To check whether someone may have accessed your email, open your provider’s official app or website yourself and review recent sign-ins, devices, recovery details, connected apps, and mailbox settings. Then look for messages you did not send, missing mail, or changes you did not make. A suspicious sign-in or setting is a reason to investigate—not, by itself, proof of who accessed the account. If you find an unauthorized change, secure the account promptly; if you are locked out, use the provider’s official recovery process.
Start with the provider’s official account page
Do not use a link in an unexpected “suspicious sign-in” or password warning email. Open the provider’s known website or app yourself, then navigate to its security or recent-activity area. This helps avoid entering your password on a fake warning page. Microsoft specifically advises people unsure about an unusual-activity email to sign in to their Microsoft account without clicking links in that message.
As an Amazon Associate I earn from qualifying purchases.
If you use a work or school mailbox, establish whether it is a managed account before changing settings. Your organization may control sign-in policies and mailbox configuration, and its administrator may have access to logs that are not available to an ordinary user.
Before you start, note the time you noticed the problem and what prompted you to check: a warning, an unexpected message, a password change, or a report from a contact. This helps you compare events with your own activity and gives a provider or administrator a useful starting point if you need help. Do not forward suspicious messages to yourself or click their links as a way to test them.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review sign-ins and devices
Google accounts
In your Google Account, open the security area and review Recent security events. Then check Your devices for devices you do not recognize. Google’s account-help guidance recommends reviewing both areas when you think someone else may be using your account. If you find a device that is not yours, remove it and continue checking the account rather than treating removal as a complete investigation.
Microsoft accounts
Review the Recent activity page for your Microsoft account. Entries can include the date and time, location, IP address, device or operating system, and browser or app. Microsoft says the page shows significant events, not every account event, so an empty or apparently normal list cannot rule out all access.
Interpret locations cautiously. Mobile phone services can route activity through locations that differ from yours, and a location mismatch alone may be a false lead. A successful sign-in, security-information change, or app permission you cannot explain deserves closer attention, especially when it lines up with an unfamiliar device or a mailbox change.
When reviewing an event, compare its time with your own travel, device use, and sign-in attempts. An event you recognize as a failed attempt is different from a successful sign-in you cannot explain. A failed attempt does not establish that the person got into the account, but it can still be a reason to use a unique password and check that recovery details and two-factor verification are under your control. Likewise, an entry with an unfamiliar device name may be one of your devices described differently; cross-check the time and operating system before deciding.
Work and school Microsoft 365 accounts
For a managed Microsoft 365 account, ask your administrator to review Microsoft Entra sign-in and audit logs if user-visible activity does not answer the question. Microsoft’s administrator guidance identifies IP address, location, time, and whether an event succeeded or failed as useful investigation details. These logs and the inspection of hidden inbox rules are administrative procedures, not routine consumer settings.
Give the administrator concrete details rather than only saying that the account looks suspicious: the approximate time, event or setting you noticed, any unusual messages, and whether you can still sign in. Keep any relevant notification or message available, but do not send passwords or verification codes. Because a work or school account may be managed centrally, an administrator can determine whether a policy, shared mailbox, or legitimate organizational tool explains an unfamiliar setting or event.
Check who can regain access
Review the account’s recovery and verification information. Look for an email address, phone number, alternate address, or verification method that you did not add. An unfamiliar recovery contact can let another person regain access even after you change your password. Google flags unknown recovery or alternate-contact changes as suspicious; Microsoft’s recent-activity descriptions include security-information changes such as adding or deleting an alternate email, phone number, or verification app.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Also inspect applications that have permission to access the account. Remove access for an app you do not recognize or no longer use, taking care not to revoke a legitimate work or accessibility tool without understanding its purpose. A familiar app name is not enough by itself: check whether you recognize granting it access and whether the permission is still needed.
