4 min read · Beginner · Related: Business Email & Security

Updated October 2026 · Tampa Bay–tested steps

Hacker in Your Gmail? Check These 3 Hidden Settings

Attackers add silent forwarding rules and filters so they keep reading after you change the password. Find them now.

  1. 1. Check forwarding addresses

    Gmail → Settings (gear) → See all settings → Forwarding. If mail forwards to an address you don't recognize, disable it immediately — this is the #1 persistence trick: they keep every future email even after your password change.

  2. 2. Inspect filters for silent rules

    Same settings → Filters and Blocked Addresses. Look for filters that Skip Inbox, Mark as read, or Forward specific mail (bank, password resets) — attackers file away the evidence so you never see it.

  3. 3. Review access, then lock it down

    Scroll to the bottom → Details → Sign out all other sessions. Check myaccount.google.com → Security → Third-party access and remove unknowns. Then change the password and enable passkeys or authenticator 2FA.

Hacker in Your Gmail? Check These 3 Hidden Settings — When to Call a Pro

  • Money moved or accounts were opened — identity theft needs freezes plus a paper trail.
  • It's a Google Workspace business account — admin logs and forced resets required.
  • You need the whole team audited and moved to a password manager.
Get help with this(813) 702-3155

Guide FAQ

Usually an old breach password reused on Gmail, or a phishing login. The forwarding rule gets added in the 10 minutes they have access — then they leave and read everything remotely.
Only if you also remove forwarding rules, filters, and unknown sessions first. Password change alone leaves every backdoor they installed wide open.
Was this guide helpful?

Keep going on Business Email & Security

Outlook Not Syncing? Fix Send & Receive Fast5 min readGmail Says Storage Full? Reclaim Gigabytes in 15 Minutes4 min readOutlook Keeps Asking for Your Password? Break the Loop4 min read

Related service: Business Email & Security →