Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To check whether someone may have accessed your email, open your provider’s official app or website yourself and review recent sign-ins or security events, signed-in devices, recovery details, connected apps, and mailbox settings such as forwarding and rules. Then check Sent and Deleted for messages you did not write and look for missing mail. A suspicious event is a reason to investigate—not, by itself, proof of who accessed the account or how.
If you find changes you did not make, secure the account through the provider’s official recovery or security process. If you cannot sign in, start with account recovery; if you can, use a trusted device to change your password, remove unauthorized access, and protect other accounts that reused that password.
Start with the provider’s official account page
Do not open a sign-in link in an unexpected warning email or text. Instead, open the email provider’s known official app or type its familiar website address yourself, then navigate to the account’s security or recent-activity area. This makes it less likely that a convincing fake alert will send you to a page designed to steal your password. Microsoft specifically advises people who are unsure about an unusual-activity email to sign in to their Microsoft account without using links in that message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you use a work or school account, your organization may manage security settings and sign-in records. Follow its approved support process rather than assuming that the consumer-account screens described here will show everything.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Before making changes, note what you found if it is safe to do so: the event’s date and time, whether it succeeded or failed, any listed device or app, and changes to recovery or mail settings. These details can help you explain the issue to a provider or administrator. Do not delay securing the account if you believe someone still has access; the notes are useful context, not a reason to leave the account exposed.
Review sign-ins, security events, and devices
Look for activity you cannot explain: a successful sign-in you did not make, an unfamiliar device, or a security change you did not authorize. Record the date, time, device, and other details before taking action if you can do so safely. A familiar location or device is not conclusive proof that access was legitimate, and a strange location is not conclusive proof of an attacker.
Compare events rather than judging a single detail in isolation. For example, an unfamiliar location paired with a device you recognize may have a different explanation from an unexplained successful sign-in followed by a changed recovery phone or an added app permission. Check whether the time and device fit your own use, and whether other changes in the account support or contradict your first impression.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGoogle accounts
- Open your Google Account and go to Security.
- Review Recent security events for changes or activity you do not recognize.
- Under the device area, review Your devices. If a device is not yours, investigate it and remove it from the account if appropriate.
Google’s compromised-account guidance also directs users to review account settings and recovery details. Do not treat an empty or familiar-looking event list as a complete forensic record; combine it with the mailbox and access checks below.
When you find a device you do not recognize, consider whether it could be an older device, a device you share, or one that was previously used to sign in. If you cannot account for it, use the account’s controls to remove it and continue checking recovery information, apps, and mailbox settings. Removing a device is only one part of the review; it does not by itself establish what the device did or undo changes to the mailbox.
Microsoft personal accounts
Open the Microsoft account’s security area and review Recent activity. Microsoft says entries can include the date and time, location, IP address, device or operating system, and browser or app. The page displays significant events, not every account event, so an absence of an entry does not establish that nothing happened.
Interpret location carefully. Microsoft notes that mobile phone services can route activity through a different location, so a location mismatch alone may have an innocent explanation. Give closer attention to a successful sign-in, security-information change, or app permission that you cannot explain, especially when it coincides with other changes in the mailbox.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview the event details that are available instead of relying only on a broad location label. The date and time, IP address, device or operating system, and browser or app can help you compare the activity with your own sign-ins. A failed attempt is not the same as a successful sign-in, but repeated or unfamiliar events still merit attention if they appear alongside changes you did not make. Microsoft’s page is a view of significant activity, not a complete record of every action.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Work or school Microsoft 365 accounts
Users of managed Microsoft 365 accounts may need their administrator to inspect Microsoft Entra sign-in and audit logs. Microsoft’s administrator guidance identifies IP address, location, time, and whether an event succeeded or failed as useful details. This is an administrator investigation, not a routine consumer setting that every mailbox user can access.
If you report a concern, give your support team the time period, suspicious message or setting, and any sign-in details you can see. An administrator may be able to examine logs unavailable to an ordinary user and check mailbox forwarding or rules, including hidden rules. Do not try to treat administrator-only instructions as a consumer procedure; ask the organization to investigate through its approved tools.
Check who can recover or access the account
An intruder who changes recovery information may make it easier to retain access or harder for you to regain control. Review the recovery email address, phone number, alternate addresses, and other security information listed by your provider. Remove or correct anything unfamiliar, using the provider’s official security controls.
Check every listed method, not just the main recovery email. A phone number, alternate email address, or verification app that you do not control could affect account recovery or verification. Microsoft’s recent-activity descriptions include changes such as adding or deleting an alternate email, phone, or verification app; Google also identifies unfamiliar recovery or alternate-contact changes as suspicious. If you find a change you did not make, correct it and then continue to review the rest of the account.
