Has your account been hacked? The signs to look for
The clearest signs of a hacked account are a password that no longer works, security settings you did not change, messages you did not send and sign-ins from places you have never been. The dangerous cases are quieter: an attacker who only reads, with a hidden rule forwarding your mail to them. This article lists the signs, loud and quiet, with real cases, and then the steps to take back control in the right order.
The obvious signs
The UK National Cyber Security Centre (NCSC) lists five:
- You cannot sign in, because the password or the recovery details have changed.
- Security settings have changed without you doing it.
- Messages or notifications have been sent from the account that you do not recognise.
- Sign-ins appear from unfamiliar places or at odd times.
- Money has moved: transfers or purchases you did not make.
Google and Apple add a few more: a new recovery email address or phone number, devices you do not recognise in the account's device list, two-factor codes arriving that you did not ask for, mail missing from both the Inbox and the Bin, and friends telling you they received spam from you.
The quiet signs
Many attackers change nothing visible. A mailbox is worth more to them if you keep using it, because your mail tells them who pays whom and when.
Check for these:
| Where | What to look for |
|---|---|
| Mail filters and rules | A rule that forwards mail elsewhere, moves it to an odd folder, marks it as read or deletes it |
| Forwarding settings | An outside address you did not add |
| Sent and deleted items | Messages you did not write, or gaps where replies should be |
| Connected apps | Apps or services with access to the account that you do not recognise |
| Recent activity | Sign-ins by mail programs (IMAP or POP) or from IP addresses that are not yours |
Two of these deserve a word of warning. The NCSC explains that attackers add forwarding rules and filters to receive copies of your mail, which lets them reset your other passwords. And Microsoft notes that an app you were tricked into approving keeps its access after a password reset and a new second factor, so it must be removed separately.
On Noiz shared hosting, filters and forwarding rules for a mailbox are in the webmail settings, under Filters.
Three real cases
A law firm's mailbox, used for four days. The UK Information Commissioner's Office (ICO) published a reprimand in 2023 against a small firm of solicitors. A member of staff fell for a targeted phishing email. Over four days the attacker used the mailbox to divert payments due to the beneficiaries of an estate. The mailbox had no second factor at sign-in. The firm repaid its clients in full.
An attacker who waited. Microsoft Threat Intelligence described, in July 2022, an attacker who signed in to a finance mailbox every few hours for days, reading but changing nothing. When the moment came, the attacker sent a fraudulent payment request and set inbox rules so that replies never reached the real owner, then deleted the sent messages.
A mailbox turned into a spam cannon. In 2023 and again in January 2026, Microsoft described attacks in which the criminal added a rule to archive or delete all incoming mail and mark it read, then sent hundreds or thousands of phishing emails to the victim's contacts, deleting the bounces and the worried replies.
The scale is worldwide. The FBI's Internet Crime Complaint Center recorded US$3.05 billion lost to business email compromise in 2025, from 24,768 complaints, and South Africa is among the twenty countries outside the United States with the most complaints.
An illustration of how this looks from the other side: a supplier sends you an invoice as usual, followed a day later by an email from the same address saying their bank details have changed. The address is genuine, because the supplier's mailbox has been taken over. The only defence is to confirm the change by phone, on a number you already have.
How accounts get taken over
Most takeovers start with one of three things: a password reused from a site that leaked it, a fake login page that captured the password and the second-factor code, or malware on a computer that copied saved passwords and signed-in sessions. Our article Saved passwords, stolen in seconds explains the third in detail, and why changing a password does not always end a stolen session.
To see whether your address appears in known breaches or in stolen-credential data, use Have I Been Pwned (haveibeenpwned.com).
What to do, in order
The order matters. Work on a device you trust.
- Make sure the device is clean. If you suspect malware, deal with that first, or any new password you type can be stolen again. The infostealer article covers how.
- Recover the account through the provider's official recovery process if you are locked out. Type the address yourself; do not use links in messages.
- Check forwarding, filters and rules, and delete any you did not create. The NCSC puts this before changing the password, because a forwarding rule keeps leaking mail, including password reset links, whatever the password is.
- Change the password, and change it anywhere else you used the same one.
- Sign out every other session and device, and remove apps and mail programs you do not recognise.
- Check the recovery details (email address and phone number) and remove anything that is not yours.
- Turn on two-factor sign-in, preferably with a security key or passkey, otherwise an authenticator app.
- Warn your contacts to treat recent messages from you with suspicion, especially anything about payments or bank details.
- Check your bank and card statements, and call the bank at once if money was sent. The FBI stresses that a quick call to request a recall gives the best chance of recovering a payment.
A business in South Africa holding personal information about clients should also consider whether the Protection of Personal Information Act (POPIA) requires it to notify the Information Regulator and the people affected. The infostealer article sets out the relevant sections.
Where Noiz fits
If you host with Noiz and think a mailbox, website or control panel login has been taken over, contact Noiz support, after you have changed the password from a clean device. For the control panel itself, turn on two-factor authentication in Plesk. For an organisation that wants two-factor sign-in on every mailbox, with app passwords for mail programs, Noiz runs Private Email on a server for your organisation alone, quoted per deployment.
If a mailbox you rely on for payments has no second lock on it, ask us about Private Email.
Sources
- NCSC, Recovering a hacked account (modified 8 December 2025): https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account
- Google Account Help, Secure a hacked or compromised Google Account: https://support.google.com/accounts/answer/6294825
- Gmail Help, Check for unusual activity (last account activity): https://support.google.com/mail/answer/45938
- Google Account Help, third-party apps with account access: https://support.google.com/accounts/answer/3466521
- Apple Support, If you think your Apple Account has been compromised (5 December 2025): https://support.apple.com/en-us/102560
- Microsoft Learn, Detect and remediate illicit consent grants: https://learn.microsoft.com/en-us/defender-office-365/detect-and-remediate-illicit-consent-grants
- Microsoft Threat Intelligence, 12 July 2022: https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/
- Microsoft Threat Intelligence, 8 June 2023: https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
- Microsoft Threat Intelligence, 21 January 2026: https://www.microsoft.com/en-us/security/blog/2026/01/21/multistage-aitm-phishing-bec-campaign-abusing-sharepoint/
- ICO reprimand, 9 August 2023: https://ico.org.uk/media2/migrated/4026144/20230809-ico-ssj-redacted-reprimand.pdf
- FBI IC3, Business Email Compromise: The $55 Billion Scam (11 September 2024): https://www.ic3.gov/PSA/2024/PSA240911
- FBI IC3, 2025 Annual Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Have I Been Pwned: https://haveibeenpwned.com/
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
