# Can someone hack my email without my password?

URL: https://iblockspam.com/blog/can-someone-hack-my-email-without-my-password
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> Yes. Stolen session cookies, SIM swaps, hacked recovery emails, rogue app access and unlocked devices skip the password. How to check and lock your email down.

## Short answer

Yes. Attackers can get into email without your password by stealing a signed-in session cookie, taking over your phone number or recovery email to reset the account, tricking you into approving a malicious app, or using a device you left signed in. Check your account's recent activity and devices, sign out everywhere, and switch to a passkey.

Yes, someone can get into your email without ever knowing your password. Passwords are only one way in. Attackers also steal the "already signed in" token your browser keeps, take over the phone number or backup address used to reset your account, or get you to approve an app that reads your mail. This guide explains each route in plain English, how to check whether it happened to you, and what actually keeps attackers out.

## How can someone get into my email without my password?

Here are the realistic ways in, what the attacker needs, and what stops each one. Your email account is usually the key to everything else, because password resets for other accounts go there.

| Method | What the attacker needs | Does a normal MFA code stop it? | What stops it |
|---|---|---|---|
| **Stolen session cookie** from a fake login page | You to sign in through their proxy page | No | Passkey or security key; spotting the fake page |
| **Stolen session cookie** from malware | Malware on your computer | No | Clean, updated device; sign out all sessions |
| **SIM swap** | Your mobile carrier to move your number | No, if codes go by text | Carrier PIN or port-out lock; app or passkey instead of SMS |
| **Hacked recovery email** | Control of your backup address | Depends on settings | Secure the recovery account too; remove old ones |
| **Malicious app consent** | You to click "Allow" on a real consent screen | No | Only approve apps you trust; review connected apps |
| **Device code phishing** | You to type their code on a real sign-in page | No | Never enter codes someone sends you |
| **Unlocked or shared device** | Your phone or computer, still signed in | No | Screen lock; sign out of shared computers |
| **Spoofing** (not a hack) | Nothing; they fake your address | Not relevant | SPF, DKIM and DMARC on your domain |

### What is session cookie theft?

When you sign in, the email service gives your browser a token, often stored as a cookie, so you stay signed in without typing your password again. Whoever holds that token *is* you as far as the service is concerned.

Microsoft describes a token theft attack as one where criminals "compromise and replay tokens issued to a user, even if that user has satisfied multifactor authentication" ([Microsoft Learn](https://learn.microsoft.com/en-us/security/operations/token-theft-playbook)). There are two common ways to get the token:

- **A fake login page that relays your sign-in** (adversary-in-the-middle, or AiTM, phishing). You type your password and approve MFA on what looks like the real page. The attacker's server passes everything through and keeps the resulting token. Our guide on [AiTM phishing and MFA bypass](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) explains it in detail.
- **Malware on your computer.** Microsoft notes that common malware families "have built-in functionality to extract and exfiltrate browser cookies" ([Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/)). It usually arrives through a fake download, a pirated app or a malicious attachment.

In both cases the attacker never needs your password again. Changing it may not end their access.

### Can someone hack my email through my phone number?

Yes, through a SIM swap. The FBI describes SIM swapping as a technique "where criminal actors target mobile carriers" to take over a victim's phone number ([FBI IC3](https://www.ic3.gov/PSA/2022/PSA220208)). Once your number rings on their SIM card, every text-message code and "reset your password" text goes to them.

The FBI's IC3 received 1,611 SIM swapping complaints in 2021, with adjusted losses of more than $68 million. Its advice includes not giving your mobile account information to callers, using unique passwords, watching for sudden loss of phone service, and using "strong multi-factor authentication methods such as biometrics, physical security tokens".

### Can someone use my recovery email or security questions?

Yes. Account recovery is designed to let the owner back in without the password, which makes it a target. If an attacker controls your recovery email, perhaps an old address you stopped using, they can request a reset and receive the link. The same goes for security questions with answers someone can look up.

### Can an app read my email without my password?

Yes, if you gave it permission. When you click **Allow** on a sign-in screen, the app gets its own access to your mail, separate from your password. Google warns: "Only give access to your Google Account if you trust a third-party app" ([Google Account Help](https://support.google.com/accounts/answer/41236?hl=en)). Attackers exploit this with fake apps; see [OAuth consent phishing](https://iblockspam.com/blog/oauth-consent-phishing-microsoft-365). A related trick asks you to type a code on a real Microsoft page, which hands the attacker a signed-in session; see [device code phishing](https://iblockspam.com/blog/device-code-phishing-microsoft-365).

