Unauthorized Access to Your Email Account: What to Do Before the Evidence Disappears

Someone has read your emails, changed a recovery address or set up a rule that silently forwards messages to an outside address. The natural reaction is to lock the account down and move on. That is understandable, and protecting the account is essential. But the same minutes in which you regain control are often the minutes in which the traces of the intrusion are overwritten, removed or simply left to expire.

This guide is about that moment: what to do in the first hours after discovering unauthorized access to an email account, how to secure the account without destroying what may later be needed to prove what happened, and what access logs can and cannot demonstrate. It does not describe our certification services in detail; those are covered on the dedicated service pages linked at the end.

Contents

1. Signs that someone else is using your account
2. Securing the account without erasing the traces
3. What to preserve
4. Why time matters: activity logs do not last
5. What access logs can and cannot show
6. A practical example
7. Forensic acquisition, legal advice and the complaint
8. How to request the service

Signs that someone else is using your account

Unauthorized access to an email account is rarely announced. More often it is noticed through small anomalies, for example:

• security notifications from the provider about a new sign-in, a new device or a password change you did not make;
• messages marked as read that you never opened, or sent messages you did not write;
• contacts who receive unusual requests from your address, such as payment instructions or links;
• new forwarding addresses, filters that move or delete messages, or changed recovery details;
• third-party apps or app passwords you do not recognise in the account’s security settings;
• being suddenly signed out, or a password that no longer works.

None of these signs proves an intrusion on its own. Some have innocent explanations, such as a forgotten device or a colleague with delegated access. They are reasons to look more closely, and to do so in a way that keeps the information intact.

Securing the account without erasing the traces

Two goals compete in the first hours: stopping the intrusion and preserving the evidence of it. Neither can simply be postponed.

If the intruder is actively causing harm — sending fraudulent emails, changing recovery details, deleting messages or locking you out — protecting the account and the people who write to you comes first. Ongoing damage is not an acceptable price for a cleaner record.

If there is no sign of ongoing activity, a few minutes spent documenting before changing anything are usually worth it, and contacting a forensic provider immediately allows the acquisition to be planned around the security steps rather than after them.

In practice, a careful sequence often looks like this:

1. Look before you change. Open the account’s security pages (recent activity, connected devices, forwarding, filters, connected apps) and take screenshots or screen recordings, noting the time. This is not a forensic acquisition, but it records what you saw.
2. Keep the provider’s notifications. Do not delete security alert emails or text messages about new sign-ins or password changes. They are often among the most useful pieces of information.
3. Secure the account deliberately. Change the password from a device you trust, enable two-step verification and review recovery options. Be aware that some actions, such as signing out of all sessions or removing a device, may change what the security pages show afterwards.
4. Remove malicious rules after documenting them. A forwarding rule or a filter that deletes messages must be stopped, but it should be recorded first, including the destination address and the conditions it applies.
5. Do not delete the account or mass-delete messages. Closing the account may make its activity history unavailable, and deleted messages may be exactly what shows what the intruder did.

If the account belongs to a company domain, the user’s own security pages are only part of the picture. Administrators of business email services can usually access additional audit and sign-in logs, subject to their configuration and licence. The IT administrator should be involved early and asked not to purge or reset anything before the logs have been preserved.

If you suspect that the intrusion started from a compromised computer or phone, avoid reinstalling or resetting that device until you have taken advice: the device itself may hold information that the account logs do not.

What to preserve

The aim is to keep enough to reconstruct what happened, when, and from where. The availability of each element depends on the provider and the type of account.

Account activity

• Recent sign-in and security activity, with dates, times and the time zone shown.
• IP addresses, approximate locations and device or browser information displayed by the provider.
• Lists of connected devices and active sessions.

Configuration changes

• Forwarding addresses, filters and automatic rules, including any that delete or archive messages.
• Changes to recovery email, recovery phone number or two-step verification.
• Delegated access, connected third-party apps and app passwords.

Messages and notifications

• Security alerts from the provider about sign-ins, devices or password changes.
• Messages sent, read, moved or deleted by the intruder, as far as they can be identified.
• Full message headers of relevant emails, which contain routing information not visible in the normal view.

Context from outside the account

• Messages from contacts who received suspicious emails from your address.
• Bank or payment records if the intrusion led to a fraudulent transfer.
• Your own notes: when you noticed the problem, what you saw and what you changed, in order.

