Symptoms
- Friends say they got a strange email or link from you
- Sent folder has messages you didn't write
- Unfamiliar forwarding rule set up in your email settings
- Login alerts from unfamiliar locations
Likely causes
- CommonPassword compromised through reuse or a data breachAttackers often test leaked passwords from other sites against email accounts.
- CommonPhishing gave away your login credentialsA fake login page may have captured your password recently.
- PossibleMalicious auto-forwarding rule set up by an attackerAttackers sometimes add hidden rules to forward or send mail without full account takeover awareness.
What to do
- Change your email password immediately to something strong and unique.
- Check your email settings for any forwarding rules or filters you didn't create and delete them.
- Review connected apps and devices with account access and remove anything unfamiliar.
- Turn on two-factor authentication if it isn't already active.
- Check your sent folder and drafts for evidence of what was sent and to whom.
- Notify contacts who received suspicious messages not to click any links in them.
- Check any other accounts using the same password and change those too.
When to call a pro
If the account recovery options were also changed by the attacker and you can't get back in, use the email provider's dedicated hacked-account recovery process.
Safety
Generally low risk
Generally low risk for a careful person. Stop if anything looks different from what this guide describes.