TL;DR:
Being in a data breach is not the same as being hacked, so check both. Have I Been Pwned tells you whether your address was exposed; your provider’s sign-in activity tells you whether someone is inside. If they are, work the lockdown in order: scan your device, change the password, sign out other sessions, fix recovery details, delete forwarding rules you did not create, and switch on two-step verification.
Published: 9 November 2026. Last checked: 23 October 2026.
What are the signs your email account has actually been hacked?
The reliable signs are changes you did not make. A password that suddenly stops working. Recovery details you do not recognise. Sign-ins from places you have never been. Messages sitting in your Sent folder that you never wrote. Contacts asking about strange mail from you. One or two odd emails are not proof.
Anyone can type your address into a reset form, and a spam spike usually just means your address was sold. Treat the signs above as the real alarm, especially in combination, and confirm with the two checks below. Attackers move quickly: they change the password, adjust recovery details so they can return, and set up silent forwarding so they keep reading your mail after you act.
How do you check if your email address was in a data breach?
Start at haveibeenpwned.com, a data breach search and notification service that, in its own description, aggregates tens of billions of breached records. Enter your email address and it lists the breaches your address appears in, with dates and the kinds of data exposed. It costs nothing and needs no account.
- Go to haveibeenpwned.com and type your email address into the search box.
- Read each breach it lists. Note the date and, above all, what data was exposed: an email address alone is a nuisance; an email plus a password is an emergency for every account where you reused it.
- Turn on the site’s free Notify me alert, so you hear about future breaches involving your address instead of finding out by accident.
- Repeat the check for any other addresses you use.
Two limits keep this check honest. A result means your details circulated in a breach, not that anyone is reading your inbox today. A clean result means your address is not in the breaches the service has loaded, most large ones, not a guarantee about every leak. Either way, a breached password should be changed on that service and everywhere you reused it.
How do you check whether someone is signed in to your account right now?
Every major provider keeps a sign-in record, and it is the closest thing to a yes or no answer. Look for devices, locations and times you do not recognise, then sign out anything unfamiliar from the same screen. For Google, open your Google Account, then Security, then Your devices. For Microsoft, open the account activity page.
Google and Gmail: in your Google Account, review Recent security events and Your devices, and remove anything unfamiliar. Inside Gmail, scroll to the inbox bottom and click Details (bottom right) to see recent sessions with access type, location and time, and to sign out all other web sessions on the spot.
Microsoft and Outlook: the Microsoft account activity page lists successful and failed sign-ins with locations. Expand anything unusual and flag that it was not you.
Apple and iCloud Mail: check the devices signed in to your Apple Account under your name in Settings, or at account.apple.com, and remove any you do not own.
Could your address just be spoofed instead of hacked?
Often, yes. Spoofing means someone forged your address as the sender without ever entering your account, the email equivalent of writing your return address on an envelope. Two checks separate the cases: if the strange messages are not in your Sent folder, and your sign-in activity shows nobody unfamiliar, spoofing is far more likely than a hack.
That distinction decides what you do next. A spoofed address needs no password change, because nothing inside your account needs fixing; the forged messages usually stop on their own. A hacked account leaves evidence inside: sent mail you did not write, stranger sessions, changed settings. If either inside check is positive, run the lockdown below.
What should you do first if your email has been hacked?
Work in this order, because each step protects the next. Scan the device you are about to use, change the password from it, sign out every other session, restore your recovery details, delete any forwarding or filter rule you did not create, then switch on two-step verification and review which apps can access your account.
- Scan your device first. Microsoft’s recovery guide puts this before everything: run a full antivirus scan before changing your password, so a keylogger cannot record the new one. Our roundup of the best free antivirus covers free tools.
- Change the password from a trusted device. A long, unique password you have never used elsewhere, on your own device and network, never public Wi-Fi. Savozi’s free password generator creates one in a click.
- Sign out every other session and device. A password change alone does not always end sessions already open. Use the device list from the check above and sign out everything except the device in your hand.
- Fix your recovery email and phone. Attackers change these so they can reset your password later. Confirm both are yours, and remove anything you do not recognise.
- Delete forwarding rules and filters you did not create. The step most people miss; the next section gives the exact locations.
- Turn on two-step verification. Google calls it 2-Step Verification, Microsoft two-step verification, Apple two-factor authentication. Prefer an authenticator app or passkey over text codes where offered.
- Revoke suspicious app access. In Google, review Third-party access under Security; remove anything unfamiliar or unused, because a connected app can keep reading mail after a password change.
Where do you check for hacker-added forwarding rules and filters?