Where the provider offers an official data export, it can complement the acquisition of the security pages. For accounts on the two largest platforms, we also provide Google Takeout certification and Microsoft account export certification.

Why time matters: activity logs do not last

Email providers do not keep the activity history shown to users indefinitely. Depending on the provider, the account type and the specific page, the visible window can range from a few weeks to several months, and some views show only the most recent sessions. Business services may keep longer audit logs, but only where they are enabled and within the limits of the subscription.

Two consequences follow. First, waiting has a cost: an intrusion discovered late may already be partly outside the visible window. Second, the information that is visible today may not be visible next week, even if nobody touches the account. This is why the preservation of logs should start as soon as the intrusion is discovered, ideally before the formal complaint is drafted.

What access logs can and cannot show

An IP address in an activity log is a valuable clue, but it is often over-interpreted. A forensic acquisition makes the logs verifiable; it does not change what they are able to prove.

The technical work therefore answers questions about existence, time and integrity. Attribution and legal qualification are separate steps that rely on it.

A practical example

The following scenario is hypothetical and simplified.

A small engineering firm learns from a client that an invoice it received by email showed new bank details. The firm never sent that version. Its administrator checks the managing director’s mailbox and finds a rule, created a few weeks earlier, that forwards every message containing the word “invoice” to an external address and deletes it from the inbox. The account’s recent activity page shows sign-ins from a network in another country.

1. Stop the ongoing damage

Because the rule is still active and clients may be paying the wrong account, the firm immediately warns its clients through a separate channel to confirm bank details by phone.

2. Record what is visible

Before touching anything, the administrator takes screenshots of the rule, its conditions and destination, and of the activity page, noting the time. The provider’s security notification emails are kept.

3. Involve a forensic provider

The firm contacts a forensic provider the same day. The acquisition is planned so that the mailbox security pages, the rule, the sign-in and audit logs available to the administrator and the relevant message headers are acquired, hashed with SHA-256 and sealed with a qualified electronic time stamp.

4. Secure the account

Once the material has been acquired, the rule is removed, the password is changed, two-step verification is enabled and active sessions are revoked.

5. Legal assessment and complaint

A lawyer examines the report together with the client’s payment records and advises on the complaint to the police, on informing the bank and on any data protection obligations arising from the incident.

The certification does not reveal who set up the rule, and it does not guarantee that the money will be recovered. What it provides is a verifiable record of what was in the account, how it was configured and from which connections it was accessed, preserved before the logs could expire.

Forensic acquisition, legal advice and the complaint

Three different activities are involved, and it helps to keep them distinct:

• Forensic acquisition preserves and documents the account’s activity, configuration and related messages in a verifiable form. This is the work of a digital forensics provider such as CertifyWebContent.
• Legal assessment determines whether the facts amount to an offence or a civil wrong, which law applies and what remedies are available. This is the role of a lawyer. Within the European Union, Directive 2013/40/EU requires Member States to make illegal access to information systems a criminal offence, but how and within which deadlines a complaint must be filed depends on national law.
• The complaint and the investigation are handled by the police or the competent authority. Only the authorities can normally obtain from providers and network operators the data needed to link a connection to a subscriber.

Preserved, documented material is useful at each stage: it gives the lawyer a stable basis for advice and allows the complaint to refer to precise events rather than to a general description.

Acquisition should concern accounts and data that the client is entitled to access, and only what is relevant to the incident. An account may contain personal data of third parties, and data protection rules such as the GDPR apply to its processing.

How to request the service

CertifyWebContent certifies unauthorized access to email and online accounts: sign-in activity, IP addresses and devices, configuration changes and related messages, acquired with a documented procedure, hashed with SHA-256, sealed with a qualified electronic time stamp and accompanied by a technical report and our FEDIS declaration. The service can be carried out remotely.

You will find the details on the unauthorized account access certification with IP page. For cases specific to mailboxes, such as forwarding rules, Business Email Compromise or phishing, see also our email account breach certification.

To receive a quote, tell us which provider and type of account are involved, when you noticed the intrusion, whether you currently have control of the account and what you have already changed. If the activity logs may soon fall outside the visible window, say so, so that we can assess the timing of the intervention.

Request a quote for unauthorized access certification