Think of recovery information and app permissions as separate ways to retain access. A person who changed a recovery phone may be able to attempt a later reset; an app with account permission may continue to interact with email even if you do not see a new browser sign-in. That is why a password change alone is not a complete check. Confirm that the contact methods belong to you, revoke access you cannot explain, and then review activity and mail settings again.
Inspect the mailbox for changes and consequences
Look for messages and missing mail
Check Sent for messages you did not write and Deleted for mail you did not delete. Look for missing messages, unexpected replies, or contacts telling you they received unusual mail from your address. Microsoft lists suspicious messages in Sent or Deleted, missing or deleted mail, and unusual mailbox rules among possible Microsoft 365 compromise symptoms. These clues can indicate that someone used the account, but none establishes the cause on its own.
Consider what an intruder might have tried to hide. A deleted warning from a service, a missing password-reset email, or an unexpected reply in a conversation can be more informative than a blank Sent folder. Check the mailbox folders and settings available to you, but do not assume that every missing message means an attacker deleted it; ordinary cleanup, filters, and provider behavior can also affect where mail appears.
Recommended Free Tools
Check forwarding, rules, and delegation
Review forwarding and automatic replies, then inspect filters, inbox rules, labels, and delegation or other shared-access settings that your provider offers. In Gmail, Google’s account-help guidance specifically calls out forwarding, filters, labels, delegation, and other settings to check for changes you did not make. Microsoft’s account-recovery instructions call out connected accounts, forwarding, and automatic replies.
Pay particular attention to a rule that forwards, copies, archives, or deletes certain messages. Someone who can receive password-reset messages may be able to pursue access to other accounts even if no unfamiliar sign-in remains visible. The UK National Cyber Security Centre warns that criminals may set forwarding rules to receive copies of email and use them to reset passwords elsewhere. For Microsoft 365, administrators can inspect mailbox forwarding and inbox rules, including hidden rules, using administrative tools; that is not the same as a normal user checking visible inbox settings.
For each unfamiliar rule, record what it does before removing it, especially if this is a managed account where an organization may have set legitimate routing. For a personal mailbox, remove settings you did not authorize, then look for other rules that could conceal replies or security alerts. Revisit the settings after changing your password and ending sessions, because the goal is not only to remove one visible clue but to ensure mail is no longer being redirected or handled unexpectedly.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Know what the signs do—and do not—tell you
Several indicators together are more useful than one isolated clue. For example, an unexplained successful sign-in followed by a changed recovery phone and a new forwarding rule is a stronger reason to act than a location that looks unfamiliar on its own. Conversely, authorized apps, travel, mobile-network routing, and incomplete activity pages can make legitimate activity look suspicious or conceal some events.
| What you notice | What it can mean | What to check next |
|---|---|---|
| Unfamiliar successful sign-in or device | Possible access, but location or device details can be misleading. | Compare the time and device with your own activity; review security changes and mailbox settings. |
| Recovery email, phone, or verification method changed | Someone may be trying to retain or regain access. | Restore contact details you control and review recent sign-ins. |
| Forwarding, filter, rule, or automatic reply you did not set | Mail may be exposed, redirected, hidden, or answered without your knowledge. | Remove the unauthorized setting and inspect Sent, Deleted, and missing mail. |
| Unexpected messages sent from your address | The account or a connected application may have been used to send them. | Review sign-ins, connected apps, and sessions; warn affected contacts. |
| Password-reuse or breach warning without a strange sign-in | A password may be exposed elsewhere; this does not establish current access to this mailbox. | Change reused passwords and continue checking the email account itself. |
A breach notice or password lookup is not a definitive test of current mailbox access. The official guidance covered here does not establish a particular lookup service as proof that someone is—or is not—inside your email account. Treat a reused or exposed password as a reason to replace it, then assess the account through its own activity, recovery, app, and mailbox settings.
It is also possible to have a warning sign without being able to identify the person or method involved. An account activity page can show a time, location, or device, but those details do not necessarily identify who was using it. A clean-looking page is not a forensic guarantee, particularly when the provider says it displays only significant events. Use the combination of signs to decide whether to secure the account, and ask the provider or your organization’s administrator when the remaining uncertainty matters.
