How to Tell If Your
Email Was Hacked
7 Warning Signs — and Exactly What to Do If It Happened to You
Most email compromises don’t announce themselves with obvious alarms. Here are the seven signs to look for — and the step-by-step recovery process if your account has been accessed without your permission.
Most of us have had that uneasy feeling — a contact mentions receiving a strange email from you, or you notice an unfamiliar login location in your account history. Email compromise is far more common than most people realize. There’s an identity theft incident in the US roughly every 22 seconds, and compromised email accounts are one of the leading entry points. The problem is that most email breaches don’t come with obvious alarms — attackers often operate quietly for days or weeks before you notice anything. This guide shows you exactly what to look for and what to do about it.
theft incidents
in the US
by the Morphing
Meerkat phishing kit
use a password
manager
can lurk undetected
in compromised accounts
The methods attackers use to compromise email accounts have become increasingly sophisticated and automated. Phishing remains the most common vector — but modern phishing kits like Morphing Meerkat can impersonate over 114 brands, dynamically detect your email provider, and serve a perfectly replicated login page with your email address pre-filled. Once you enter your password, it’s transmitted to attackers instantly before redirecting you to the real login page, leaving you unaware anything happened.
Password spraying — where attackers try commonly used passwords across thousands of accounts — is particularly effective because so many people reuse passwords across services. Data breaches at other websites expose credentials that then work on email accounts using the same password. Simply opening a well-crafted phishing email and clicking a link was enough to compromise accounts in documented March 2025 attacks that exploited an unpatched Chrome vulnerability. The common thread across all these methods: you often don’t know it happened until you look for the signs.
One sign alone doesn’t always confirm a compromise — but multiple signs together mean you should act immediately.
- Login fails with your known correct password
- Check if you’ve been redirected to a fake login page recently
- Use your provider’s official account recovery immediately — don’t delay
- Contacts receive emails with suspicious links or money requests “from you”
- Check your Sent folder for messages you don’t recognize
- Alert your contacts not to click any recent links from your address
- Gmail: Settings → Security → “Your devices” and “Recent security activity”
- Outlook: Account settings → Security → “Review activity”
- Sign out of all other sessions immediately if you see unfamiliar locations
- Emails being silently copied to an address you don’t recognize
- Gmail: Settings → See all settings → Filters and Blocked Addresses + Forwarding
- Delete any forwarding rules or filters you didn’t create — then change your password
- Recovery email or phone number changed without your knowledge
- Security questions altered to answers you don’t recognize
- Check and restore all recovery options immediately after regaining access
- Unexpected password reset emails for linked accounts (bank, social media)
- Do NOT click the links in these emails — log in separately to change passwords
- Prioritize financial and banking accounts — change those passwords first
- Emails or replies you’d expect to find are missing or deleted
- Check Trash, Spam, and All Mail for messages that shouldn’t be there
- Review all filter rules — attackers often create “move to trash” rules to hide activity
| Step | Action | Priority |
|---|---|---|
| 1. Regain access | Use official provider recovery process (not email links) | Immediate |
| 2. Change password | Create a strong, unique password not used anywhere else | Immediate |
| 3. Enable MFA | Turn on two-factor authentication (authenticator app preferred) | Immediate |
| 4. Check forwarding rules | Delete any filters or forwarding rules you didn’t create | Within 1 hour |
| 5. Review recovery info | Verify recovery email and phone are still yours | Within 1 hour |
| 6. Run virus scan | Full (not quick) scan on all devices used to access email | Same day |
| 7. Alert contacts | Notify contacts not to click any recent links from your address | Same day |
| 8. Secure linked accounts | Change passwords for banking, social media, and other key services | Within 24 hours |
The three changes that provide the biggest security improvement are all free and take under 10 minutes to implement. First, enable two-factor authentication on your email account — an authenticator app (Google Authenticator, Authy) is significantly more secure than SMS codes, since SIM-swapping attacks can intercept text messages. Second, use a password manager to create and store a unique, strong password for every account, so a breach at one service can’t cascade into others. Third, check whether your email address has been exposed in known data breaches using Have I Been Pwned (haveibeenpwned.com) — if it has, change the affected passwords immediately.
Beyond those three steps, be skeptical of any login pages reached through email links — always navigate directly to your provider’s website by typing the URL rather than clicking through. Modern phishing kits are visually indistinguishable from real login pages. If you receive an unexpected password reset email or security alert, treat it as potentially fraudulent and access your account directly, not through the email.