A hacked inbox announces itself. The proof sits in your own settings and activity log, not in breach news, and almost nobody checks there. I run AliasFleet, an email-alias service, and this guide is the detection half of the job: how to know someone is inside your inbox, before you do anything about it.
Most people check backwards. A breach hits the news, they run their address through Have I Been Pwned, and stop there. That database tells you which stolen files contain your address. It says nothing about who is reading your mail right now. Google's own hacked-account checklist starts somewhere else entirely: changes you did not make, inside your own account.
The signs arrive in your own inbox first
Start with the mail itself. Two minutes of looking beats an hour of worrying.
Sent mail you did not write. Open the Sent folder and scan for anything you do not recognise. Attackers use a hijacked inbox to phish the contact list, then delete the evidence, so Sent is the first witness. Ask a contact as well. Google's checklist names "your friends say they got spam or unusual emails from you" as one of the core signs.
Mail that never arrived. Google lists "you no longer receive emails" and "your emails were deleted from your inbox and are not found in Trash" as signs of compromise. If expected mail stops landing, do not assume the sender forgot. Check Trash and Spam, then check the settings panels in the next section. Missing mail is usually a filter doing its work, not a delivery failure.
The password-reset flood. A wave of reset emails you never requested proves someone is trying. It does not prove they got in. Which? reports three causes: deliberate targeting, an automated attack working through a leaked credential list from an older breach, or a stranger who mistyped their own address. Their key line: one request does not mean the attempt succeeded. With a strong unique password and two-factor switched on, a one-off is usually safe to ignore. A pattern of them is not.
Security alerts that ride on real fear. Expect one more shape: the alert that looks like Google or Microsoft and urges you to click. Some are genuine. Some are the attack itself. The rule survives both cases. Never click the link. Open a new tab, type the provider's address yourself, and check the security panel directly.
The forwarding rule you never set
This is the quietest sign, and the one most guides skip. An attacker inside your inbox sets up automatic forwarding to their own address. After that they never need to log in again. They just read.
Gmail warns you, but only briefly. For the first week after forwarding is turned on, a banner reads: "You are forwarding your email to [email address]." Gmail's own forwarding help says that if you see that notice and never set it up, someone else might have access, and you should change your password immediately, then turn forwarding off in Settings. The banner expires after a week. The rule does not.
The check is manual and takes thirty seconds. In Gmail on a computer: Settings, then See all settings, then the Forwarding and POP/IMAP tab. A forwarding address you did not add is your answer. Then check the second hiding place, Filters and Blocked Addresses, where a filter can forward, archive, or delete mail without ever showing a banner. Google's hacked-account checklist tells you outright to remove any labels, filters, or forwarding rules you did not set up.
This audit has to be separate from the password step. A new password closes the password route. It does not remove a forwarding rule or a filter. Those settings survive a password change, which is exactly why Google lists them as a separate action.
A hacked inbox does not have to mean a hacked life
Stated plainly: aliases do not stop an inbox from being hacked. Nothing about a forwarding address hardens the mailbox itself. The fit is containment, and it works after the lockdown, not instead of it.
When every site holds a different alias, a compromised inbox stops being a master key. Kill the one alias the attacker harvested and the leak stops spreading: their mail bounces, the address is worthless, and your real inbox and every other alias keep working. Spam landing on one alias also names the site that leaked the address, which is the mechanism our leak-tracing guide walks through. For the mechanics, what an email alias actually is and the two-minute setup are the starting points, and the one-alias-per-site habit is the full argument.
With one alias per site, a "security alert" from your bank arriving on any address other than your bank alias is fake by definition. You do not need to inspect headers or hover over links. The wrong address is the whole tell.
Sessions and devices you do not recognise
An attacker cannot use your inbox without appearing on the device and activity lists. Every major provider keeps one.
Gmail first, since that is where most readers live. Scroll to the very bottom of the inbox on a computer and click Details next to "Last account activity". The popup lists every recent access: IP address, rough location, browser or device type, time. A country you have not visited is a flag. From there, TechCrunch's detection guide walks through Security Checkup, which puts your signed-in devices and Recent security activity on one screen.
Outlook hides its evidence one level deeper. Open your Microsoft account, go to Security, and find the sign-in activity view. Microsoft's Recent activity page covers the last 30 days; each entry expands to location, IP address, device type, and browser or app. Unusual activity gets its own section with "This was me" and "This wasn't me" buttons. Scan the event types even when nothing looks wrong: Password changed, Alias added or deleted, App password created, Permission given to an application, Sign-in blocked (Account compromised). Microsoft adds two caveats of its own: the page shows significant events only, not everything, and mobile networks route through odd locations, so one strange location on a phone network is not proof of anything.
Yahoo gets a shorter treatment, for a sourcing reason. Its My Account Overview has a "Review recent activity" view showing password changes, added phone numbers, connected devices, and IP addresses. Yahoo's own help pages were unreachable while I researched this, so the click path comes from TechCrunch's guide rather than Yahoo's docs. If the menu names have shifted, take the closest match in the account settings.
Apple is the simplest check of the four. On an iPhone, open Settings, tap your name, scroll to the device list. Apple's device-list guide spells out what a signed-in device can do: change your password, receive two-factor verification codes, edit your personal information, sync with iCloud. A device you do not recognise is not a curiosity. Remove from Account.
"these methods don't guarantee that you haven't been compromised."
TechCrunch's caveat, and it applies to every panel above. They catch the common cases. A careful attacker leaves little trace, so clean panels are good news, not a verdict.
| Provider | Where the evidence lives |
|---|---|
| Gmail / Google | Inbox bottom: "Last account activity" > Details; Security Checkup: devices and Recent security activity |
| Outlook / Microsoft | Microsoft account > Security > sign-in activity; Recent activity page covers the last 30 days |
| Yahoo | My Account Overview > Review recent activity: password changes, devices, IPs |
| Apple Account | Settings > your name > device list; Remove from Account for anything unknown |
What a breach check cannot tell you
Run the breach check anyway. Our walkthrough of reading a Have I Been Pwned result shows how to do it properly, breach by breach. Then keep the two questions apart:
- Breach news answers: has my address appeared in a stolen file?
- Your account activity answers: is someone inside my inbox right now?
A breach does not mean your inbox is hacked. A hacked inbox does not require a breach. Most takeovers start with phishing, password reuse, or malware on your own machine, and none of those appear in a breach database. Run the breach check, then answer the harder question in your own settings.
If you find something, recovery is the next job
Detection and recovery are two different jobs. If the checks above turned up anything, a forwarding rule you never set, unknown sessions, mail you did not send, do not stop at changing the password. Our recovery guide walks the full eviction: sessions, recovery methods, planted mail rules, connected apps, and the alias rotation that finishes the job. If the trail leads back to a breach rather than a takeover, the breach-response order of operations picks up from there.
The audit itself is cheap. Twenty minutes, the four panels above, once in a while. Your inbox will tell you it is hacked long before the news does. Just be the one who looks.
