Was My Email Actually Hacked? How to Check, and What to Do First

Things that scare people but usually aren't a hack

An email from "yourself" demanding money

The classic: a message that appears to come from your own address, claiming the sender has been watching you through your webcam and will publish the footage unless you pay. It often quotes an old password of yours to seem credible.

This is a mass-mailed scam. The sender address is spoofed — writing any name on an envelope doesn't mean you have the keys to that house, and email works much the same way. The password, when there is one, comes from an old breach of some unrelated website, not from your computer. There is no footage. Delete it, and if that old password is still in use anywhere, change it — that's the only real action item.

Friends say they got spam from you

Worth checking, but usually not what it looks like. Two far more common explanations: someone is spoofing your address the same way as above, or a contact of yours had their account compromised and the spam is going to everyone in their address book with your name attached.

The test that settles it: look in your Sent folder. If the messages aren't there, they didn't go through your account. (A careful attacker deletes them — so combine this with the security log check below rather than relying on it alone.)

A "suspicious sign-in" notification

Usually genuine and usually benign: it fires when you use a VPN, travel, get a new phone, or your mobile provider routes you through a different city. Open the account's device list and see whether you recognise the entry. Critically — check it by typing your provider's address into the browser yourself, never by clicking a link in the notification email. Fake versions of exactly this alert are among the most effective phishing messages there are.

Signs that genuinely matter

Take these seriously:

• Your password stopped working and you didn't change it. Attackers lock owners out.
• Password reset emails you didn't request — for other services. It means someone is walking through your accounts using your mailbox.
• Emails missing from your inbox, or messages that show as read before you've opened them.
• Your recovery phone number or backup email changed. This is the strongest single indicator of a real compromise, and the first thing an attacker changes to keep control.
• A device or location in your account's login history that you can't account for.
• Contacts receiving mail you didn't send, and it's in your Sent folder.
• New filters, rules, or forwarding addresses you didn't create. See below.

Check the account's own security log

Every major provider records where and when your account has been accessed. Go to it directly — type the address in yourself:

• Google: myaccount.google.com/security — look at "Recent security activity" and "Your devices". Gmail also has a "Last account activity" link in tiny text at the very bottom right of the inbox, which shows recent sessions with IP addresses and lets you sign out of all other sessions.
• Microsoft / Outlook: account.microsoft.com/security → "Sign-in activity".
• Apple: Settings → your name, which lists every device signed into your Apple Account.
• Yahoo, Naver, and most others have an equivalent under account security or login history.

Read the list carefully, but don't over-interpret locations. IP-based geolocation is frequently wrong by a hundred kilometres or more, and mobile traffic often appears from wherever your carrier's gateway sits. A login from a nearby city on a device you recognise is normal. A login from another continent, or a device type you've never owned, is not.

The thing nobody checks: forwarding rules

This is the most important paragraph in this article.

When someone compromises a mailbox, the sophisticated move isn't to send spam — it's to set up a silent forwarding rule or filter that copies your mail to them, and often auto-deletes or archives the evidence. Then they change nothing else. You reset your password, feel safe, and they keep reading everything: your bank notifications, your password resets, your private correspondence. It can run for years.

Check for this every time, even if everything else looks clean:

• Gmail: Settings → See all settings → Filters and Blocked Addresses (look for any rule that forwards or deletes), and → Forwarding and POP/IMAP (look for any forwarding address you don't recognise).
• Outlook: Settings → Mail → Rules, and Settings → Mail → Forwarding.
• Apple Mail / iCloud: iCloud settings → Mail → Forwarding and Rules.

While you're there, also review connected apps and third-party access — anything with permission to read your mail. Revoke anything you don't actively use or recognise. Old app passwords are another common leftover; delete any you don't need.

If it was compromised: the order matters

Doing these in the wrong sequence lets the attacker back in. Follow the order.

1. Use a device you trust. If there's any chance a computer has malware on it, don't do the recovery from that machine — a keylogger will capture your new password too. Use a different device, and run a scan on the suspect one afterwards.
2. Change the password to something long and entirely new — not a variation of the old one. If you can't get in, use the provider's account recovery process rather than repeated login attempts.
3. Sign out of all other sessions. This is the step people skip, and it's the one that actually evicts the attacker. Changing a password does not always terminate existing logged-in sessions — until you force a global sign-out, they may still be sitting inside your mailbox. Every major provider has a "sign out of all devices" or "sign out of all other sessions" button.
4. Remove the rules, filters, forwarding, and connected apps you found above. Do this after the sign-out, so they can't simply recreate them.
5. Restore your recovery options. Check the recovery email and phone number are yours, and remove any you don't recognise.
6. Add strong authentication. A passkey or an authenticator app, not SMS if you can avoid it. Our passkeys guide covers how to do this without locking yourself out.
7. Save the recovery codes offline, somewhere that survives losing your phone.

After you've locked it down

• Change the password on anything that reused it. If the same password protected your email and six other sites, all seven are compromised. Prioritise anything with money or identity attached.
• Check accounts that reset through this email — bank, payment services, marketplaces, cloud storage. Look at their own login histories too.
• Tell your contacts if spam went out from your account, so nobody clicks it.
• Check your Sent folder and drafts for anything sent in your name. Attackers sometimes use a compromised mailbox to request payments from your colleagues or family, which is far more damaging than spam.
• If money or identity documents were involved, report it to your bank and your national fraud or cybercrime reporting service. Speed matters a great deal for recovering funds.

Why it happened, and how to stop the repeat

Accounts are rarely "hacked" in the cinematic sense. In practice it's almost always one of three things:

• Password reuse. Some site you signed up to years ago was breached, its password list was published, and attackers tried the same combination everywhere else. This is by far the most common route.
• Phishing. You signed in on a page that looked exactly like the real one. Modern fakes are visually perfect, so "being careful" is not a reliable defence — which is precisely why passkeys, which refuse to work on the wrong domain, are such a meaningful upgrade.
• Malware on a device, usually from pirated software or a fake installer, capturing credentials as you type them.

The three habits that close all of these off:

1. A password manager with a unique password everywhere. This single change removes the reuse problem entirely, which is most of the risk.
2. A passkey or authenticator app on your email account above all others, since email is the master key to everything else.
3. Check Have I Been Pwned for your addresses, and fix anything it flags. Most password managers now do this check continuously.