### Is spoofing the same as being hacked?

No. Spoofing means someone sends email that only *looks* like it came from you. They never touch your account. If contacts get odd messages "from you" but they're not in your Sent folder, read [someone sending email from my address: spoofed or hacked](https://iblockspam.com/blog/someone-sending-email-from-my-address).

## Can someone hack my email just because I opened a message?

Very rarely. Opening an email in an updated app like Gmail, Outlook or Apple Mail is low risk. The danger comes from what you do next: signing in through a link, opening an attachment, approving a prompt or installing something. See [is it safe to open a spam email](https://iblockspam.com/blog/is-it-safe-to-open-spam-email). Keep your mail app and phone updated to close the rare bugs that don't need a click.

## Can someone access my email through an old phone or a forgotten session?

Yes. If a phone, laptop or library computer is still signed in, anyone who picks it up can read your mail, no password needed. Selling or recycling a device without signing out, or leaving a browser signed in on a shared computer, both leave this door open.

Google explains that each sign-in on a new device, browser or app, and each time you grant an app access to your account data, can create a separate session. Its devices page lists every session so you can review the details and sign out of any you're not sure about. Google recommends signing out on devices that are lost, that you no longer own, or that don't belong to you ([Google Account Help](https://support.google.com/accounts/answer/3067630?hl=en)).

Don't panic over an unexpected timestamp. Google says the time shown is the last time the device or session communicated with Google, which includes automatic background syncing, so it can be more recent than when you last used the device.

Before you sell, give away or recycle a phone or computer, sign out of your email on it first, then check that it no longer appears on your account's device list.

## How do I know if someone is in my email?

Check your account's own activity pages first. They show sign-ins and devices, which is exactly what password-free attacks leave behind.

**Gmail and Google accounts:**

1. Go to your Google Account and open **Security & sign-in**.
2. Under **Recent security events**, select **Review security events**. If something wasn't you, choose **No, it wasn't me** and follow the steps ([Google Account Help](https://support.google.com/accounts/answer/6294825?hl=en)).
3. Under **Your devices**, select **Manage all devices**. Google lists devices "where you're currently signed in to your Google Account or have been in the last few weeks" ([Google Account Help](https://support.google.com/accounts/answer/3067630?hl=en)). Sign out of any session you don't recognize.

**Outlook.com, Hotmail and personal Microsoft accounts:**

1. Sign in at account.microsoft.com and open the **Recent activity** page from Security. Microsoft says it shows "when and where you've used your Microsoft account within the last 30 days" ([Microsoft Support](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page)).
2. Expand anything unusual. If it wasn't you, choose **This wasn't me** or **Secure your account**.

**Then check the hiding places** in either service: forwarding, filters or rules that move or delete mail, recovery email and phone, and connected apps. The FTC lists warning signs including login alerts from unknown devices, password change notices you didn't make, and contacts getting messages you never sent ([FTC](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account)). For a full list of signs, see [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised).

## What should I do if someone got in without my password?

Work through these in order. Speed matters, but so does doing them from a clean device.

1. **Scan your device first.** Microsoft says to run a full antivirus scan "before you change your password", so malware can't capture the new one ([Microsoft Support](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-recover-a-hacked-or-compromised-microsoft-account)).
2. **Change your password** to a new, unique one. If you can't sign in, use the provider's account recovery page.
3. **Sign out everywhere.** Remove devices and sessions you don't recognize. This is the step that ends a stolen-cookie session.
4. **Remove unknown apps** with access to your account.
5. **Check recovery details.** Make sure the recovery email and phone are yours; delete old ones.
6. **Delete forwarding, filters and rules** you didn't create. The FTC specifically says to look for "rules set up to forward emails".
7. **Turn on stronger sign-in:** a passkey, a security key or an authenticator app rather than text messages.
8. **Tell your contacts** not to click links or send money based on recent messages from you.
9. **Change passwords on other accounts** that reset through this email, starting with banking.

If you lost money, contact your bank straight away. For business accounts, your admin should follow the full playbook in [Microsoft 365 compromised account remediation](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation) or [Google Workspace compromised account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery), because revoking sessions and checking audit logs needs admin rights.

