Email Account Compromised and Emails Inaccessible — what to check first (without making it worse)
Steve H.
Expert ★★★★★ 27,853 satisfied customers
Specialities: compromised email account triage, “can’t access inbox” and missing emails checks, suspicious sign-in and recovery-method review, forwarding/rules.
If your email account looks hacked and your inbox is missing, start with safe checks: account access, recovery info, suspicious devices, and hidden forwarding/rules
Technician
1) You’re being blocked from signing in (password changed, 2FA issues, “unusual activity”).
2) You can sign in, but the mail is missing (inbox empty, emails moved, hidden rules/forwarding, sync/view settings).
We’ll do this the safe way: no risky “try everything” steps and no repeated sign-in attempts that trigger lockouts.
First, tell me:
• Which email is it (Gmail, Outlook/Hotmail, Yahoo, iCloud, work email)?
• Can you sign in at all, or are you locked out?
• What changed right before this started (new phone, browser update, new mail app, VPN, travel, clicking a link, password reset)?
Technician
Two quick, low-risk questions (different order on purpose):
1) Are you looking at Outlook in a browser, in the Windows Mail/Outlook app, or on a phone (iPhone/Android Mail app)?
2) When you say “empty,” do you mean no new mail arriving, or old mail missing too?
3) Do you see any emails in Junk/Spam, Deleted Items/Trash, or Archive?
Technician
If the phone shows more mail but the browser looks empty, it often points to view/filter settings, Focused/Other tabs, or a sync/account connection issue — not necessarily permanent deletion.
Trust moment: I don’t want you to “clean up” folders or run bulk deletes right now. If someone did access the account, moving things around can make recovery harder.
Safe check #1: In the browser, do you see any filter like Unread or a search filter turned on, or “Focused” vs “Other”?
Safe check #2: Can you search for a specific sender (like your bank) rather than browsing the inbox list?
Technician
We’ll keep this calm and controlled. The goal is to stop any ongoing misuse and figure out why emails look inaccessible.
Quick questions:
1) Did you get any “security alert” emails about sign-ins from a new location or device?
2) Do you have two-step verification / 2FA on this account?
3) Has anyone helped you “set up” email recently (a shop, a friend, a new app)?
Technician
Trust moment: I’m not going to tell you to click random “recovery” links or enter codes into messages. We’ll stick to safe checks inside your provider’s official account pages.
Safe checks (no “deep changes” yet):
• Look for recent sign-ins / devices and note anything you don’t recognize (device type, location, time).
• Check whether there’s mail forwarding turned on or any rules moving mail to Archive/Trash or marking it as read.
• Check “connected apps” or “third-party access” that can read/send email.
Do you remember seeing anything about forwarding, rules, or a “connected app” you don’t recognize?
Technician
Here’s the safest order (high-level, not a “click this, click that” list):
1) Confirm you still control your recovery email/phone and can receive codes.
2) Review recent sign-in activity and remove anything clearly not yours.
3) Review rules/forwarding and connected apps for anything unfamiliar.
About the old tablet: it usually doesn’t delete mail by itself, but it can confuse sync if it’s connected through an old setup or if someone gained access through a saved sign-in. That’s why the “devices list” check is important.
Also: if you saw a strange Sent email, it’s worth considering that the password may have been guessed or reused from another site.
Technician
• Settings/view issue: Focused/Other, filters, or a browser session problem can make mail “look gone” even when it isn’t.
• Compromise risk: a security alert + a Sent message you didn’t send is the part we take seriously.
Why phone vs laptop differs: the iPhone Mail app may be showing cached mail or syncing differently (IMAP), while the browser view depends on your current account settings and rules. That’s why searching and checking folders can reveal emails that aren’t showing in the main list.
Safe check to protect you: if you suspect compromise, avoid replying to suspicious emails and don’t open attachments while we’re still investigating.
Technician
Trust moment: I don’t want you to remove recovery info or spam resets — those are the exact actions that can lock you out or make it harder to prove the account is yours.
For now, avoid:
• Repeated password reset attempts in a short time.
• Removing your recovery email/phone until you confirm you still control the account.
• “Cleaner/security” extensions you don’t fully trust (they can read what you type).
If you want a simple, safe next step: write down the security alert details (time, device/location) and compare what you see in “devices / recent activity” to what you actually own.
Technician
One more protective reminder: if anyone contacts you offering “email recovery help” and asks for a code, password, or remote access, treat it as a scam. Real recovery happens only through your provider’s official account pages and verified support flows.
If you discover any unfamiliar rules (like “move to Archive,” “delete,” or “forward”), don’t delete everything in a rush — take a screenshot or note the rule name first. That gives you a clean record of what changed and when.
