How do I know if my email has been hacked? Your email is the master key to your digital life — password resets for your bank, shopping, social media and everything else flow through it. A compromised email account is therefore much worse than a compromised anything-else. The frightening part: many people don’t realise for weeks or months, because skilled attackers quietly monitor rather than obviously rampage. Here’s how to check right now, the warning signs to watch for, and exactly what to do if the worst is confirmed.

Check first: the 2-minute breach test

Before anything else, go to Have I Been Pwned and enter your email address. This free, reputable service checks your address against hundreds of known data breaches. If it appears — and for most long-used addresses, it will — it tells you which breaches exposed it and what data was taken (passwords, phone numbers, etc.). This doesn’t mean your email account itself is hacked; it means your credentials are circulating, which is how email hacking usually starts. If your password from a breached site matches your email password, assume the worst and act.

How do I know if my email has been hacked? The warning signs

• Password stopped working unexpectedly — the classic sign someone changed it.
• Friends report strange emails from you — spam or phishing sent from your account.
• Login alerts from unfamiliar locations — check your account’s recent activity/security page for logins you don’t recognise.
• Missing emails or mysterious sent items — attackers delete password-reset emails to hide their tracks. Check trash and sent folders.
• New forwarding rules you didn’t create — a favourite attacker trick: silently forward your incoming mail to themselves, so they see password resets without you noticing. Check Settings > Forwarding in Gmail/Outlook now.
• Changed recovery options — a new recovery email or phone number you don’t recognise means someone is cementing control.
• Unexpected 2FA prompts — someone has your password and is trying to get past the second factor.
• Contacts receiving “I’m stranded, send money” emails — the oldest email scam, still running on hijacked accounts.

Immediate action: the recovery checklist

If you suspect compromise, move fast and in this order:

• 1. Try to sign in. If you can, change the password immediately to something strong and unique — ideally generated by a password manager.
• 2. Check and remove forwarding rules, filters and delegates — attackers’ persistence mechanisms. In Gmail: Settings > Forwarding and POP/IMAP, and Settings > Filters. In Outlook: Settings > Mail > Forwarding and Rules.
• 3. Review recovery options — remove any recovery email or phone number you don’t recognise, and confirm yours are correct.
• 4. Sign out all other sessions — Gmail: account security > Your devices > sign out unfamiliar ones. This kicks the attacker out.
• 5. Enable two-factor authentication if it wasn’t on — our guide on setting up 2FA walks through it. This is what prevents recurrence.
• 6. Check connected apps — revoke access for any third-party apps you don’t recognise.
• 7. If you’re locked out, use the provider’s account recovery flow immediately (Google and Microsoft both have one). Act quickly — attackers work fast to lock you out permanently.
• 8. Warn your contacts — a quick message that your account was compromised and to ignore suspicious emails from you.
• 9. Check your other accounts — if you reused the email password anywhere (be honest), change those passwords now, starting with banking.

How email hacking usually happens (so you can prevent it)

• Credential stuffing from breaches — the number one cause. Your password leaked from some forum in 2019; attackers try it on your email in 2026. Unique passwords per site (via a password manager) kill this completely.
• Phishing — fake “your account will be suspended” emails harvesting your login. Learn the signs in our guide on phishing links.
• No 2FA — without a second factor, a stolen password is game over. With 2FA, it’s a blocked attempt.
• Malware — keyloggers and info-stealers harvest credentials directly. Keep antivirus current (see best free antivirus).
• Old, weak or reused passwords — “Password123” with your birth year isn’t a password, it’s a welcome mat.

Securing email for the long term

Once recovered (or, better, before anything happens): unique 20+ character password from a manager, 2FA via authenticator app (not SMS), recovery options verified, forwarding rules checked quarterly, and login alerts enabled. Consider a separate email address for critical accounts (banking, government) versus general sign-ups — compartmentalisation limits blast radius. And back up important emails — providers can and do lock accounts, sometimes mistakenly.

Setting up a security contact and legacy plan

While you’re in security mode, handle two things most people never think about. First, add a recovery email and phone number you actually control and keep current — an old recovery address you can’t access is worse than none, because it gives false confidence. Second, consider the legacy question: if something happened to you, could your family access your accounts? Google’s Inactive Account Manager and Apple’s Legacy Contact let you designate someone to access your data after a period of inactivity — set it up in five minutes and spare your family a bureaucratic nightmare. Store your master password (for your password manager) somewhere your next of kin can find it — a sealed envelope with a solicitor, or with your will. It’s morbid, it’s responsible, and it takes less time than reading this paragraph.

Finally, make email security a habit, not an event: review connected apps and forwarding rules twice a year, keep 2FA on everything important, and treat unexpected login alerts as guilty until proven innocent. The attackers are patient — your defences should be permanent.

The bottom line

How do I know if my email has been hacked? Check Have I Been Pwned, review recent login activity and forwarding rules, and watch for the warning signs above — especially password changes you didn’t make and rules you didn’t create. If compromised: change password, kill forwarding rules, boot unknown sessions, enable 2FA, warn contacts. And going forward, a unique password plus 2FA makes your email practically unhackable by the methods that work today.

Have I Been Pwned for breach checks, Google’s hacked-account recovery, and the NCSC’s guidance for UK-specific advice.