How to Check If Your Email Has Been Hacked (2026)
Your email account is the master key to your digital life — it controls every other account through password resets. Knowing whether it's been compromised, and acting fast, is critical. Here is everything you need to check and exactly what to do if it has.
Quick Answer
To check if your email has been hacked: (1) Run an email breach check on your address, (2) Check your email provider's recent activity log for unfamiliar logins, (3) Look in your Sent folder for emails you didn't send, (4) Check for forwarding rules you didn't create, and (5) See if friends have reported receiving strange messages from you.
Check Your Email for Breaches — Free
Instantly see if your email address has appeared in any known data breach. Takes 5 seconds, no account required.
Check My Email Free →Email hacking — key statistics
15B+
Email credentials in breach databases
94%
Of malware delivered via email
1 in 5
People have had email accounts compromised
197 days
Average time to detect a breach
Why Your Email Account Is So Valuable to Attackers
Your email inbox is more valuable than most people realise. Beyond the messages themselves, access to your email account means:
- The ability to reset the password on every other account you own — banking, social media, shopping, work
- Access to years of financial statements, tax documents, and personal records stored or receipts emailed to you
- The ability to send convincing phishing emails to all your contacts, who trust your address
- Corporate email access that may expose colleagues and clients to targeted attacks
- OAuth tokens — many apps let you "sign in with Google/Apple", giving access to the app through your email
8 Warning Signs Your Email Has Been Hacked
Emails in your Sent folder you didn't send
CriticalAttackers commonly use compromised email accounts to send spam or phishing emails to your contacts. Check your Sent folder for any messages you don't recognise.
Friends report receiving strange emails from you
CriticalIf contacts reach out about weird emails they received from your address, your account has almost certainly been compromised and is being used to send spam.
You're locked out of your account
CriticalAn attacker who changed your password to lock you out is using your account actively. Use account recovery options immediately — every minute counts.
Unexpected password reset emails for other accounts
CriticalIf you receive reset emails for accounts you didn't request, someone may be using your email to take over your other accounts right now.
Login notifications from unfamiliar locations
HighMost email providers send alerts for new device or location logins. A notification you didn't expect is a strong sign of unauthorised access.
Email forwarding rules you didn't set up
HighCheck Settings → Forwarding (Gmail) or Rules (Outlook). Attackers frequently set up silent rules to forward copies of your email to themselves.
Filters or rules that delete or archive messages
HighSome attackers create rules to auto-delete security notifications or messages that would alert you to their presence.
Messages marked as read that you haven't opened
MediumSomeone reading your emails would open and possibly mark them as read. Unexpectedly read messages are a subtle sign of access.
How to Check Your Email Account Right Now
Run through these checks in order — the whole process takes about 5 minutes:
Check 1: Run a breach database check
Enter your email address into SafeSearchScan's email breach checker. This searches databases of known breaches to see if your credentials have been exposed. If your email appears in a breach, change your password for that service immediately — and change your email password too if you reused it.
Check 2: Review recent account activity
- Gmail: Scroll to the very bottom of Gmail → click "Details" next to Last account activity
- Outlook / Hotmail: outlook.com → Settings → View all Outlook settings → Privacy and data → Browse your data → Security
- Yahoo: Scroll to Account Security → Review recent activity
- Apple iCloud: appleid.apple.com → Security section → View all devices signed in
Check 3: Inspect your email settings
Go to your email settings and check:
- Forwarding: No addresses you don't recognise should receive copies of your email
- Filters/Rules: No rules should be silently deleting or moving security notifications
- Delegates: No one should have delegate access unless you explicitly granted it
- App passwords: Review and revoke any third-party apps you don't recognise
- Recovery phone/email: Verify these are still yours and haven't been changed
If Your Email Has Been Hacked: Recovery Steps
Act quickly. The faster you respond, the less damage an attacker can do:
- 1
Change your email password immediately
Use a strong, unique password you've never used before. Do this from a device you trust — not the one that may have been used to steal the original password.
- 2
Enable two-factor authentication
This is the most important protective step. Even if an attacker has your new password, they cannot log in without your second factor.
- 3
Sign out all other sessions
Gmail: Settings → All Settings → Scroll to bottom → "Sign out of all other Gmail web sessions." This kicks out any active intruders.
- 4
Check and remove forwarding rules
Settings → Forwarding. Remove any addresses you don't recognise. Check Filters for any rules that shouldn't be there.
- 5
Check recovery options
Verify that the recovery email and phone number are still yours. If they've been changed, use your email provider's account recovery process.
- 6
Secure all connected accounts
Change passwords for any account that uses this email to login or that you could reset via this email. Prioritise banking, social media, and shopping accounts.
- 7
Alert your contacts
If you found emails sent from your account that you didn't write, warn your contacts not to click any links in those messages.
- 8
Check for malware on your devices
If your password was stolen via keylogger, your device may still be infected. Run a malware scan before creating new passwords on that device.
How to Prevent Your Email Being Hacked
- Use a strong, unique password — not reused from any other account
- Enable two-factor authentication (authenticator app is best)
- Regularly check for breaches using an email breach checker
- Be suspicious of emails asking you to click links or confirm your password
- Use a separate email address for newsletters and low-trust signups
- Keep your recovery phone and email up to date
- Review account activity every few months
Check Your Password Strength
Weak or reused passwords are the leading cause of email account compromise. Test your current password strength and see how long it would take to crack.
Test Password Strength Free →Check Your Email for Breaches — Free
Cross-reference against XposedOrNot, HIBP, and more. Find out which sites leaked your email and when.
Check Your Email Free →Frequently Asked Questions
What is the fastest way to check if my email has been hacked?
The fastest check is to use a breach monitoring service: enter your email address into SafeSearchScan's email breach checker — it searches known breach databases and tells you instantly if your email has been exposed. Also check your email provider's "Recent Activity" or "Last account activity" section for logins from unknown locations or devices. A breach check takes under 10 seconds.
Can someone hack my email without me knowing?
Yes. Many attackers specifically avoid detection: they read your email without sending anything, set up silent forwarding rules to receive copies of your mail, or use your account occasionally to avoid triggering security alerts. Data breach exposure can mean your credentials are quietly used months or years later. Regular checks — using a breach checker and reviewing account activity — are the only reliable way to catch silent access.
If my email was in a data breach, does that mean it's been hacked?
Not necessarily. A breach means your email address (and potentially your hashed password) was exposed in a database leak from a third-party service. Your email account itself may be fine — especially if you used a unique password for the breached service. However, if you reused that password on your email account, your email is at high risk. Change your email password immediately if your email appeared in a breach of any service.
Should I close a hacked email account and start fresh?
In most cases, no — recovering a hacked account is better than abandoning it. Closing the account does not protect the data that was already accessed. More importantly, your old email address is linked to dozens or hundreds of other accounts, and losing it means losing the ability to reset passwords for all of them. Secure the account with a new password, 2FA, and audit recovery options instead.
Related Guides
What to Do After a Data Breach
Step-by-step guide for the next 48 hours
What Is Two-Factor Authentication?
Stops 99% of account hacks — set it up now
How to Create a Strong Password
Passwords that take centuries to crack
How to Spot a Phishing Email
9 warning signs to check every time
How to Prevent Identity Theft
10 protective habits to set up today
How to Tell If an Email Is a Scam
8 red flags that identify scam emails