How to tell if your email has been hacked

The clearest signs your email has been hacked are a password or recovery detail that changed without you, a sign-in alert from a device or place you don't know, and friends getting messages you never sent. To confirm it, open your provider's sign-in activity page and your mail settings, because those two places show what an intruder did and what they left behind.

Below are the signs each provider lists, the exact screens to check in Gmail, Outlook and Yahoo, and how to tell a real break-in from a spoofed message. If you have already confirmed a hack, go straight to what to do if your email is hacked.

The signs your email has been hacked

Google, Microsoft and Yahoo each publish their own list. Put together, they fall into three groups.

Things that changed without you:

Your password no longer works, or you got a notice that it changed.
Your recovery phone number or recovery email is different.
The name on the account, or the name on outgoing mail, is different.
Two-step verification was turned on or off.
An app you don't recognize has access to the account.

Things happening in your mailbox:

You stop receiving email. Both Google and Yahoo list this one.
Friends say they got spam or odd messages from you.
Your Sent folder has messages you didn't write.
Emails are missing and are not in Trash, which Google flags specifically.

Warnings from the provider:

An alert about an unusual sign-in or a new device.
In Gmail, a red bar at the top of the screen that says "We've detected suspicious activity in your account."
At Microsoft, an email or text about an unusual sign-in attempt. Microsoft says real ones come from account-security-noreply@accountprotection.microsoft.com. If you aren't sure about an alert, don't click it: sign in to your account directly and look.

One sign alone can be innocent. The checks below tell you whether you have more.

How to check sign-in activity in Gmail

Gmail has two places to look, and they show different things.

The Gmail activity page. From Google's Gmail help:

On a computer, open Gmail.
In the bottom right, click Details.
Read the "Activity on this account" page.

It shows the last 10 IP addresses and approximate locations that accessed your Gmail, plus up to 3 more labeled suspicious if Google warned you about something. The "Concurrent session information" section tells you whether you are signed in on another device, browser or location right now. The "Access type" section shows how each one got in: a browser, a phone, or a mail server using POP or IMAP. A POP or IMAP entry you can't explain is worth a hard look, because that is how a mail app, including someone else's, would pull your messages.

Your Google Account security page. From Google's hacked-account guide:

Go to your Google Account and open Security & sign-in.
On the "Recent security events" panel, select Review security events.
If something wasn't you, select No, it wasn't me and follow the steps.

Then check devices. In the same section, under Your devices, select Manage all devices. Google's device help says this lists devices signed in now or in the last few weeks. If you see one you don't recognize, select Don't recognize a device? and follow the steps on screen.

How to check sign-in activity in Outlook and Hotmail

Microsoft keeps this on the Recent activity page of your Microsoft account. From Microsoft's Recent activity help:

Sign in to the Security basics page of your Microsoft account.
Select Review activity.
Expand any entry to see the location, the IP address, the device and how the account was accessed.

The page covers the last 30 days. If there is an Unusual activity section, Microsoft wants an answer: choose This was me or This wasn't me. Choosing This wasn't me starts the process of changing your password and updating your security info. If something in the regular Recent activity section looks wrong, such as several sign-in attempts or profile changes you didn't make, select Secure your account.

Microsoft is upfront that the page is not a full log: "We don't show all account activity." You usually see significant security events, and repeated sign-ins from the same device and place may only appear once.

How to check sign-in activity in Yahoo Mail

From Yahoo's unusual activity help, sign in to the Yahoo Account security page in a browser and review three sections:

Current sign-ins: every device signed in to your account. Click one you don't recognize and select Sign out.
External connections: third-party apps signed in to your account, through app passwords.
Recent account activity: recent changes to the account, such as a phone number added or an email address removed.

In most Yahoo mobile apps, tap the Profile icon, then Settings, then Manage account privacy or Your privacy controls, then Security.

Pay attention to External connections. Yahoo says app passwords remain active even if you change your main password, so an app password you didn't create is a sign that matters even after a reset.

