old password worked yesterday. These signs do not prove a hack by themselves, but they are enough to begin securing the account.
A single unfamiliar login location is not always evidence of an attacker. Mobile networks and privacy tools can make locations look strange. Compare the device, date, browser, and approximate area instead of relying only on a city name.
How to tell if your email has been hacked by checking account activity
Start with the email provider's account security page, not a link inside a warning message. For Gmail, open your Google Account and review Recent security activity and Your devices. Microsoft Outlook users can review Recent activity in their Microsoft account. Apple users should check the devices and trusted phone numbers connected to their Apple Account. Other providers usually offer similar options under Security, Privacy, or Account settings.
Look for devices you do not recognize, sign-ins at times you were asleep, and access from places you have never visited. Record screenshots or write down the dates before signing out unfamiliar sessions. If you find an unknown device, use the provider's option to sign it out. Do not confront or message the suspected person; focus on closing access.
Next, inspect settings that can quietly give someone ongoing access. Check forwarding addresses, filters, automatic replies, delegated mailbox access, recovery email addresses, phone numbers, connected apps, and app-specific passwords. A criminal may create a rule that moves bank alerts into Trash or forwards new messages to another inbox. Remove anything you did not add, then review the mailbox again for changes.
If you are still unsure how to tell if your email has been hacked, search the provider's official help page by typing its address manually into your browser. Avoid calling phone numbers from popups or unsolicited emails. Fake support agents often use a frightening security alert to obtain remote access or a one-time verification code.
Secure the account immediately
Change the email password from a device you trust, preferably after updating its operating system and running a reputable antivirus scan. Create a long, unique password that you have never used elsewhere. A password manager such as Bitwarden, 1Password, or the built-in manager in Chrome, Safari, or iCloud can generate and store one safely.
Do not reuse the replacement password for banking, shopping, social media, or your internet provider. Email is often the recovery key for those services, so one reused password can let an attacker move from one account to another. Change passwords on important accounts that used the same old credential, starting with financial services and accounts containing payment information.
Turn on multifactor authentication, preferably with an authenticator app or passkey when available. Text-message codes are still better than having no second step, but they can be exposed through phone-number takeover scams. Save backup codes in a secure location, not in the same email account you are trying to protect.
After changing the password, choose the option to sign out of all sessions if your provider offers it. Then sign in again only on devices you recognize. This step can remove access from an attacker who saved an old session, although it does not replace changing passwords or removing suspicious connected apps.
Protect your contacts, money, and other accounts
Tell close contacts that your address may have been misused. A short message such as “Please ignore recent requests for money or links from me; I am securing my account” can stop someone from clicking a malicious link. Do not include your new password, security answers, or verification codes.
Review recent activity on your bank, credit card, payment app, shopping accounts, and social platforms. Look for new shipping addresses, unfamiliar purchases, changed recovery details, new followers, or messages you did not send. Contact a financial institution through the number on its official website or card if you see unauthorized transactions. If your email contained tax, medical, employment, or identity documents, consider the broader privacy risk and watch for identity theft indicators.
Run a security scan on your laptop and phone, remove browser extensions you do not recognize, and install pending updates. Malware or a malicious extension can steal a password again after you change it. Check browsers for saved passwords and remove exposed credentials from any account you have secured.
How to tell if your email has been hacked after you recover it
Monitor the account for several days instead of assuming the problem is over. Look for new login alerts, forwarding rules, password-reset requests, and messages in Sent or Trash. Confirm that your recovery phone number and email still belong to you. If an unknown setting returns after you remove it, contact the provider through its official support channel.
Be especially careful with emails claiming your account is about to close. Attackers often imitate Google, Microsoft, Apple, or a security company and create urgency. Open the provider's app or type the known website address yourself rather than clicking the message. Trust matters before the click.
If you cannot regain control, report the takeover to the email provider and secure the recovery account first. You can also report phishing to the Federal Trade Commission at ReportFraud.ftc.gov. For serious identity theft, consider placing a fraud alert or credit freeze with the major credit bureaus.
A practical prevention routine
Use a unique password, multifactor authentication, automatic updates, and a recovery method you can access. Once a month, review active sessions and connected apps. Every few months, check forwarding rules and mailbox filters. Keep your phone protected with a screen lock, and avoid approving sign-in prompts you did not initiate.
The answer to how to tell if your email has been hacked is usually found in account activity, mailbox settings, and unexpected recovery changes rather than in one dramatic clue. Start with the risk you actually have, secure the email first, and then work outward to financial and social accounts. Safe enough starts with clear choices.