## How do I protect my email from attacks that skip the password?

A strong password still matters, but it isn't enough on its own. These steps cover the routes above:

- **Use a passkey or security key where you can.** They only work on the real website, so a fake login page gets nothing it can replay. See [passkeys for email](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email).
- **Move off text-message codes.** Use an authenticator app or passkey so a SIM swap can't intercept your sign-in.
- **Lock down your phone number.** Ask your carrier for an account PIN or port-out protection.
- **Protect your recovery email** like your main account, and remove addresses you no longer use.
- **Keep devices updated** and don't install cracked software, unknown browser extensions or "required" downloads from emails.
- **Read consent screens.** If an app you didn't seek out asks to "read your email", say no.
- **Use a screen lock** on your phone and sign out of shared computers.
- **Review devices, apps and forwarding** every few months, not only after a scare.

For businesses, most of these become policies: phishing-resistant MFA, blocked device code flow, restricted app consent, and filtering that stops phishing emails before staff can click. If you run email for a small company, see how iBlockSpam filters inbound phishing for [small businesses](https://iblockspam.com/solutions/small-business).

## Next steps

1. Open your Google **Your devices** page or Microsoft **Recent activity** page today and sign out of anything you don't recognize.
2. Check forwarding, filters, recovery details and connected apps.
3. Add a passkey or security key to your email account and remove text-message codes if you have a better option.
4. Ask your mobile carrier about a PIN or port-out lock.
5. If a suspicious "sign-in alert" email prompted this, check its headers in the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) before clicking anything, and see [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) if you already did.
6. Running a business domain? Protect inboxes before phishing arrives: see iBlockSpam for [small businesses](https://iblockspam.com/solutions/small-business).

## Frequently asked questions

### Can a hacker get into my email if I have two-factor authentication?

Yes, in a few ways. A fake login page that relays your sign-in can capture the session cookie after you approve the code or push, and malware on your computer can copy cookies from your browser. Microsoft says token theft works even when the user has satisfied MFA. Passkeys and security keys stop the fake-page method because they only work on the real site.

### Can someone hack my email with just my phone number?

Not with the number alone, but a SIM swap can turn it into access. The criminal convinces your mobile carrier to move your number to their SIM card, then receives your text-message codes and account recovery texts. The FBI's IC3 received 1,611 SIM swap complaints in 2021, with adjusted losses of more than $68 million. Ask your carrier for a PIN or port-out lock.

### Does changing my password kick a hacker out of my email?

Not always. A stolen session cookie or an approved app can keep working after a password change. After resetting the password, also sign out of all sessions, remove devices you don't recognize, revoke unknown third-party apps, and check forwarding and filters. Microsoft also says to scan your PC for malware before changing the password, so the new one isn't stolen too.

### Can someone read my email if they hacked my recovery email?

They can try. Whoever controls your recovery email or phone can usually start a password reset on your main account and receive the reset link or code. That's why the recovery address needs the same protection as the main account: a unique password, two-step verification and up-to-date contact details. Remove recovery addresses you no longer use.

### Can someone see my emails without me knowing?

Yes, if they're signed in quietly from another device, have a forwarding rule copying your mail out, or control an app you granted mailbox access. None of these change your password, so nothing looks wrong. Check Google's Your devices page or Microsoft's Recent activity page, plus your forwarding settings, filters and connected apps, every few months.

## Sources

- [Microsoft Learn: Token theft playbook](https://learn.microsoft.com/en-us/security/operations/token-theft-playbook)
- [Microsoft Security Blog: Token tactics: How to prevent, detect, and respond to cloud token theft (November 16, 2022)](https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/)
- [FBI IC3 Public Service Announcement: Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (February 8, 2022)](https://www.ic3.gov/PSA/2022/PSA220208)
- [FTC Consumer Advice: How To Recover Your Hacked Email or Social Media Account](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account)
- [Google Account Help: Secure a hacked or compromised Google Account](https://support.google.com/accounts/answer/6294825?hl=en)
- [Google Account Help: See devices with account access](https://support.google.com/accounts/answer/3067630?hl=en)
- [Microsoft Support: What is the Recent activity page?](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page)
- [Microsoft Support: How to recover a hacked or compromised Microsoft account](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-recover-a-hacked-or-compromised-microsoft-account)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/can-someone-hack-my-email-without-my-password (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt