Email is the master key to most of your other accounts, so a compromised inbox is worth taking seriously and worth staying calm about. Here is how to tell whether yours has actually been broken into, and the order to do things in if it has.
The signs to look for
- Contacts mention odd emails from you that you did not send.
- Sent items or replies you do not recognise.
- Password reset emails you never asked for.
- New forwarding rules or filters you did not create.
- Being signed out unexpectedly, or sign-in alerts from places you have never been.
Any one of these is worth checking. Two or more together, and you should assume the account is compromised and act.
What to do, in order
Order matters here. Change the password from a device you trust, not the one you suspect. Then turn on two-factor authentication so a stolen password alone is no longer enough. Only then check the inbox for rules and filters the attacker may have left to keep a copy of your mail or hide their tracks.
Check your forwarding rules and filters specifically. A common trick is to quietly forward your mail elsewhere, so the attacker keeps reading even after you change the password.
You can check whether the password itself has turned up in a known data breach with our free password breach check, which never sees your actual password.
When to get help
If the inbox is tied to your business, your banking or anything sensitive, it is worth a second pair of eyes to make sure the account is genuinely clean and nothing has been left behind. Our calm first-response guide walks through the immediate steps, and cybersecurity support covers locking things down properly afterwards.