Could someone be using your email without your knowledge?

A friend says you sent a strange link, but you cannot remember sending it. Before you panic, check your account directly. The message might be a fake sent using your address, or someone might actually have access to your email.

Either way, do not click links in a suspicious security alert. Open your email provider’s app or type its official address yourself. If you find unfamiliar activity, change your password and review the account’s security settings immediately.

Signs that someone may be using your email

One clue is a message in your Sent folder that you did not write. Other signs include password-reset emails you did not request, a security alert about an unfamiliar sign-in, or changes to your recovery phone and email address.

You might also notice that emails are disappearing, messages are marked as read before you open them, or contacts are receiving requests for money in your name. These are reasons to investigate, not proof by themselves. A family member using a shared device, a connected app or an email rule you forgot about could explain some activity.

Likewise, a message that appears to come from your address is not proof that someone signed in. Senders can sometimes forge the displayed address. Check your Sent folder and account activity before drawing a conclusion, and warn contacts not to open suspicious links.

Check recent security activity in Google

If you use Gmail, start with your Google Account. The labels may look slightly different depending on your phone or account.

1. Open Gmail and tap your profile picture.
2. Select Manage your Google Account and choose the account you want to check.
3. Open Security & sign-in.
4. Under Recent security events, select the option to review activity.
5. Look for a sign-in, password change or recovery change that you do not recognise. Follow Google’s prompts if it asks whether an event was yours.

A location shown on an alert is not always exact. Mobile networks, VPNs and travel can make a familiar device appear in an unexpected place. Look at the device, time and activity together. If you are unsure, secure the account instead of assuming the alert is harmless.

Next, find Your devices in the same security area and review the devices with access. Sign out of any you do not recognise. Google may list several sessions for one device, so read the details before removing one. Its hacked account guide covers these checks.

For Outlook, Yahoo or another provider, open the official account security page and look for recent activity and signed-in devices. Do not use a link from a message you suspect is fake.

Change your password and secure reused accounts

If you suspect unauthorised access, change your email password from a device you trust. Pick a unique password that you do not use anywhere else. Our guide to creating a strong password you can remember explains how to make one without relying on a short predictable word.

Change the same password on any other service where you reused it. Give priority to banking, shopping and social accounts, especially if password-reset messages for those services go to the affected inbox. A password manager can help you keep different passwords without writing them in an exposed note.

If you cannot sign in to Gmail, go to Google Account recovery and answer the questions as accurately as you can. Use a familiar device and location if possible. Do not pay a stranger who promises instant recovery or give anyone a verification code.

Check recovery details and app access

Inside your account security settings, check the recovery email and phone number. Remove unfamiliar details and replace outdated information with contact methods you control. Also review third-party apps or services connected to the account and remove access for anything you do not recognise or no longer trust.

Be careful before removing a work or school application you depend on. If you are unsure whether it is legitimate, ask your organisation’s IT administrator through a known channel.

Turn on two-factor authentication after you have secured the account. Keep backup codes or another recovery method somewhere private, so losing your phone does not leave you locked out. The extra step helps, but it will not protect you if you hand a sign-in code to an attacker.

Look for forwarding addresses and filters in Gmail

Someone with access may create a rule that forwards or hides future messages. Gmail’s full settings are easier to inspect in a desktop browser. If you are on a phone, you may need a computer or the browser’s desktop-site option.

1. Open Gmail at its official website and sign in.
2. Select the settings gear, then See all settings.
3. Open Forwarding and POP/IMAP and check whether forwarding is enabled to an address you do not recognise.
4. Open Filters and Blocked Addresses. Review filters that forward, delete, archive or mark messages as read.
5. Remove settings you did not create or no longer want, then save any changes requested on the page.

Some forwarding or filters may be legitimate. Read each one before deleting it. Other providers use different menu names, so search their official help for forwarding and inbox rules.

Check what else could have been affected

Email often contains receipts, identity information and password-reset links. Review recent messages for unfamiliar purchases, changes to other accounts or requests that appear to come from you. If bank details or financial activity may be affected, contact your bank using its official number and explain what you found.

Tell affected contacts through another channel that suspicious messages from your address should be ignored. You do not need to share private account details with them. If a work account is involved, notify your IT team promptly and follow its incident procedure.

Review your devices too. Remove apps or browser extensions you do not recognise, install available security updates and run a reputable security scan where appropriate. If you suspect a device is compromised, use a different trusted device to change passwords. Avoid downloading a random cleaner advertised in a pop-up.

What if the alert itself is a scam?

A fake alert may urge you to click immediately, ask for your password or direct you to a website with a slightly altered address. Instead, open the account’s official app or enter its website address yourself. Genuine account security events should also be visible through your account settings.

Do not approve a sign-in prompt you did not start, even if it keeps appearing. Reject it, review recent activity and change your password if necessary. Never read out a one-time code to someone who contacts you, regardless of the name they claim to represent.

The important thing is to act on evidence without waiting for every sign to appear. A password change, device review and check of recovery and forwarding settings can help you regain control and spot changes an intruder may have left behind.