Quick answer: the accepted fix
Most common “safe first steps” when your email account is compromised and emails are inaccessible:
• Stop repeated sign-in/reset attempts for a bit (this reduces lockout risk).
• Confirm you still control your recovery email/phone and can receive security codes.
• Review recent sign-ins/devices and look for anything unfamiliar (time, location, device).
• Check for hidden forwarding, rules/filters, or connected apps that can move or delete mail.
• If mail “looks gone,” search for a known sender and check folders/tabs (Junk/Spam, Deleted/Trash, Archive, Focused/Other) before assuming permanent loss.
Common reasons a hacked email account suddenly “loses” emails
An email compromise doesn’t always mean everything was deleted. Often, attackers set forwarding or rules to hide mail (move to Archive, mark as read, send to Trash), or they grant access to a connected third-party app that can read and send messages. Sometimes it’s not a hack at all — a browser update, a new extension, or a mailbox view (Focused/Other, filters) can make emails look missing even when they’re still there.
What to check first before you change passwords or remove recovery info
Start with the least risky checks: verify you can receive security codes, review recent sign-in activity, and look for unfamiliar devices. Then review forwarding, rules/filters, and connected apps that can redirect or delete mail. If your inbox looks empty on one device but not another, compare the browser view (tabs/filters) and avoid “cleaner” extensions until you’re confident the session is safe.
Security tip: don’t share codes or let strangers “help” remotely
Compromised email accounts attract scammers.
If someone asks for a verification code, password, recovery key, or remote access to “fix your email,” treat it as suspicious. Legitimate recovery should happen only on your provider’s official sign-in pages and verified support site. Stick to safe checks (recovery method control, recent sign-ins/devices, forwarding/rules, connected apps) and keep notes you can share with official support.
Disclaimer: This information is AI-generated and intended for general guidance only. Steps vary by device, region, and service. For exact instructions for your setup, consult a verified expert or the manufacturer’s support site.
Getting Started Is Easy
Low-risk diagnosis
Identify whether the verification loop is driven by risk signals, cookie/session persistence, or blocked security resources.
Reduce security friction
Learn why repeated attempts can trigger cooldowns and how to test safely without escalating lockouts.
Escalation-ready notes
Collect the exact prompts, timestamps, and environment differences so official support can triage faster.
FAQ
Why did it start suddenly — was my email hacked overnight?
It can start suddenly if someone gained access, but it can also happen after a login alert, a device change, or a browser update. Attackers often add forwarding or rules that hide mail, so it looks like messages vanished. A new extension or a changed mailbox view can also make emails appear missing. The safest approach is to check recent sign-ins/devices and mail rules before making big changes.
Could this happen after an update or a new extension?
Yes, updates and extensions can change how your mailbox displays or how sign-in works. Some extensions can interfere with pages or access what you type, which is risky during account recovery. Updates can also reset filters like Focused/Other or change sync behavior. If the timing matches, test in a clean browser profile and keep security checks limited and controlled.
Is this a hardware problem or just account settings?
Most of the time it’s not hardware. If one device shows more email than another, it usually points to view settings, syncing, or account rules rather than a broken computer. A compromised account can also make mail move or disappear across all devices. Checking recent sign-ins, forwarding, and rules is more useful than replacing hardware.
Can this be fixed without a service or paid help?
Often, yes, if you still control the recovery email/phone and can review account activity. Many cases are resolved by removing unfamiliar devices, disabling suspicious forwarding/rules, and securing the account through official provider pages. If you’re locked out or recovery methods were changed, you may need the provider’s recovery process. Avoid repeated resets and keep notes of what you see so support can help faster if needed.
Sources
- Microsoft Support — How to recover a hacked or compromised Microsoft account
- Google Account Help — Secure a hacked or compromised Google Account
- Google — Gmail Message Recovery Tool (for emails deleted by unauthorized access)
- Apple Support — If you think your Apple Account has been compromised
Filed under: Account Access Help
Related articles
- Email Account Compromised and Suspended Automatically — why it happened and what to check first
- Email Account Compromised and Recovery Denied Completely — what to check first (without making lockouts worse)
- Email account compromised and recovery denied — what to check first (without making it worse)
- Email account compromised and personal data exposed — what to check first (without making it worse)
- Email Account Compromised and Payout Emails Missing — what to check first (without making it worse)
- Email Account Compromised and Identity at Risk — what to check first (before you make it worse)
- Email Account Compromised and Money Lost — what to do first (safe steps, preserve evidence)
- Email Account Compromised and Data Access Lost — what to check first (without making lockouts worse)
