Most email takeovers don't announce themselves with a locked door. They look like a Tuesday. A message you don't remember sending sits in your Sent folder, a login alert arrives from a city you've never visited, or a friend replies to something you never wrote. The sooner you spot those small wrongnesses, the less damage there is to undo.
Below are ten warning signs worth recognising, followed by the steps that actually matter once you see one.
The ten warning signs, at a glance
- Messages in your Sent folder that you didn't write.
- Replies from contacts asking why you sent them a link, invoice, or attachment.
- Sign-in or security alerts for sessions, devices, or locations you don't recognise.
- Password reset emails you never requested.
- Two-factor prompts or verification codes arriving while you're doing nothing.
- A forwarding address or auto-forward rule you didn't create.
- Filters or rules that quietly move, archive, or delete certain mail.
- A changed recovery address, phone number, display name, or signature.
- Mail that stops arriving, or old messages suddenly marked unread or gone.
- Contacts receiving spam from your address, or bounce and "mailbox full" notices you didn't cause.
Any single item on that list can have an innocent explanation. Two or three together rarely do.
Sent mail you don't remember writing
The Sent folder is where most people first notice. Look for short messages with a link, a PDF, or an invoice attached, sent to people you haven't emailed in years, often at an hour when you were asleep. Attackers keep the wording vague on purpose so it reads plausibly to whoever opens it.
Check Trash and Archive too. Skilled intruders delete their sent messages, but rules and threads leave traces: a reply that arrives minutes after a message you never sent, a colleague forwarding something back to you with "is this yours?" Those replies are one of the most reliable signs there is.
Login alerts, resets, and codes you didn't ask for
A "new sign-in" notification from an unfamiliar device or city is worth taking seriously, but read it carefully — VPNs and travel can make a legitimate login look strange. What matters is whether you recognise the session at all. If you don't, treat it as real.
Password reset emails you didn't request are a grey area. Someone may simply be trying their luck with your address. Or the resets are flooding your inbox to bury a genuine security alert underneath. Either way, don't click the reset links inside those messages; go to the provider's site directly if you want to change anything.
The most urgent version is this: two-factor prompts or codes arriving when you're not signing in. That means someone already has your password and is trying to get past the second step. Decline the request, then change your password immediately.
Changes you didn't make in your account settings
This is the part people skip, and it's where intruders do the most lasting damage. Open your mail settings and check for:
- Forwarding. A rule that copies incoming mail to an unknown address lets someone read your correspondence long after you change your password.
- Filters and rules. Look for rules that send anything containing words like "security", "alert", "bank", or "invoice" straight to Trash or a hidden folder.
- Recovery details. If the recovery email or phone number isn't yours, a password reset will go to the attacker instead of you.
- App passwords and connected apps. Older mail apps and third-party services can keep access even after a password change. Remove anything you don't recognise.
- Signature, auto-reply, display name, and delegated access. Small cosmetic changes are often a test run before bigger ones.
Your mailbox is rarely just a mailbox. It's the address that can reset almost everything else you signed up for, which is why a compromise here spreads.
Mail that goes missing, and contacts who hear from you
Sudden silence is a sign in itself. Messages you're expecting never land, read items go back to unread, or an entire folder empties. Combined with filters, this usually means someone is hiding evidence of what they're doing with your account.
Then there's the outside view: friends, family, or clients receiving spam or odd requests from your address, and delivery failure notices piling up for messages you never sent. If your address is used to sign into other services through "sign in with" options, check the connected apps list there too. And if you're locked out completely, that isn't a technical hiccup — it's the loudest sign on this list.
What to do in the first hour
- Change the password from a different, trusted device. Use a long, unique one you've never used anywhere else.
- Sign out of all sessions using your provider's "log out everywhere" option, so anyone already inside is pushed out.
- Turn on two-factor authentication — an authenticator app or a hardware key is stronger than SMS codes.
- Remove forwarding, unknown filters, app passwords, and connected apps. Re-check this a day later; attackers sometimes return.
- Fix your recovery email and phone number so only you can receive reset links.
- Save evidence. Screenshot suspicious sent mail, login history, and settings before you delete anything.
- Warn your contacts in plain words: messages from your address in the last day or two were not from you, and nobody should click links or send money.
- Check the accounts that use this address — bank, work, cloud storage, social media — and change those passwords too, starting with anything financial.
- Scan your own device if the compromise may have started there, and if money moved, contact your bank straight away.
If a financial or legal problem is already in motion, speak to your bank and a qualified professional rather than handling it alone. There are limits to what a password change can fix after the fact.
Turning this into a habit
You don't need to audit your inbox weekly. Once a quarter, skim your Sent folder, your security settings, and your recent sign-in activity. Keep two-factor authentication on, use a password manager so this address isn't reused anywhere, and make sure your recovery details are current.
If you spot one of these signs later, don't wait to see how it plays out. Act first, investigate after — a quiet account is much easier to recover than a busy one.
Photo: stevedimatteo / Pixabay
