The clearest sign your email was hacked is emails you never sent sitting in your Sent folder, or a password reset notification for an account you did not request. If you spot either, change your email password immediately, then work through the steps below in order, since the sequence matters more than doing everything at once.
The warning signs, ranked by urgency
- Confirmed, act now: emails in your Sent folder you did not write, a login alert from an unfamiliar location, your password no longer working
- Likely, investigate today: contacts mentioning strange messages from you, missing emails, unexpected password reset emails from other services
- Worth watching: your account appearing in a data breach checker, even without other symptoms yet
What to do first, in this exact order
1. Change your email password immediately
Do this before anything else. If you still have access, use a genuinely new password, not a variation of the old one. If you have been locked out, use your provider’s account recovery process straight away, since delaying gives an attacker more time inside your account.
2. Turn on two factor authentication
This single step blocks most follow up attempts, even if your new password is somehow compromised again later. Most providers offer this under Security settings, using either a text message code or, more securely, an authenticator app.
3. Check for forwarding rules and recovery changes
A common tactic is setting up a hidden rule that forwards a copy of every email you receive to the attacker, or quietly changing your recovery phone number or email. Check your account’s Filters, Forwarding, and Recovery Information settings for anything you did not set up yourself.
4. Check where else that password was used
If you reused your email password anywhere else, change it there too, starting with banking, shopping, and any account tied to payment details. This is the step most people skip, and it is often how a single email breach turns into a much bigger problem.
5. Review recent account activity
Most email providers show a recent login activity log, including location and device. Check this for anything unfamiliar and end any sessions you do not recognise.
How to tell if you were part of a wider data breach
Sometimes an account is compromised not through anything you did wrong, but because a company holding your email address was breached. Checking a reputable breach lookup tool for your email address will tell you whether it has appeared in a known breach, and which one, which helps you understand whether the password involved is one you have reused elsewhere.
Once your account is secure
Tell close contacts not to click links or open attachments from any suspicious message sent from your address during the affected period, since it likely was not you. If reused passwords were part of the problem, it is worth solving that properly rather than just patching each account individually, our guide on creating a password you will actually remember that is still secure covers a practical way to do that without needing to memorise dozens of different passwords.
FAQs
Can someone hack my email just by knowing my email address?
No, knowing the address alone is not enough. They also need your password, or need to trick you into revealing it through a phishing attempt.
Should I delete my email account and start fresh?
Usually not necessary. Securing the existing account with a new password and two factor authentication is normally enough, and starting fresh means losing years of message history and needing to update every linked account.
How long does it take for hackers to act after getting a password?
It varies, but automated attempts using stolen credentials often happen within hours, which is why changing your password immediately matters more than doing every other step perfectly.
