Someone Hacked Your Email? 10 Things to Check Immediately

If someone broke into your email, changing the password is essential—but it may not undo changes they already made. This friendly checklist helps you regain control of Gmail or Outlook and spot hidden settings that can keep causing trouble.

First: If this is a work or school account, notify your IT administrator immediately. If you suspect your computer is infected, use a different trusted device to secure the account.

10 things to check after your email is hacked

1. Change your password. Open the official Gmail, Microsoft, or company sign-in site yourself—not a link from a suspicious email. Choose a unique password and replace it anywhere else you reused it.
2. Sign out unfamiliar devices and sessions. In your account’s security settings, review recent activity and sign out devices you do not recognize. Your workplace IT team may need to revoke Microsoft 365 sessions centrally.
3. Turn on or reset two-factor authentication (2FA). Remove unknown verification methods, verify your own recovery phone and email, and register a passkey or authenticator when available. Never approve a sign-in request you did not start.
4. Check inbox rules and filters. Attackers sometimes make incoming messages skip the inbox, go to Trash/Deleted Items, get marked read, or forward elsewhere. Remove rules or filters you did not create. In Outlook on the web, open Settings → Mail → Rules (menu names vary). In Gmail on a computer, open Settings → See all settings → Filters and Blocked Addresses.
5. Check forwarding. Look for an unknown forwarding address. In Outlook on the web, check Settings → Mail → Forwarding. In Gmail on a computer, check Settings → See all settings → Forwarding and POP/IMAP. Business administrators should also check mailbox-level forwarding and mail flow rules, which may not appear in the user’s settings.
6. Review connected apps. An outside app may have permission to read mail even after you change your password. Review third-party connections or app permissions in your Google or Microsoft account, and revoke anything unfamiliar. Ask an administrator for help with workplace app permissions.
7. Check who can access your mailbox. Look for unfamiliar delegates, shared access, or Send As permissions. These can be managed in account settings or by your organization’s administrator; Gmail delegation is under Settings → Accounts and Import on supported accounts.
8. Check Sent, Deleted Items/Trash, and archive folders. See whether anyone sent fraudulent messages from your account or hid incoming mail. If an unexpected rule sent mail to Deleted Items or Trash, the messages may still be there. Check recovery options before emptying anything; retention periods and recovery availability vary.
9. Review account activity and security changes. Look for suspicious successful sign-ins, unfamiliar devices, new recovery methods, and account changes. A location by itself can be misleading, so look at device and time details too.
10. Warn affected contacts and watch for repeat activity. Tell people who may have received suspicious messages not to open links or enter passwords. Monitor the account for new rules, forwarding changes, unfamiliar sessions, and unexpected mail for the next several days.

Where to find the settings

Gmail / Google account

Go directly to Google Account Security to review devices, sign-ins, and two-step verification. In Gmail on a computer, open the gear icon → See all settings to inspect filters, forwarding, and account delegation (where supported). You can find Google’s instructions at Secure a hacked Google Account.

Outlook.com / Microsoft 365

Open your normal Outlook webmail directly. Use Settings to inspect Rules and Forwarding, and your Microsoft account’s security page to review authentication and recent activity. On a workplace Microsoft 365 account, some settings—including server-side forwarding, mailbox permissions, OAuth app grants and session revocation—require help from IT. Microsoft’s account recovery guidance is a useful starting point for personal Microsoft accounts.

Extra checks for Microsoft 365 administrators

If you’re the IT administrator responding to a compromised mailbox, preserve appropriate evidence and review: Entra sign-in and audit logs; active sessions and registered authentication methods; inbox rules (including hidden or suspicious rules); mailbox and transport-level forwarding; Full Access, Send As and Send on Behalf permissions; enterprise app consent and service principals; suspicious sent mail and message trace; and whether a phishing campaign affected other users. Revoke sessions and unauthorized grants and confirm remediation with fresh sign-in activity.

Important: An empty forwarding setting or delegate list does not prove the account is clean. Review other access paths too, and follow your organization’s incident-response process.

What if your missing email is in Deleted Items?

Do not empty that folder. Remove the unwanted rule or filter first, then move legitimate messages back to the Inbox. If messages are no longer there, check the provider’s recovery feature or ask IT about retention and restore options. Recovery is not always possible.

The bottom line

Secure the login, then check what the attacker changed. A malicious inbox rule can keep hiding email after the hacker is locked out. Checking rules, forwarding, app access, delegated access and deleted messages can reveal problems that a password reset alone will miss.

Related guides: Clicked a Scam Link? · Dangerous Email Attachments · How to Spot a Scam Email.