Check if someone has access to your email account

Something feels slightly off — a “new sign-in” notification you don’t recognize, an email marked read that you never opened, a contact mentioning a message you never sent. Before assuming the worst, there’s a direct way to check rather than guess.

Check the account’s own activity log

Every major email provider keeps a record of recent sign-in activity, including the approximate location and device. This is the single most useful check:

• Gmail: scroll to the bottom of your inbox and click “Details” next to “Last account activity.”
• Outlook/Microsoft: account.microsoft.com → Security → Sign-in activity.
• iCloud: appleid.apple.com → sign in → Devices, to see everything currently signed in.

Look for a location or device you don’t recognize. One unfamiliar entry from years ago is less concerning than recent, repeated access from an unfamiliar place.

Check for forwarding rules you didn’t create

This is the check people miss most often, and it’s how a compromise can go unnoticed for months: an attacker sets up a rule that silently forwards a copy of your incoming email to themselves, then leaves your account alone otherwise so nothing looks wrong. Check your mail settings for any forwarding address or filter rule you don’t remember creating — in Gmail this is under Settings → Forwarding and POP/IMAP; in Outlook, Settings → Mail → Rules.

Check connected apps and devices

Both Google and Microsoft show a list of third-party apps and devices with access to your account. Anything unfamiliar, especially something you don’t recall authorizing, is worth revoking.

If you find something

1. Change the password immediately, from a device you trust.
2. Remove any forwarding rule or connected app you didn’t set up.
3. Turn on two-factor authentication if it isn’t already on — this is what prevents it from happening again even if the password leaks a second time.
4. Sign out of all other sessions — most providers offer a “sign out everywhere” option in security settings, which forces anyone else with access to be logged out.

When it’s worth calling someone

If you find signs of access and aren’t sure how far it goes — especially for a business email account with sensitive client information — that’s worth a proper review rather than a quick fix and hoping. Part of the security support we provide across Manhattan.