The settings that give a hack away

A sign-in log can look clean, especially if the intruder came and went weeks ago. The settings they changed stay put. These are the ones each provider tells you to check.

Provider	Where	What to look for
Gmail	Settings, See all settings	Forwarding and POP/IMAP: forwarding to an address you don't know. Filters and Blocked Addresses: filters with "Forward to" or "Delete it". Accounts and Import: unknown entries under "Send mail as", "Grant access to your account" and "Check mail from other accounts". General: a changed signature or a vacation responder you didn't turn on
Outlook.com	Account settings	Microsoft's hacked-account page names connected accounts, forwarding and automatic replies
Yahoo Mail	Mail settings	Yahoo's hacked account list: filters, sending name, signature, reply-to address, send-only address, vacation response, default sending address, blocked addresses, auto-forwarding address

Google's guide adds scheduled emails, labels and blocked addresses for Gmail, and Google Account apps with access at myaccount.google.com/permissions.

Not every strange location is a hacker

Before you assume the worst, the providers themselves list innocent explanations:

Phones. Google says a mobile carrier's location can show up far from where you are, and that's not unusual as long as the carrier name matches yours. Microsoft says the same about mobile routing.
Mail apps. If you read Gmail in another app over POP or IMAP, those connections appear in the activity list too.
Travel and new devices. Microsoft may flag activity as unusual when you travel, get a new device or let an app sign in as you. Google notes airports, public computers and factory-reset devices.
Proxies. Yahoo says unfamiliar locations can appear if your device detects the wrong location or your internet provider uses a proxy server.

The test is whether the device, browser and time also fit you. An unknown Windows PC in another country at 3 a.m. is a different story from your own phone showing a city two hours away.

Hacked or spoofed?

If friends got spam "from you" but your Sent folder is clean, nothing changed in your settings and the activity pages show only you, your account may not have been touched. Anyone can put your address in the From line of a message without getting into your mailbox. That is spoofing, and our guide on how to tell if an email is spoofed shows how to confirm it from the message headers.

What to do if the signs check out

Act now, in this order: scan the device you're using, change the password (or use the provider's recovery page if you're locked out), sign out of every other session, remove anything in the settings above that isn't yours, and turn on two-step verification. Our step-by-step guide to what to do if your email is hacked covers each one.

Google also says to change the password on any site where you used the same one, and on sites tied to that email address. If you want to know how the intruder got in, can someone hack my email walks through the common routes, and has my email been in a data breach shows how to check whether your password was leaked somewhere else.

Frequently asked questions

Can I tell if someone is reading my email right now?

Partly. Gmail's "Concurrent session information" shows whether you're signed in on another device, browser or location at the moment, and Yahoo's Current sign-ins lists every device signed in. Neither shows which messages someone opened. Forwarding rules and filters matter just as much, because they let someone read your mail without signing in at all.

Will my provider tell me if my email was hacked?

Often, but not always. Google and Microsoft send alerts about unusual sign-ins and changes to security settings, and they send them to your recovery phone and email. If an intruder changed those first, the warnings go to them. That is why checking your recovery details is part of the diagnosis.

How far back can I see sign-in activity?

Microsoft's Recent activity page covers the last 30 days. Gmail's activity page shows the last 10 IP addresses, and Google's device list shows devices from the last few weeks. Yahoo does not state a period on its help page.

My email was hacked but nothing looks changed. Am I safe now?

Check the settings table above line by line, and remove app passwords and app access you don't recognize. Yahoo states that app passwords survive a password change. If everything is yours and the password is new and unique, you have closed the usual doors.

If you'd rather start fresh

Sometimes an address has been through too many breaches and keeps getting targeted. Moving to a new one is a reasonable option. Secria Mail signs you up with a name, the address you want and a password, with no phone number and no card. You can give each site its own alias, so if one leaks you can see which site it came from and stop it by deleting that alias. You can also import your old mail from Gmail, Outlook, Apple Mail or Thunderbird. The free plan includes 1 GB and 2 aliases.