Can someone hack my email? How takeovers really happen

No, someone can't hack your email just by knowing your email address. They need one more thing: your password, a code sent to your phone, or a login session copied from your device. They get it by trying passwords leaked from other sites, phishing, SIM swaps or malware. Each route has a specific defense, and most take minutes to set up.

So the useful question isn't "can they?" but "which of these doors is open on my account?" Here are the six routes, then how to check whether anyone is in your mailbox right now.

Can someone hack my email without my password?

Yes, but not out of thin air. "Without my password" usually means one of three things: they reset it through your phone, they copied a session that was already logged in, or they got you to sign in on a fake page and captured the result. None of those starts from the address alone. The table shows what each route needs.

Route	What they need besides your address	What blocks it
Reused password	A password of yours from another site's breach	A password used only for email
Phishing page	You typing your password into a fake login	Two-factor, and checking the address bar
Real-time phishing proxy	You signing in, code and all, through their page	Passkeys or security keys
SIM swap	Your carrier moving your number to their SIM	Not relying on text messages for sign-in or recovery
Stolen session cookie	Malware on your computer	Not running cracked software or unknown attachments
Your old recovery address	Control of an email you listed for recovery years ago	Keeping recovery details current

The 6 ways email accounts actually get taken over

1. A password you used somewhere else

This is the bulk of it. Breached email-and-password pairs are tried automatically against other services, and in Google's words, "most attacks stem from automated bots with access to third-party password breaches" (Google Security Blog, 2019). Microsoft, writing the same year, said "up to 73 percent of passwords are duplicates" (Microsoft Security, 2019). If your email password has ever been used on another site, assume someone has tried it.

Close it: a long password that exists only for your email account. A password manager makes that painless.

2. A fake sign-in page

A message says your mailbox is full or a document is waiting, and the link opens a page that looks like Gmail or Outlook. Whatever you type goes to the attacker. A second factor stops most of this, because the password alone is no longer enough. Our guide to spotting a phishing email shows how to check the sender and the link before you sign in.

3. A fake page that passes your code along

This is the version that beats ordinary two-factor codes. The phishing site sits between you and the real one, forwards your password and your code in real time, and keeps the logged-in session it gets back. Microsoft tracked one such campaign that "attempted to target more than 10,000 organizations since September 2021," and noted the attacker gets a session "regardless of the sign-in method" (Microsoft Threat Intelligence, 2022). Once inside, the attackers created an inbox rule to hide replies, then wrote to people about invoices from the real mailbox.

Close it: passkeys and hardware security keys. They check which website is asking, so a lookalike site gets nothing it can reuse. Microsoft's own recommendation in that report is FIDO2-based sign-in.

4. A SIM swap

The attacker convinces your mobile carrier to move your number to a SIM they hold. Your texts now go to them, including password reset codes. The FBI explains that this lets criminals send "'Forgot Password' or 'Account Recovery' requests to the victim's email and other online accounts associated with the victim's mobile telephone number" (FBI PSA, 2022). The FBI logged 971 SIM swap complaints in its 2025 report, so it is far rarer than password reuse, but it is aimed at people worth the effort.

Close it: use an authenticator app or passkey instead of text messages where the service allows it, and ask your carrier what extra PIN or lock it offers for number transfers. Fewer phone numbers on your accounts means fewer ways in. Secria Mail, for example, doesn't ask for a phone number at sign-up; account recovery uses a 12-word recovery phrase you keep yourself.

5. Malware that copies your logged-in session

When you sign in, your browser stores a session cookie so you stay signed in. Malware that steals those cookies lets an attacker open your account as if they were you, with no password and no code. Google's Threat Analysis Group calls it a "pass-the-cookie attack," a "session hijacking technique that enables access to user accounts with session cookies stored in the browser" (Google TAG, 2021). In that campaign, attackers sent YouTube creators fake "collaboration opportunities" built around a demo of some software, and the download was the malware.

Close it: don't install cracked software or "tools" sent by strangers, keep your system and browser updated, and if you suspect malware, clean the device before signing in again, since a new password won't help while the thief can copy the new session.

