How to tell if someone is reading your email
2 min read · Updated October 15, 2026
Check for forwarding addresses, filters and rules that copy or hide mail, review signed-in devices and recent activity, and look at connected apps with mailbox access. Any of these can let someone read your email without sending a single message from your account.
Why quiet access is common
Many attackers prefer not to be noticed. Instead of sending spam, they quietly watch your inbox for invoices, password resets and financial details. Because nothing changes visibly, victims often have no idea.
Places to check
- ✓Forwarding: look for any address that automatically receives a copy of your mail.
- ✓Filters and rules: look for rules that move mail to hidden folders or delete security alerts.
- ✓Connected apps: look for third-party apps with permission to read your mailbox.
- ✓Devices and sessions: look for unknown devices or locations.
- ✓Email client settings: look for unexpected access via other mail programs.
First, see what was actually exposed
Before you change anything, find out whether your address shows up in known breach records. The free check takes seconds.
Business email: watch for impersonation
In business settings, attackers who read mail can time a fake invoice or payment-change request perfectly. If you handle payments, always confirm changes by phone using a number you already know.
What to do if you find something
Remove the rule or app, sign out all sessions, change the password and enable two-factor authentication. Then change passwords on any accounts whose reset emails or details might have been seen.
Frequently asked questions
Can someone read my email with only my address?+
No. They need access to the account, usually via a password, a stolen session or a malicious app permission.
Does my provider tell me if someone logs in?+
Most providers send alerts for new sign-ins and offer an activity page. Enable alerts where available.
Does using a VPN prevent this?+
No. A VPN protects your connection, but not against stolen passwords or malicious app permissions.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.