How to Tell If Your Email Has Been Hacked (7 Warning Signs)

Your email is the master key to your digital life — password resets for every account flow through it. A hacked inbox means hacked everything. The scary part: most people don’t notice for weeks. Here are the warning signs that confirm a compromise, and the emergency response that takes your account back.

How can I tell if my email has been hacked?

1. Password doesn’t work anymore. The most obvious sign — and if the recovery email/phone was also changed, you’re in full account-takeover territory. Act immediately (see below).

2. “Have I Been Pwned” says so. Go to haveibeenpwned.com right now and enter your email. This free, reputable service (run by security researcher Troy Hunt) checks your address against billions of breached records. If you’re in multiple breaches, your password is circulating — change it everywhere it’s reused.

3. Sent-folder emails you didn’t write. Check Sent and Drafts for messages you don’t recognize. Hackers use compromised accounts to spam your contacts (which is also how you find out — “did you send me this weird link?”).

4. Login alerts from strange places. Gmail: scroll to the bottom > Details > “Show details” reveals recent access locations and IPs. Outlook: account.microsoft.com > Security > Sign-in activity. Logins from countries you’ve never visited are a smoking gun.

5. Missing emails or mysterious filters. Sophisticated attackers create inbox rules that auto-delete or forward password-reset emails so you don’t notice the takeover. Check your filters/rules settings — rules you didn’t create are a major red flag.

6. Contacts report spam “from you.” Classic sign. Your friends aren’t imagining it.

7. Recovery info changed. Check that your recovery email and phone number are still yours. Attackers change these first to lock you out permanently.

The First 30 Minutes: Emergency Response

If you confirm (or strongly suspect) a hack, move fast and in this order:

1. Try to sign in. If you can, change the password immediately to something long and unique. If you can’t, use the provider’s account recovery flow (Google’s and Microsoft’s are thorough — answer everything you can).
2. Check and fix recovery options. Attackers change these first; change them back and add your real phone number.
3. Review active sessions and sign everything out. Gmail: Details > Sign out all other sessions. Outlook/Microsoft: Security > Sign out everywhere. This kicks the attacker out.
4. Delete unknown filters, forwarding addresses, and app passwords. This is the step everyone forgets — attackers leave backdoors via forwarding rules and authorized apps.
5. Enable two-factor authentication NOW. Use an authenticator app, not SMS if possible. Our two-factor authentication setup guide walks through it.
6. Check connected financial accounts for unauthorized password resets or transactions — email access means the attacker tried these.

How They Got In (So It Doesn’t Happen Again)

The most common entry points, honestly ranked: password reuse (your email password leaked in some other breach — #1 by a mile), phishing (that “verify your account” email that looked real), no 2FA (a password alone is one guess away from useless), malware/keyloggers (less common but real), and old app passwords granted years ago and forgotten. Fix the actual cause: a password manager eliminates reuse permanently, 2FA blocks 99% of automated attacks per Microsoft’s own data, and reviewing authorized apps quarterly closes the forgotten backdoors. The FTC’s phishing guide trains your eye for the fakes.

After Recovery: The Cleanup Week

Regaining access isn’t the end. Over the next week: change passwords on every important account that shares (or shared) the email password — start with banking, then social, then everything else. Review sent mail and deleted items for what the attacker did (sent phishing to contacts? warn them). Check financial statements for the past month. Consider a credit freeze if financial accounts were touched — it’s free, takes 20 minutes across the three bureaus, and is the strongest identity-theft protection available. And tell your contacts: a quick “my email was hacked, don’t click links from me dated X–Y” prevents your compromise from becoming theirs.

Business Email Compromise: When It’s Your Work Account

Work email hacks follow different rules. Tell your IT department immediately — don’t try to fix it yourself, since corporate accounts have compliance and legal implications (and IT has tools you don’t). Business email compromise is also how companies lose millions: attackers impersonate executives and authorize wire transfers. If you receive an “urgent wire transfer” request from your CEO’s email, verify by phone before acting — this specific scam costs businesses billions annually, per FBI reports. And never use work email for personal account recovery; when you leave the job, you lose the email, and with it the recovery path for every account tied to it.

Passkeys: The Future That Kills Password Hacks

The long-term fix for email hacks is passkeys — cryptographic logins tied to your device that can’t be phished, guessed, or reused. Google, Microsoft, and Apple all support them now: in your account security settings, look for “Passkeys” and enroll. A passkey on your phone unlocks with your fingerprint; there’s nothing to type, nothing to steal, nothing to leak in a breach. We’re in a transition period where passwords still exist as backup, but every account you move to passkeys is one fewer hackable credential. Enable them on your email first — it’s the master key, so it deserves the strongest lock.

Help Others: Share the Warning Signs

Email hacks spread through trust — your compromised account attacks your contacts, whose compromised accounts attack theirs. When you recover, tell people what happened and share the warning signs: unexpected password-reset emails, login alerts from odd locations, friends asking about weird messages. Most people have no idea what a compromised account looks like until it’s theirs. A two-minute conversation with less tech-savvy family members (parents, grandparents) does more collective good than any single security tool — they’re the ones attackers target most, and the ones least likely to recognize the signs.

The Bottom Line

Check haveibeenpwned.com, audit sent folders and login activity, and inspect filters for attacker backdoors. If hacked: recover access, nuke sessions and forwarding rules, enable 2FA, then change reused passwords everywhere. Prevention is a password manager plus 2FA — the two tools that make 99% of email hacks impossible.