6. A recovery address or device you forgot about

Accounts often list a backup email from years ago. If that old address was deleted, hacked or reused, whoever controls it can request a reset for your main account. The same goes for a laptop you sold while still signed in. Check your recovery email and phone, and remove old devices.

Can someone hack my email by sending me an email?

Not in the normal case. Receiving or opening an ordinary email doesn't hand over your account. The harm comes from what the message persuades you to do: sign in on a linked page, open an attachment, approve a sign-in prompt you didn't start, or reply with a code. Keep your mail app and operating system updated so the rare bug-based attacks have less to work with, and treat any email that asks you to log in or "verify" as something to check first. If you already clicked and typed something, follow our steps for a hacked email account.

How to check if someone is in your email right now

You can see this yourself in a couple of minutes.

Gmail. At the bottom right of your inbox on a computer, click Details next to "Last account activity." Google says the page shows "the IP addresses which were used to access your account" and whether you're signed in "on another device, browser, or location" (Gmail Help). Then open your Google Account's device list and sign out anything you don't recognize (Google Account Help).

Outlook.com and Hotmail. Sign in to your Microsoft account and open the Recent activity page. It shows the recent sign-in activity on your account, so you can spot a device or place that isn't yours.

Any provider. Look in your mail settings for forwarding addresses, filters and rules you didn't make. An intruder's favorite move is a rule that quietly forwards or hides mail, as in the Microsoft case above, and it survives a password change.

If everything you see is yours, nobody is in. If not, act now: sign out other sessions, change the password from a clean device and turn on two-factor.

Lock it down in 15 minutes

New password, email only. Long, unique, stored in a password manager.
Turn on a second factor. CISA's More than a Password campaign puts it simply: "Users who enable MFA are significantly less likely to get hacked."
Pick a stronger factor than SMS if you can. In Google's 2019 study, an SMS code blocked 100% of automated bots, 96% of bulk phishing and 76% of targeted attacks; on-device prompts blocked 100%, 99% and 90%. Google added that "zero users that exclusively use security keys fell victim to targeted phishing." Our ranking of two-factor methods explains the trade-offs.
Save your backup codes somewhere other than the mailbox.
Review recovery details. Current phone, current backup email, nothing you no longer control.
Remove old devices and app access. In your account's security page, revoke anything unfamiliar.
Protect your phone number with whatever PIN or lock your carrier offers.

Why would someone hack my email?

Because your inbox is the reset button for everything else. Get into it and you can request new passwords for shopping, banking and social accounts. Your mailbox also holds invoices, ID scans and contacts who trust messages from you. That trust is worth money: the FBI recorded $3,046,598,558 in reported losses to business email compromise in 2025, a scam that often runs through a hijacked real mailbox. For most people, though, the attacker isn't after them personally. Your password was simply on a list.

Frequently asked questions

Can someone hack my Gmail with just my email address?

No. Google still needs your password and, if you've turned it on, your second step. What your address does let someone do is send you phishing and try leaked passwords, which is why a unique password and two-factor close the realistic routes.

Can someone hack my email if I have two-factor authentication?

It's much harder, but not impossible. Real-time phishing proxies can capture a code as you type it, and malware can steal a session after you've logged in. Passkeys and security keys defeat the proxy attack, and keeping unknown software off your device defends against cookie theft.

How do I know if someone is reading my email?

Check your provider's sign-in history for unfamiliar devices and locations, look for read messages you didn't open, and review forwarding addresses and filters. In Gmail, use the Details link at the bottom of the inbox; in Outlook.com, use the Microsoft account Recent activity page.

Can someone hack my email through public Wi-Fi?

It's unlikely on its own. Gmail, Outlook.com and other major providers load over HTTPS, which encrypts the connection between your browser and the provider. The bigger public Wi-Fi risk is a fake sign-in page, so check the address bar before you type a password.

Most email takeovers are a reused password and a missing second factor. Fix those two today, and if you're choosing a new inbox while you're at it, Secria Mail's free plan signs you up without a phone number.