If something feels off, such as emails disappearing, messages you did not send, or unexpected password resets, take a few minutes to review your email account. Someone with access to your email may be able to read your messages, reset other passwords, or quietly forward emails without your knowledge.

Review recent sign-ins and devices

Check your account’s recent security activity and device list. Sign out of any device, browser, or location you do not recognize. Also look for password, recovery phone, or recovery email changes you did not make.

For Gmail:

1. Go directly to myaccount.google.com/security.
2. Select Your devices and then Manage all devices.
3. Sign out of anything you do not recognize.
4. Review Recent security activity for unfamiliar sign-ins or account changes.
5. Confirm that the recovery phone number and recovery email belong to you. 

Check for hidden forwarding and email rules

Attackers sometimes create forwarding rules or filters so they can receive copies of your messages or hide important alerts from you.

For Gmail:

1. Open Gmail on a computer.
2. Select the gear icon and then See all settings.
3. Open Forwarding and POP/IMAP. Forwarding should be turned off unless you intentionally set it up.
4. Open Filters and Blocked Addresses.
5. Delete any filter you did not create, especially one that forwards, deletes, skips the inbox, or archives messages. Pay close attention to rules involving terms such as payment, ACH, bank, password, or security. 

If you use Outlook, Yahoo, iCloud, or another provider, look in the account’s Mail Settings for sections labeled Rules, Filters, Forwarding, or Automatic Replies.

Review your mailbox folders

Look through your Sent, Trash or Deleted Items, Archive, and All Mail folders. Watch for:

• Messages you did not send
• Deleted bank, payment, password-reset, or security alerts
• Replies to conversations you never saw
• Messages that were unexpectedly archived or marked as read
• Password-reset emails you did not request 

Review connected apps

An unfamiliar application may continue accessing your email even after you change your password.

For Gmail, go to Google Account → Security → Your connections to third-party apps and services. Remove anything you do not recognize or no longer use. You can also run Google’s Security Checkup to identify settings that may need attention. 

If you find something suspicious

• Change your email password to a strong, unique password you have never used elsewhere.
• Turn on two-step verification, preferably with a passkey or authenticator app.
• Save your backup codes somewhere secure and offline.
• Change the password on any other account where you reused the same or a similar password.
• Continue checking your account activity regularly for the next few months. 

Important: Type the provider’s website into your browser. Avoid signing in through links in unexpected emails or text messages.