Also review applications that have permission to access the email account. Revoke access for apps you do not recognize or no longer need. Google identifies unfamiliar apps with account access as something to review; Microsoft’s recent-activity descriptions include changes such as adding or deleting an alternate email address, phone number, or verification app.
Think about the scope of an app permission. A connected app may have access that outlasts a password change, depending on the provider’s controls, so review and revoke permissions you cannot explain rather than assuming a new password has removed them. Keep access for apps you recognize and still use; the goal is to remove unauthorized or unnecessary access, not to disable every connection indiscriminately.
Inspect the mailbox for signs of what happened
Someone who can read or send mail may leave clues even when a sign-in screen does not make the situation clear. Check Sent and Deleted for messages you did not write, and look for mail that has disappeared or been deleted unexpectedly. Ask whether any contact received an unusual message that appears to come from you. These are warning signs to investigate, not standalone proof of the cause.
Look for patterns and consequences. An unfamiliar message may have been sent to one contact or many; missing mail may have been moved or deleted; an unexpected reply or automatic response may be connected to a setting you did not create. Compare what you see with your own activity, and ask a recipient what arrived if you need to confirm whether a message came from your account. Do not assume that a message’s appearance alone identifies who sent it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Look for forwarding, filters, rules, and delegation
Review settings that can quietly copy, redirect, hide, or manage messages. In Gmail, Google’s guidance calls out forwarding, filters, labels, delegation, and other settings. Check for destinations, rules, delegates, or changes you did not configure. Microsoft’s consumer recovery instructions also call out connected accounts, forwarding, and automatic replies.
Check both what happens to incoming messages and who else can act on the mailbox. A rule or filter might route certain mail away from the inbox; forwarding may send copies to an address you do not control; delegation gives another account a role in handling mail. Review automatic replies and connected accounts too. If any entry is unfamiliar, remove or correct it through the provider’s settings and keep checking for other unauthorized changes.
Forwarding deserves particular attention because it can expose future password-reset messages. UK National Cyber Security Centre guidance explains that criminals may set forwarding rules to receive copies of email and use those messages to reset passwords for other accounts. An attacker may therefore leave a way to monitor incoming mail even if you no longer see an unfamiliar sign-in.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For Microsoft 365, administrators can investigate mailbox forwarding and inbox rules, including hidden rules, with administrative tools. Ordinary users should not assume they can see every such rule in their normal mailbox settings; ask the organization’s administrator to check if the account is managed or suspicious activity remains unexplained.
Understand what a breach notice can—and cannot—tell you
A notice that a password used on another service was exposed is a reason to change that reused password, but it does not establish that someone currently has access to your email. Conversely, a provider page without an unfamiliar sign-in does not rule out mailbox access, because event pages may show only selected activity and mailbox rules can continue to expose mail.
The official guidance cited here does not establish that a breach lookup can confirm current access to a mailbox. Treat any such notice as a prompt to investigate credentials and account settings, not as a definitive compromise test. If you reused the email password elsewhere, change it on those other accounts too.
Keep two questions separate: whether a password may have been exposed somewhere, and whether someone is currently able to use this email account. The first is a reason to stop reusing that password and change it anywhere it was used. To investigate current account access, review the provider’s activity, devices, recovery methods, app permissions, and mailbox behavior. Neither a breach notice nor a clean-looking activity page answers every part of that check.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What to do if you find something suspicious
If you are locked out
- Go to the provider’s official account-recovery flow using its known app or website. Do not use a recovery link from an unsolicited message.
- Follow the prompts to recover access. Google directs users to account recovery when a password or recovery phone has changed or access is lost; Microsoft provides a sign-in helper and password-reset path.
- If it is a work or school account, contact your organization’s administrator or support team. They may be able to review managed-account logs and help restore access.
Use the recovery route for the provider and account type you actually have. A consumer recovery page may not restore access to an organization-managed mailbox, and a workplace administrator may be responsible for its security information or logs. If the provider offers a sign-in helper or recovery process, follow its current prompts rather than relying on links in messages claiming to fix the problem.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you can still sign in
- Use a device you trust. If you suspect the computer or phone may be infected, use another trusted device to secure the account. Microsoft’s compromised-account instructions recommend a full malware scan before changing the password from the affected computer.
- Set a new, unique password. Do not reuse it on other services. If you reused the old password, change it on those accounts as well.
- End other sessions or remove unknown devices where your provider offers that option.
- Correct recovery information. Remove unfamiliar phone numbers, email addresses, verification methods, and other recovery details.
- Remove unauthorized access. Review and remove unfamiliar connected apps, forwarding destinations, filters, mailbox rules, delegates, or automatic replies that your account exposes.
- Turn on two-factor authentication. Enable the provider’s available 2-step verification option to add another check beyond the password.
