How to Check If Your Email Was Hacked in 2026

If an email thread looks completely normal, same names, same tone, same signature block that's exactly the setup attackers count on. One fabricated reply is all it takes to redirect a payment to the wrong account, and it often isn't caught until the money's already gone. This is invoice hijacking: an intruder sits quietly in a compromised inbox, watches a real conversation unfold, then slips in a fake invoice at the exact moment money is about to move.

This is the reality of compromised email accounts. It is not the inciting event of a lockout. A member of the accounting team is led to believe a compromised email account is being used in the business as usual.

If you think your email account is being hacked, you should not panic. Instead, you should control your email hack in the right sequence before the compromised account is used to make money or cause further damage.

The majority of email hacks are not overt, but done in silence. The first checks should be on: your login activity, any forwarding rules, and connected apps. Then check Have I Been Pwned. After investigating, if you see any signs of intrusion, make your password from a clean device and activate two-factor authentication.

  Image: AI-generated illustration

Why a Compromised Email Account is Most Dangerous

Your email is not just another login. It is the recovery point for almost every other account you own.

Getting a password for any of your other accounts, your bank, your cloud storage, or your tax software will not be as easy as getting the email. Once an attacker gets access to your email, they can get access to all of your other accounts. This is why a compromised email account is not the primary target of a malicious cyber operation. It is the first step in breaching a larger network.

The statistics support the assertion. The Verizon 2025 Data Breach Investigations Report states that in 88% of attacks on web applications, primitive and basic cyber methods were utilized, and compromised user accounts were used. Have I Been Pwned tracks over 1,000 breaches and 17.6 billion compromised user accounts. There is a high probability your user accounts are in there.

I saw this frequently in my consulting work. The financially significant breach never started with sophisticated cyber methods. The breach started with a password that was reused, which was leaked in some unrelated breach that occurred two years ago, that few people remembered.

The Real Signs Your Email Was Hacked

You can disregard the far-fetched scenarios seen in Hollywood. In most cases of unauthorized access to email accounts, the signs manifest in minor and often inconsequential ways. This is what concerns us.

The signs you can directly observe

• Friends or colleagues receive spam or messages that are out of the ordinary from you, and you did not send these messages.
• Your Sent Items contain messages that you did not compose.
• You no longer receive expected messages, statements, and receipts.
• Your account password no longer works, and you did not change it.

Signs seen by the majority of people but are often overlooked

• An email forwarding rule has been set to send copies of your email to an unknown email address.
• A filter that is set to delete or archive messages has been silenced, and the filter contains the words "invoice," "password," or "security."
• Your recovery phone number or backup email address has been altered, and this was done without your permission.
• A Login was attempted from an unknown device, and an unfamiliar location has been added to your login history.

That second list contains the most concerning items. An attacker wishing only to eavesdrop on your email does not need to kick you out of your email account. They can set an email forwarding rule and filter out security alerts.

I set up an auto-forward email rule in a sandbox email account and created a filter to remove security alerts. In my experiment, the account owner received no alerts. Everything in the account looked normal. In the days that followed, “the attacker” was able to access everything in that email account with no consequences.

How Email Accounts Actually Get Compromised

Before you fix anything, it helps to know how attackers most likely got in. The cause shapes the cleanup.

Two causes dominate, and they are connected.

• Phishing credential theft tricks you into typing your password into a fake login page. The page looks identical to the real one.
• Credential stuffing takes passwords leaked in other breaches and tries them against your email. This only works because people reuse passwords.

Malware-based theft is rising fast through infostealers that scrape saved browser passwords. But for most individuals, the entry point is still a reused password or a convincing fake login.
 

Step-by-step: Instructions to Identify if Your Email Account is Compromised

You need to answer the following steps in order. You will understand why in the mistakes section.

Step 1: Review Recent Account Activity

With Gmail and Outlook, you can review recent account access, sign-in locations, and the devices that accessed your account.

• In Gmail, go to Security and review security events and your devices.
• In Outlook, go to the account security page and review recent activity.

You need to identify if there are access attempts from unfamiliar locations, the access occurred from a device that is not yours, or accessed at times you were sleeping. You only need one instance of account access from a foreign location to a device you were not sleeping.

Step 2: Review Forwarding Rules and Filters

You will not find this step in the generic guides.

• In Gmail, Forwarding and POP/IMAP, Filters and Blocked Addresses 
• In Outlook, your Inbox Rules, and Forwarding, will all help you. Delete any that you did not create.

You should be worried about any rules that forward or remove or mark messages with sensitive words as read.

Step 3: Review connected apps and account access

Apps that access a mailbox are a common means for third parties to breach account security. Remove access for any app that you do not recognize or no longer use. Also check mail delegation settings that allow other users direct access to your mailbox.

