How to Know If Your Email Has Been Hacked

Your email is the key to all your online accounts. If it gets hacked, criminals can reset passwords, steal data, and impersonate you. Here's how to know if you've been compromised and what to do immediately.

10 Signs Your Email Has Been Hacked

🚨 1. You Can't Log In (But Don't Remember Changing Password)

If your password suddenly doesn't work and you didn't change it, someone else did. This is the biggest red flag.

📧 2. You See Suspicious Login Activity

Gmail shows "Someone used your password on [date] from [unknown location]". Check: Gmail → Account → Security → Your devices

📬 3. Recovery Email or Phone Number Changed

Hackers change this first to lock you out. If you didn't make this change, you're hacked.

✉️ 4. Emails You Didn't Send

Check your "Sent" folder for suspicious emails. Hackers often use your email to send spam or phishing to your contacts.

💾 5. Forwarding Rules You Didn't Create

Hackers set up forwarding to spy on you. Check: Gmail Settings → Forwarding and POP/IMAP → Forwarding address

📊 6. Password Reset Email You Didn't Request

Someone trying to reset your password on another account. This means they're actively trying to compromise you.

🎯 7. Connected Apps You Don't Recognize

Check: Gmail → Account → Security → Third-party apps with account access. Delete suspicious ones immediately.

🔒 8. Contacts Reported Getting Phishing From You

Friends tell you they got spam from your email. Classic sign of account compromise.

💰 9. Unexpected Password Resets on Other Accounts

Your Amazon, banking, or social media passwords suddenly don't work. Hackers use your email to reset them.

👤 10. You Receive "Confirm Your Identity" Emails You Didn't Request

Someone is trying to access your account and the service is asking you to verify. This is active hacking in progress.

What To Do IMMEDIATELY If You're Hacked

🚨 EMERGENCY STEPS (Do These First)

Change your password immediately from a secure device
Enable two-factor authentication (2FA) right now
Remove all connected apps (Settings → Security → Third-party apps)
Check recovery email/phone - change them back if hacker modified them
Review active sessions - sign out all other devices (Gmail → Account → Security → Your devices)

5-Day Recovery Checklist

Day 1: Secure Your Email

Change email password to something strong (16+ characters, mix of letters/numbers/symbols)
Enable 2FA (Google Authenticator or hardware key is most secure)
Remove all third-party app access
Remove all forwarding rules

Day 2: Secure Your Recovery Methods

Update recovery email to a separate, secure email
Update phone number to YOUR current number
Add backup email and phone if possible

Day 3-4: Check Important Accounts

Banking & credit cards - check for unauthorized transactions
Social media (Facebook, Twitter, LinkedIn) - change passwords
Work/school accounts - notify IT immediately
Online shopping (Amazon, eBay) - check order history

Day 5: Monitor & Prevent

Monitor email for suspicious activity for next 30 days
Set up email alerts for unusual login attempts
Check credit reports (AnnualCreditReport.com - free)
Consider credit freeze if identity theft suspected

How to Prevent Email Hacking

Use a strong, unique password: 16+ characters with uppercase, lowercase, numbers, symbols
Enable two-factor authentication: This stops 99% of hacks even if password is compromised
Use a password manager: LastPass, 1Password, or Bitwarden to generate & store unique passwords
Don't use the same password anywhere: If one account is breached, all are vulnerable
Be suspicious of emails: Verify sender addresses, hover over links before clicking
Use email verification: Tools like SpamScore help catch phishing before you click
Update recovery info regularly: Make sure phone/backup email are current
Review active sessions monthly: Check who's logged into your account

🔍 Quick Check: Is Your Email Safe?

Use our free email scanner to instantly analyze any suspicious email. Paste the email and get a threat score in seconds.

Scan An Email Free →

Learn how to spot and respond to email compromises before they become serious