What to do if you find unauthorized access
If you can still sign in
- Use a trusted device. If you suspect the device you are using may be infected, switch to a device you trust. Microsoft’s compromised-account instructions recommend running a full malware scan before changing the password from that computer.
- Change the password. Set a strong, unique password that you do not use on another site. If the account may have been accessed, change reused passwords on other accounts too; Google explicitly advises this when someone else may be signed in elsewhere with the same password.
- End other sessions where available. Use the provider’s option to sign out other devices or sessions, if offered. Then remove devices and connected apps you do not recognize.
- Restore account control. Correct recovery email addresses, phone numbers, and verification methods so they belong to you. Remove unauthorized forwarding, filters, rules, delegation, connected accounts, or automatic replies.
- Turn on two-factor authentication. Enable the provider’s two-step or two-factor verification option. A FIDO2 hardware security key is one possible second factor supported in Google’s 2-Step Verification guidance; verify that your provider and devices support the key before buying one. A security key can help protect future sign-ins, but it does not identify a past intruder or replace account recovery.
- Review the mailbox again. Check for changes or suspicious messages made before you secured the account, and make sure the settings you corrected remain as intended.
Work through those actions in a deliberate order: secure access from a device you trust, change the password, end sessions where possible, restore recovery control, remove unauthorized access and mail handling, then enable two-factor verification and recheck. The exact controls differ by provider, so use the options that are available rather than assuming every service has a universal “sign out everywhere” button. If you cannot change a setting, or it returns after removal, ask the provider or administrator for help rather than repeatedly changing it without resolving the cause.
Two-factor authentication adds a second check to future sign-ins, but it is not a substitute for cleaning up a compromised account. A FIDO2 security key is an optional physical form of second factor, not a diagnostic device and not a recovery service. Check that the provider and the devices you use support the key before purchasing one. The account activity review and basic mailbox checks described here can be completed through provider settings without buying a special product.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →If you are locked out
Use the email provider’s official recovery process from its website or app, not a recovery link sent by an unverified message. Google directs users to account recovery if a password or recovery phone changed or access is lost. Microsoft offers a sign-in helper and password-reset path. Follow the provider’s prompts using information and devices you can verify; do not give a recovery code to someone who contacts you unexpectedly.
If recovery succeeds, do not stop at getting back into the inbox. Review the recovery phone and email, connected apps, devices, and mail settings before relying on the account again. If the provider cannot verify that you own the account, use its official support or recovery channel rather than a person or service that promises access in exchange for your password or a code.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect people and accounts connected to the mailbox
Tell contacts who may have received a suspicious message to treat it cautiously, especially if it asks them to open an attachment, follow a link, or send money. If financial or identity information may have been exposed, Google advises contacting the bank or local authorities as appropriate. In the United States, the FTC directs people who suspect personal-information theft to IdentityTheft.gov. These steps address possible downstream harm; they do not replace securing the email account.
Also identify accounts that use the compromised mailbox for password resets or that share its old password. Change reused passwords on those accounts, prioritizing accounts where the same password could still work. Do not assume that an attacker needs to remain signed in to your email to cause harm: access to a copied reset message or a forwarding rule may have been enough to attempt a reset elsewhere. After securing the mailbox, check those other accounts through their own official security settings too.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose the right level of investigation
| Account type | Checks available to the account holder | When to involve someone else |
|---|---|---|
| Consumer email account | Provider security events or recent activity, devices, recovery details, connected apps, and visible mailbox settings. | Contact the provider if you cannot recover access or unexplained changes remain after you secure the account. |
| Work or school Microsoft 365 account | User-visible account activity and mailbox settings allowed by the organization. | Ask the administrator to review Entra sign-in and audit logs, and inspect rules or forwarding that require administrative tools. |
For a consumer account, a provider’s recovery channel is the next step if you cannot sign in or cannot remove an unauthorized change. For a managed account, report the concern to your organization’s IT or security team; an administrator may be able to examine events and settings that are not visible in your mailbox. If you still cannot explain an event after checking devices, recovery details, apps, and mail settings, do not assume that either a clean activity page or one suspicious location settles the question.