The order matters: make sure you are using a device you trust, regain or retain control of the account, then close off access paths beyond the password. A password change does not replace checking recovery details, sessions, apps, and mail settings. Provider controls differ, so use the available sign-out, device-removal, or permission-revocation options rather than assuming every service offers the same buttons.
The FTC’s US consumer guidance recommends changing the password, signing out across devices, enabling two-factor authentication, and checking recovery details and forwarding. Which exact controls appear, and how to revoke access, depends on the provider and account type.
Protect other people and sensitive information
Warn contacts who may have received suspicious messages and ask them to treat those messages cautiously, especially if they contain links or requests. If financial or identity information may have been exposed, Google’s guidance advises contacting the bank or local authorities as appropriate. For suspected personal-information theft in the United States, the FTC points consumers to IdentityTheft.gov.
Also check accounts that use this email address for password resets, especially if you reused the email account’s password elsewhere. Change reused passwords to unique ones and review those accounts for changes you do not recognize. If a contact says they received an unexpected message, ask them not to click links or act on requests until you have verified the message through another channel.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge the evidence
No single symptom in the official guidance is presented as a universal test that proves an account was compromised. An unfamiliar device, changed recovery detail, unexpected message, or forwarding rule is meaningful evidence to investigate. Some activity can look unfamiliar because of travel, mobile-network routing, or authorized apps; at the same time, an activity page may not display every event.
Use the checks together: compare sign-in activity with devices, recovery information, app permissions, and mailbox behavior. If those checks do not explain what you see—or if the account is managed—contact the provider or your work-account administrator. The FTC guidance cited above is for US consumers; the National Cyber Security Centre’s guidance is UK guidance. Provider screens and procedures can change, so use the current official controls for your account.
Think of the review as a set of clues rather than a yes-or-no diagnostic. A strange location may be a routing issue, while a forwarding rule you never created can be significant even without a recent suspicious login on screen. A successful sign-in, an unrecognized security change, and unexpected sent mail together are more concerning than any one item alone. If you cannot explain a change, treat it seriously, secure the account, and ask the provider or administrator for help when the available user-level checks are not enough.
Recommended Free Tools
Reduce the chance of another takeover
- Keep a unique password for the email account and avoid reusing it elsewhere.
- Keep recovery email and phone details current and under your control.
- Enable two-factor authentication. Google lists a security key as one possible second factor; verify that the key works with your provider and devices before buying one.
- Periodically review devices, connected apps, forwarding, and rules—especially after an unexpected password reset or unusual message.
A security key can strengthen sign-in, but it does not detect an existing compromise or replace account recovery. First regain control, remove unauthorized access, and then choose an authentication method supported by your provider and devices. A FIDO2 hardware security key is one possible physical option where supported; compatibility varies by provider and device, so check before purchasing. It is an optional prevention measure, not a diagnostic tool.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
How can I tell if someone is using my email account?
Review your provider’s recent security events or sign-ins, signed-in devices, recovery information, connected apps, and mailbox settings. Check Sent and Deleted for messages you did not write and look for missing mail or unfamiliar forwarding and rules. No single clue proves who accessed the account, so compare the evidence across these areas.
Does an unfamiliar sign-in location mean my email was hacked?
Not necessarily. Microsoft notes that mobile phone services can route activity through a different location, and travel or authorized apps may also make activity appear unfamiliar. Check the event’s time, device, IP address or app when available, and whether other changes support your concern.
What should I do first if I see activity I do not recognize?
Go directly to the provider’s official app or website. If you can sign in, use a trusted device to set a unique password, end other sessions where available, verify recovery details, remove unauthorized apps or mail rules, and enable two-factor authentication. If you are locked out, use the provider’s official recovery process.
Can a breach notice prove someone has access to my email?
No. A notice about an exposed password used on another service is a reason to change that password anywhere it was reused, but it does not establish current access to your mailbox. Investigate account activity, devices, recovery methods, app access, and mail settings separately.
Why should I check forwarding and filters after changing my password?
Forwarding or rules can continue to copy, redirect, or hide incoming mail, including password-reset messages. A password change does not replace checking mailbox settings or removing unauthorized destinations, rules, delegates, and connected apps.
What if my email is a work or school account?
Contact your organization’s administrator or support team. Managed Microsoft 365 account users may not be able to see all relevant sign-in or audit records, and administrators can investigate details such as IP address, location, time, success or failure, forwarding, and inbox rules.
The Bottom Line
Check your email account from the provider’s official app or website, and review sign-ins, devices, recovery details, connected apps, Sent and Deleted, and forwarding or rules. Treat an unexplained change as a reason to act, not as proof on its own. If you find suspicious access, use a trusted device to secure the account, recover it through official channels if locked out, and change any reused passwords.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
