How do I know if my email was hacked?
Key takeaways
- A single inbox rule that silently forwards your mail is the most common way an attacker keeps access after the password is changed.
- Device-code phishing defeats most SMS or app-based two-factor authentication, which is why a login-activity review matters more than your 2FA strength.
- In 2026, phishing emails are frequently written by language models, so poor grammar and odd phrasing are no longer reliable warning signs.
- Always change your email password first, from a clean device, because email is the password-reset route into every other account you own.
- If a new recovery contact has been added, treat the takeover as incomplete until you remove it and rotate every downstream password.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What exactly should I look at in the five-minute check?
Five-minute check, five places. The sent folder, for anything you did not write, including replies to strangers and to addresses you do not recognise. The inbox rules, where a rule named 'notify', 'sync' or something similar forwards mail to an external address. The account login activity, for unfamiliar IPs, devices and locations, and for a password change you did not make. The recovery settings, for a new recovery phone number or a new recovery email. And the connected apps list, for an unfamiliar OAuth consent, because a third-party app granted mail access can read every message you receive even after you change your password.
Why does device-code phishing beat two-factor authentication?
Because it never needs your code. In a device-code phishing flow, the attacker starts a sign-in on their own browser and persuades you to enter a short code that appears on your own screen. The code authorises their session. Your phone shows a legitimate-looking approval, your one-time code arrives by SMS or app as usual, and your authenticator is never challenged. The defence is not a stronger 2FA method, it is knowing what an approval prompt looks like when you did not initiate the sign-in, and refusing codes you did not request. Passkeys and hardware security keys close this route properly, and for business mailboxes they are now the right default.
What should I change first, and in what order?
Order matters. First, change the email password from a device you trust, and turn off every sign-in you do not recognise. Second, remove unfamiliar inbox rules and unfamiliar recovery contacts and OAuth consents. Third, enable an authenticator app or passkey in place of SMS on the recovery path. Fourth, review forwarding rules on any other account that has a forwarding address set, because that is a standard persistence trick. Fifth, forward a copy of the suspicious email to your bank's official fraud address, if it concerned a payment instruction, because business email compromise in India is usually followed by a transfer request. Sixth, notify colleagues if the sent folder shows anything you did not write.
When does an email compromise need an incident report?
When personal data was involved or your organisation was breached, CERT-In's six-hour clock starts from the moment you noticed or were brought to notice of a listed incident, and you report to incident@cert-in.org.in or 1800-11-4949. For an individual account, the practical escalation is the National Cyber Crime Reporting Portal at cybercrime.gov.in and helpline 1930, and a bank if there was a financial instruction. If the mailbox was used to run a fraud against others, that is now a criminal matter and the bank should be told immediately, because a reversal request is far harder once funds have moved on to a third account.
| Where to look | What indicates compromise | Fix |
|---|---|---|
| Sent folder | Messages you did not write or send | Change password, report the messages |
| Inbox rules | Auto-forward or delete rules you did not create | Delete the rule, then re-check forwarding |
| Login activity | Unfamiliar IP, device, location or sign-in time | Sign out all other sessions |
| Recovery settings | New recovery phone number or email address | Remove it and rotate downstream passwords |
| Connected apps | Unfamiliar OAuth consent with mail access | Revoke access, then change password |
| Password change history | A change you did not make | Change password from a clean device immediately |
What are the frequently asked questions?
Get a straight answer on this
Send us the email provider and the symptoms you found, and we will return a fixed-price mailbox takeover review with a start time.
Send us the details See pricing