The practical difference is visibility and control. Consumer account holders generally work with the provider’s own security and recovery screens, and the exact session-revocation options vary by provider. A work or school user may be able to see some activity but not all of the sign-in or audit details an administrator can inspect. Similarly, a person using a personal mailbox can review visible forwarding and filters, while hidden Microsoft 365 rules require administrative tooling. In either case, explain what you observed and when; do not try to access logs or settings you are not authorized to use.
There is no single universal check that answers every version of “Was my email hacked?” Review account activity for access clues, settings for persistent access or concealment, and messages for effects. If one area looks normal but another shows a change you did not make, treat the change on its own merits and continue. If all user-facing checks look normal but you have a credible reason for concern, ask the provider or managed-account administrator what else can be reviewed.
Sources and scope
This guidance reflects official account-security instructions from Google and Microsoft, consumer advice from the U.S. Federal Trade Commission, and guidance from the UK National Cyber Security Centre. The FTC page identifies itself as October 2024. The pages were accessed October 9, 2026. Provider interfaces and settings can change; use the labels currently shown in your account. The Microsoft 365 log and hidden-rule checks described above are for administrators, not ordinary consumer workflows. No published statistic about the accuracy of these checks or the prevalence of consumer email compromise is cited here.
Frequently Asked Questions
How can I tell if someone is using my email account?
Review the provider’s recent security events or sign-in activity, devices, recovery details, connected apps, and mail settings. Also check Sent and Deleted for messages or mail you did not handle. An unfamiliar successful sign-in combined with a changed recovery detail or forwarding rule is more concerning than one location mismatch by itself.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Does an unfamiliar sign-in location prove my email was hacked?
No. Mobile phone services can route activity through a different location, and travel or device details can be confusing. Check the event time, whether the sign-in succeeded, the device or app, and whether account or mailbox settings changed. Microsoft also notes that its Recent activity page does not show every event.
Can my account be compromised if I do not see an unfamiliar sign-in?
A normal-looking activity page does not rule out all access. Activity pages may show only significant events, and unauthorized forwarding or rules can expose future messages without an unfamiliar sign-in remaining visible. Check recovery details, connected apps, devices, forwarding, filters, and other mailbox settings too.
What should I do first if I find a forwarding rule I did not create?
If this is a personal account, remove the unauthorized rule, then review other filters, forwarding, automatic replies, and delegation settings. Secure the account by changing to a unique password from a trusted device, ending other sessions where available, checking recovery details, and enabling two-factor verification. For a work or school Microsoft 365 account, involve the administrator because hidden rules may require administrative tools.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I use a breach lookup site to confirm whether my email was hacked?
A breach or password-reuse notice can be a reason to change an exposed or reused password, but it does not prove current access to your mailbox. Check the email provider’s own activity, recovery, app, and mail settings; a lookup is not a definitive compromise test.
What if I can no longer sign in?
Go directly to your provider’s official website or app and use its account-recovery process. Google directs users to account recovery when a password or recovery phone changes or access is lost; Microsoft offers a sign-in helper and password-reset path. Do not share a recovery code with someone who contacts you unexpectedly.
Can a security key tell me whether someone accessed my account?
No. A FIDO2 hardware security key can be a second factor for future sign-ins where the provider and your devices support it. It does not detect past access or replace account recovery, and compatibility should be checked before buying one.
The Bottom Line
Check more than the sign-in list: review devices, recovery contacts, connected apps, and mailbox rules, then inspect Sent and Deleted for consequences. If you find a change you did not make, secure the account from a trusted device, use the provider’s official recovery options if locked out, and check other accounts that reused the same password.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