Step 4: Search your account on Have I Been Pwned

Go to haveibeenpwned.com and enter your email. This site shows you the most recent data breaches that your email is associated with. This does not mean that your email has been hacked. It shows you if credentials linked to your email have been compromised, and that is most certainly what credential stuffing exploits.

Step 5: Review your account recovery settings

Check that your recovery phone number and backup email still belong to you. Cyber criminals will first alter these to lock you out of your account, even if you reset your password in the future.

The Mistake Most People Make

Most people’s first and only line of defense is changing their password. This is both the most common and most costly order of operations. If you switch the operations, the following occurs.

1. The password gets changed, but the cybercriminals permanently set a hidden rule to forward your emails to them.
2. Malware on your system may also be stealing information. The moment you type your brand new password, it will be sent directly to cybercriminals.

The correct order is: 
Clean the rules and connected access, ensure the system you are using is clean, then change the password, and finally, activate two-factor authentication.

One firm reset all their passwords and thought that they were safe.Meanwhile, an attacker had an app token and a forwarding rule. By Monday, they were reading emails that had been newly reset. The operation to reset the passwords failed because the access paths were never removed. 

The Counterintuitive Part: Stop Changing Passwords on a Schedule 

People are advised to change their passwords every 30 or 90 days. I advise my clients to not do this.

Resetting passwords frequently leads to people creating worse passwords. For example, a clear an easily guessable pattern like Summer2025! becomes Summer2026! after each reset. For this reason, NIST recommends against the practice of reset intervals.

A password can and should be reset when there is a reason for it: a user is notified, a login is suspected to be out of the ordinary, or the account is found on a password leak service. Otherwise, a password once and a long and unique password for every account combined with an authentication method that is a step beyond a password is superior to a method that rotates passwords.

Not rotation. Uniqueness and a second factor.

What I Would Actually Do

If I suspected that one of my accounts was compromised, this is exactly what I would be doing.

1. First, I would be checking the login activity. Then, and only then, would I be resetting the password. My intention is to know if someone is currently logged in. I do not want to be giving them any hints that I know they have logged in.
2. Next, I would be removing forwarding rules and app filters. This closes the silent access paths that changing the password does not affect.
3. Before entering any new credentials, I check to make sure the device I’m using is clean. If I think the device has an infostealer, I move to a different device I trust.
4. I set one long, unique passphrase generated by a password manager. I’ve found only using a password manager to make my passwords unique stops the sweeping passphrase attacks.
5. I enable two-factor authentication using a hardware key or an authenticator app, but not SMS. I’ve seen SMS codes get intercepted by a SIM swap, which I’ve seen used in targeted attacks.
6. I reset every account that used that passphrase or used this email for recovery. This is the step that has the most immediate impact.

I focus first on the login activity, then the forwarding rules, and finally the passphrase. The main reason is that resetting the passphrase gives the illusion that something has been done. The real access path is still there. Closing the access path is the real thing that has to be done.

Frequently Asked Questions

Can someone hack my email without knowing my password?

Yes, they can access your email in several ways without knowing your password. Mail delegation, connected apps, and recovery settings are all ways to access email while keeping your email password secure. Malware can capture your session cookies, allowing the hacker to directly access your email. This is why checking your connected apps and email forwarding rules is as important as checking your passwords.

How do I know if someone hacked into my email?

First check your recent login activity, forwarding rules, and finally checking the site Have I Been Pwned. Reports of spam that originates from your account and missing emails are strong indicators.

If your email account has been compromised, what's the first thing you do?

You should first check your account activity and remove any unrecognizable forwarding settings, filters, or authorized apps. After doing that, change your password from a device you trust. Finally, enable 2FA. This method protects your account from any unauthorized access that the attacker may have.

Conclusion

Your email is the master key to your digital life. When you suspect your email has been hacked, treat it like a locksmith would for a break in. First find every way to get in, and then change the locks.

You cannot shortcut checking if your email was hacked with a simple one-step process like changing your password. Signs of hacking are faint. The hacks are often already occurring. You need to check your login activity, your email forwarding rules, your connected apps, and your recovery settings in that specific order before you change your password.

This order prevents the access you have, as changing a password is like locking a door while leaving a window open. If you find something, contain it. Assume every account that shares a password or a recovery email is also hacked.

James Mitchell

He is the Founder and Editor-in-Chief of Techisane. He holds a Master of Science (MS) in Computer Science and a CISSP certification, with eight years of experience in enterprise technology. He began his career working with IT infrastructure before advancing into IT security and consulting. Mitchell brings firsthand experience to his writing, drawing on technologies he has implemented, tested, and worked with in real-world environments.