Your email password is fixed. Is your inbox?

Start from a device you trust

Open the provider's official account page from a device you trust. If you suspect malware on the device normally used for email, use another trusted device where possible and arrange appropriate device support as well. Avoid account-recovery links sent by an unfamiliar person. If you cannot sign in, use the provider's official recovery process; do not pay an unsolicited contact for a supposed shortcut.

Google's compromised-account guidance calls for reviewing security activity, devices and important settings, including recovery contacts and authentication methods. Follow the protective actions it presents and change a compromised password promptly. If the same password was used elsewhere, those accounts also need attention. Do not assume a password change ends every kind of access: review unfamiliar devices and connected applications as the provider directs.

1. Access your mail provider through a bookmarked or manually typed official URL.
2. Confirm that your browser is up to date and not saving credentials to an insecure or shared profile.
3. Initiate official account recovery steps if sign-in is blocked, avoiding third-party recovery services.

Sender spoofing versus mailbox compromise

A friend receiving a strange message does not by itself establish how it was sent. Someone might have used your mailbox, forged an address, or simply copied your display name into another account. I would compare that report with your account’s security events, sent mail and settings. Technical headers can help a provider investigate, but ordinary readers should not have to interpret them before taking sensible protective steps.

Look for evidence in account activity, sent mail and settings, but interpret those clues together. Missing suspicious mail in the Sent folder does not prove that nobody used the account; messages could have been removed or a different route used. An unfamiliar device label or approximate location also needs context. If activity was not yours, follow the provider's secure-account instructions rather than waiting for absolute certainty about how the incident happened.

Preserve a small private record without delaying containment

Remove unauthorized access and correct unfamiliar security settings promptly. If a brief note can be made without delaying that work, record the setting involved, the unfamiliar destination or device, and when you noticed it. A private paper note or protected file is enough; creating a perfect evidence package is not a prerequisite for securing the account.

The note can help during a later support conversation. It may show that a forwarding address and a changed recovery contact were noticed together, for example. Keep observation separate from interpretation: forwarding was enabled is something you saw, while the person wanted my bank statements is a conclusion that may be unproven. Avoid copying passwords or usable recovery codes into the incident record.

If a payment, identity document or other sensitive account may be involved, contact the relevant provider through its official route. Do not postpone that contact while investigating every filter. Redact sensitive details before sharing any evidence with a helper, and avoid putting screenshots of private account settings into public forums.

1. Secure unfamiliar access and settings promptly.
2. Keep a brief private record when it does not delay protective action.
3. Separate observed changes from guesses about the person or motive.

Trace a message through its delivery rules

Let us work through a hypothetical case to see how an attacker manipulates an inbox invisibly. Imagine a hidden bill notification arrives from your electric utility provider. An unauthorized filter has been established in your Gmail account. This filter is configured to intercept any incoming email containing the word 'bill' or 'statement', instantly apply a 'skip the inbox (archive it)' action, and forward a copy to an external address while marking the original as read. To you, the inbox looks pristine; you see no unread notices, and no bills seem missing.

Gmail describes automatic forwarding and filters that forward selected messages after the forwarding destination is verified. Inspect the enabled destination and relevant filter actions, and remove changes you did not authorize. Review account delegation and connected-app access where applicable too. A password change is a security step, not a report confirming that all those settings are correct.

1. Navigate to your email provider's filter and rule management settings.
2. Inspect each rule for hidden actions such as auto-archiving, trashing, or forwarding.
3. Verify the forwarding tab and remove any destination addresses you did not personally set up.

Rank downstream accounts by exposure

Consider which other services rely on this mailbox for password resets or important notices. Start with accounts showing suspicious activity or carrying immediate risk, rather than waiting to finish a perfect inventory. Banking, payment and identity-related accounts may need prompt provider contact. A warning on one of those accounts should not be put aside until every email setting has been inspected.

Then work through other important services in an order that fits the household. Note whether passwords were reused, recovery details changed or messages about new access appeared. A social account can also be urgent if it is being used to deceive your contacts, so a rigid ranking that always puts it last is not useful. Use the actual evidence and the provider's instructions to choose the next action.

For each account, write a short status such as checked, password changed, support contacted or still needs review. This is a way to keep tasks visible, not to certify an account as perfectly safe. If other people received suspicious messages, warn them through an established separate channel and ask them not to act on the requests while you investigate.

1. Identify other important services linked to the mailbox.
2. Act promptly on suspicious activity or exposed reused passwords.
3. Track unfinished checks and contact affected people through a separate trusted channel.

Define what remains uncertain

An account review cannot establish exactly what an unauthorized person saw or copied. Correcting the settings limits some future exposure but cannot retrieve information already taken. Consider the kinds of documents that may have been accessible and follow the relevant provider's or official identity-protection guidance where sensitive information is involved. Keep the distinction between possible exposure and confirmed misuse clear.

You can still take useful steps while that uncertainty remains. Watch for new account alerts, check the statements or records most relevant to the incident, and be cautious of messages that use private details to sound convincing. A later caller knowing an old bill amount does not prove they represent the biller. Return to independently verified contact routes when a new request arrives.

Frequently asked questions

Putting it into practice

Treat the recovered password as the start of a review, not proof that every route into the mailbox is closed. Follow the provider's instructions, check how incoming messages are handled, and attend promptly to other affected accounts. Keep a short record of what changed and what still needs checking so the next step is clear even if the full story is not.