Check Gmail access after a suspicious sign-in

Start with access and a short incident record

A mailbox used for exchange alerts deserves its own incident check. Someone who can read it may see account notices or recovery messages even after you have secured the exchange itself. This guide is for an owner who can still access a personal Gmail account and wants to inspect where mail goes and who can access it. It uses Google's desktop settings, checked on 12 November 2026. Workplace accounts may have administrator-controlled settings.

Open Gmail and your Google Account through a saved bookmark or a manually entered address, not the suspicious message. Use a device you trust. If you cannot sign in, start Google's account-recovery process instead of following the settings below. Keep a brief private record of the unfamiliar event, its displayed time, the affected account and any changes you make. Do not include passwords, recovery codes or wallet seed phrases. If funds are actively moving, contact the exchange through its official support route immediately while securing the mailbox. [1]

Change the password, then review sessions

In your Google Account, open Security & sign-in, then Password under How you sign in to Google. Set a new, unique password. If you reused the old password elsewhere, change those accounts separately. Google explains that changing a password signs you out in many places but has exceptions, including some devices and third-party access. Treat the session review as a separate step.

Under Your devices, choose Manage all devices. Open unfamiliar entries, inspect their details and sign out where access is not yours. One device can have several sessions; if you cannot account for sessions sharing a device name, review and sign out of all relevant entries. A recent timestamp can reflect background synchronisation, and a nearby location can be approximate. Record those clues without treating one unfamiliar city as proof of an intruder. After signing out, confirm that the entry shows Signed out. [2][3]

Turn off forwarding you did not authorise

On a computer, open Gmail Settings and See all settings. Select Forwarding and POP/IMAP, or Forwarding if that is the label shown. Inspect the destination in the Forwarding section. If forwarding is not yours, record the address privately, select Disable forwarding and save the change. Return to the tab to check that the saved setting persists.

Global forwarding and filter-based forwarding are different settings. Google's instructions explicitly allow selected messages to be forwarded by filters even when automatic forwarding is off. Continue to the next section rather than concluding that mail can no longer leave the account. Avoid sending a real exchange recovery code as a test. If a work account has a legitimate business forwarding arrangement, consult its administrator before removing it; record precisely which account and destination you are checking. [4]

Inspect filters that can hide security messages

Open Settings, See all settings, then Filters and Blocked Addresses. Read each filter's matching criteria and action. Pay attention to rules affecting exchange names, password messages or security alerts, especially when they forward, archive, mark or delete mail. A filter can be legitimate; compare it with what you actually configured.

For an unauthorised rule, preserve a screenshot or written description of its criteria and destination, then use Delete and confirm. If you are correcting a legitimate rule, use Edit and complete the update rather than merely closing the window. Reopen the list to confirm the result. Check blocked addresses as well when expected alerts are missing. Search the mailbox, including Spam and Trash, for the missing conversation. Removing a rule changes future handling; it does not retrieve copies already forwarded to someone else. [5]

Remove unfamiliar delegates and app access

In Gmail's full settings, open Accounts and Import or Accounts and find Grant access to your account. A delegate can read, send and delete mail. Remove access you did not grant using Delete next to that delegate. This is distinct from a forwarding destination: delegation allows another account to operate the mailbox.

Next open your Google Account's linked-apps or third-party-connections page. Inspect each unfamiliar app and the type of connection it holds. Sign in with Google, linked accounts and access to Google data have different controls. Follow the removal option for the actual connection, rather than assuming that removing a saved password revokes permissions. Record the app name and permission first if needed for an incident report. Google notes that removing a connection does not necessarily erase information the third party already holds; contact that provider separately about stored data. [6][7]

Review recovery details and connected accounts

Review recent security events and your recovery phone and email. Use Google's on-screen response for activity that was not yours. Check that recovery destinations still belong to you and that you can access them. Review the available sign-in methods and enable two-step verification if it is absent. Keep recovery material somewhere other than the mailbox you are repairing.

Then open each important exchange directly. Review its sessions, security changes and withdrawal notices using that exchange's own controls. Mailbox repair and exchange repair are separate tasks. If an API key or other secret was present in exposed mail, replace or revoke it through the issuing service; deleting the email is not a revocation. Preserve transaction identifiers and support case numbers if there was a financial incident. Do not give a supposed recovery agent remote control or transfer funds to a claimed safe wallet. [1]

Work through a concrete example

Consider an illustrative case: a user recognises every laptop in the device list but finds a Gmail filter forwarding messages containing an exchange's name to an unknown address. The useful finding is the rule and its destination, not a guess about who created it. Record the filter, remove it, inspect global forwarding, review delegates and connected apps, and check the exchange independently.

For a harmless functional test, send a plain message from a second account you control, using a subject that matches the former rule but contains no secret or login link. Confirm it reaches the expected folder. If it does not, inspect other matching rules, Spam and delivery status. Receiving the test verifies that particular mail-handling path; it cannot establish that every account setting or device is clean. Keep the test result alongside the changes you recorded. [4][5][6][7]

Verify the result and know when to escalate

Finish with a short checklist: - Unauthorised sessions show as signed out. - Forwarding destinations and filters are expected. - Delegates and linked apps are recognised. - Recovery details belong to you. - Relevant exchange accounts have been checked separately.

If settings reappear, access is lost or unexplained activity continues, return to Google's compromised-account guidance and involve the workplace administrator where applicable. A potentially infected device needs its own investigation; repeated password changes on that device may not resolve the cause. Preserve evidence without postponing containment.

Review the account again after your next normal sign-in and after any further security notice. These checks document specific changes and help close unwanted access paths. They cannot reverse an already completed transfer or recall data already copied. The interface names in this guide should be rechecked when Google changes its account or Gmail settings. [1][3]