How to Check If You've Been Hacked: Accounts, Devices, Money

To check whether you have been hacked, work through six areas in order: whether your addresses appear in known breaches, which devices are signed in to your key accounts, whether your email has hidden forwarding rules, which apps have access to your accounts, whether your computer or phone shows signs of malware, and whether money or credit has been touched. Each step catches a different kind of compromise, and the order matters — your email account controls password resets for everything else, so it comes first. If you only have a sign-in alert or a strange email to go on, start with the signs table below.

Checking one email address specifically? Our guide to checking if your email was hacked covers that in depth.

Signs and what they usually mean

Apple's own support page lists most of these as signs of a compromised Apple Account, and Google's guidance for a hacked account starts the same way — review recent security events and devices.

Step 1 — Check breach exposure

Go to haveibeenpwned.com and enter every email address you use, including old ones you still check. For each breached service:

• Change the password to one generated by a password manager.
• If you reused that password anywhere, change it there too.
• Sign up for Have I Been Pwned's free notifications for future breaches.

Step 2 — Review active sessions and devices

Every major provider shows the devices signed in to your account:

• Google — myaccount.google.com/security/devices; Google also suggests reviewing "Recent security events".
• Apple — account.apple.com → Devices; remove any you do not recognise.
• Microsoft — account.microsoft.com/security/sign-in-activity
• Facebook — Settings → Security → Where you're logged in
• Instagram — Settings → Security → Login activity
• X — Settings → Security → Apps and sessions

For any device you do not recognise: sign it out, change that account's password, and turn on two-factor authentication.

Step 3 — Check your email for hidden rules

A common move after a break-in is to set your mailbox to copy or hide messages, so the attacker keeps receiving password resets after you change your password. Google's hacked-account guidance specifically says to check for unfamiliar mail delegation, automatic forwarding, filters and IMAP or POP access.

• Gmail — Settings → See all settings → Filters and Blocked Addresses, Forwarding and POP/IMAP, and Accounts (for delegation).
• Outlook — Settings → Mail → Rules, and Forwarding.
• iCloud Mail — iCloud.com → Mail → Rules.

Then check your recovery email and phone number. Apple also advises confirming with your email provider and mobile carrier that you control every linked address and number, including that no SMS forwarding is set up.

Step 4 — Revoke connected apps

Each "Sign in with Google/Apple/Facebook" creates a lasting grant. Review and remove what you do not use or recognise:

• Google — myaccount.google.com/security/third-party
• Apple — account.apple.com → Sign in with Apple
• Facebook — Settings → Apps and Websites
• Microsoft — Account → Privacy → Apps and services

Step 5 — Check your devices

Windows. Run a Microsoft Defender offline scan, which Microsoft describes as running after a restart "without loading Windows": Windows Security → Virus & threat protection → Scan options → choose Microsoft Defender Antivirus (offline scan) and start the scan. Save your work first — the PC restarts, scans and restarts again. Results appear under Protection history.

Mac. Keep macOS updated so its built-in XProtect can remove known malware, and check System Settings for login items and profiles you did not add.

Phone. Update the operating system, remove apps you do not recognise and check which apps have device-administrator or profile permissions.

If malware keeps returning after a scan, backing up your files and reinstalling the operating system is the most certain way to get back to a clean device.

Step 6 — Check money and credit

• Read recent transactions on every bank, card and payment account, and look for address changes or new cards you did not order.
• Check your credit report for accounts you did not open. In the US, the Federal Trade Commission notes that a credit freeze is free, lasts until you lift it and must be placed with each of Equifax, Experian and TransUnion; a fraud alert needs only one bureau, which must tell the other two.

Lock it down afterwards

• Turn on 2FA everywhere, preferring an authenticator app or security key to SMS — see the 2FA setup playbook.
• Use new, unique passwords on every affected account, generated by NordPass or another manager.
• Sign out all sessions on your main accounts so any lingering access is cut.
• Report it. In the US, report identity theft to the FTC at identitytheft.gov; elsewhere, use your national police or fraud-reporting service. Keep the reference number for disputes with banks.

Frequently asked questions

How do I know if I have been hacked?

Common signs include sign-in alerts you do not recognise, 2FA codes you did not request, a password that stops working, messages sent in your name and unfamiliar transactions. Check signed-in devices and recent security activity on your main accounts to confirm.

What should I check first if I think I've been hacked?

Your main email account: its signed-in devices, forwarding rules, filters and recovery details. Email controls password resets for your other accounts, so securing it first stops an attacker resetting everything else.

Can someone still read my email after I change my password?

Yes, if they set up automatic forwarding, a filter or mailbox delegation before you changed it. Check and remove these in your mail settings after any suspected break-in.

How do I check my computer for hackers or malware?

On Windows, run a Microsoft Defender offline scan from Windows Security → Virus & threat protection → Scan options. On a Mac, keep macOS updated and review login items and profiles. Reinstall the system if problems persist.

Related

Build the longer-term plan with the identity protection guide, and if a company has told you your data was leaked, follow what to do if your data has been breached.

Sources checked 16 October 2026: Apple Support, "If you think your Apple Account has been compromised"; Google Account Help, "Secure a hacked or compromised Google Account"; Microsoft Support, "Help protect my PC with Microsoft Defender Offline"; US FTC, credit freezes and fraud alerts. Editorial content.