Attackers add forwarding or a filter so copies of your mail reach them silently, and the rule survives a password change. In Gmail, open Settings, See all settings, and audit the Forwarding and POP/IMAP tab and the Filters and Blocked Addresses tab. In Outlook, check Settings, Mail, Forwarding and Settings, Mail, Rules.
| Provider | Sign-in activity | Forwarding and rules |
|---|---|---|
| Google (Gmail) | Google Account > Security > Your devices; Gmail > Details (bottom right of the inbox) | Settings > See all settings > Forwarding and POP/IMAP; Filters and Blocked Addresses |
| Microsoft (Outlook) | account.live.com/Activity | Settings > Mail > Forwarding; Settings > Mail > Rules |
| Apple (iCloud Mail) | Devices list under your name in Settings, or account.apple.com | iCloud.com > Mail > Settings > Rules |
Delete any rule that forwards, deletes or files away mail you never set up, especially rules targeting messages about passwords, banks or security codes. Microsoft’s recovery guide adds two neighbours worth the same minute: your connected accounts and your automatic replies, since a fake out-of-office message is another quiet way attackers harvest responses.
What if you are completely locked out of your email?
Use only your provider’s official recovery route, and expect it to ask for proof the account is yours. Google sends you to its account recovery page and advises answering as best you can, ideally from a device and place you have signed in from before. Microsoft runs a sign-in helper, then its account recovery form. Apple starts at iforgot.apple.com.
In full: Google’s hacked account guide walks from sign-in problems to securing the account, and its recovery page resolves a changed password or recovery phone. Microsoft’s recovery guide opens with a sign-in helper; the recovery form at account.live.com/acsr is where you prove ownership with old passwords, folder names and contacts. Apple’s security help page says that if you believe your Apple Account has been compromised, change your password immediately; iforgot.apple.com is the reset route when you cannot. Once back in, run the full lockdown above: recovery alone removes neither the attacker’s rules nor their sessions.
Which other accounts should you secure after an email hack?
Assume the attacker tried your email password, and any password they found inside, everywhere. Work in this order: banking and payment apps first, then social media, then shopping sites with saved cards, then cloud storage. Change each password to a unique one and switch on every login alert and two-step option they offer.
Email sits at the centre because every other account resets through it. While you sweep, check bank and card statements for transactions you do not recognise, and review your social accounts’ login activity the same way. Our online privacy guide for beginners covers the habits that keep one breach from becoming ten. A password manager earns its place here: dozens of unique passwords is not a human job.
How do hackers get into email accounts in the first place?
Almost never by breaking into the provider itself. The common routes are a password leaked in some other site’s data breach and retried everywhere, a phishing page that records the password you type, malware that logs keystrokes, and, for accounts protected only by text codes, a SIM swap that redirects those codes to the attacker.
- Data breaches and credential stuffing. Automated tools try millions of leaked email and password pairs against login pages. Unique passwords make a leaked pair worthless everywhere else.
- Phishing. A message that looks like it is from your bank or provider asks you to sign in through a link, and the page behind it is fake. Go to the site directly, never through the link.
- Malware. Keyloggers and information-stealing programs capture passwords as you type. Keep devices updated and install software only from sources you trust.
- SIM swapping. The attacker persuades your mobile carrier to move your number to their SIM. It is the strongest argument for authenticator apps and passkeys over text codes.
Notice the pattern: a unique password plus two-step verification defeats nearly every route on that list.
Keeping a reputable free antivirus running also helps stop the malware that steals sign-in sessions; see our best free antivirus 2026 picks.
Frequently asked questions
Does appearing on Have I Been Pwned mean my email is hacked?
No. It means your address, and sometimes a password, appeared in a breach at some service you used. That is exposure, not access. It becomes urgent only if you still use that password anywhere: change it on the breached service and everywhere that shares it, then check your sign-in activity.
I received a password reset email I did not request. Am I hacked?
Not by itself. Anyone who knows your address can trigger one, and many are phishing dressed as one. Never use its links. Go directly to your provider, check sign-in activity, and act only if you find sessions, sent mail or settings you do not recognise.
Should I pay a service to check or fix a hacked email?
No. Every check and fix here is free and official: the breach search, activity pages, recovery routes and security settings all belong to the providers. Be wary of any site that asks for your email password to “check” your account; that is how accounts get hacked, not fixed.
How often should I repeat these checks?
Keep the breach alerts on and they work continuously. Then give your account a five-minute review once or twice a year: forwarding rules, filters, connected apps, recovery details and the device list.
What should you do today?
Run the two checks now, breach first, activity second: together they take minutes and settle whether you have a problem. If anything inside the account is not yours, work the lockdown in order and finish with the other-accounts sweep. Warn frequent contacts if spam went out in your name.
Two habits keep it settled: never reuse a password on anything that matters, and treat urgent sign-in emails as guilty until you reach the site by typing its address yourself. The same suspicion serves you beyond email: our guide to stopping spam calls and texts applies it to your phone, and our best free VPN roundup covers signing in on public Wi-Fi.
