Your Gmail Might be Secretly Forwarded: How to Check Email Forwarding Rules and Login Security?

Assess the Risk: Even If Gmail is Being Spied On, You Might Still Be Able to Login

The most troublesome situation with unusual Gmail activity isn't necessarily having your password changed, but rather when the account remains accessible while additional forwarding addresses, filters, or third-party authorizations are set up. If attackers can read your emails, they may gain access to password reset emails, security notifications, payment reminders, or shared cloud document notifications, potentially impacting other accounts.

Therefore, the focus of this article is not to vaguely remind you to 'stay alert,' but rather to break down Gmail security checks into a sequence: first capture suspicious screens, then check email flows, address login devices and authorizations, and finally check other important accounts.

Step 1: Capture Anomalies Before Changing Settings

If you notice unfamiliar forwarding addresses, suspicious filters, unknown login devices, or unrecognized third-party apps, don’t rush to delete them. First, take screenshots of the settings page, suspicious email addresses, rule names, login times, device names, and approximate discovery times. These records can help you later determine the sequence of events and provide evidence if you need to explain the situation to the platform or relevant authorities.

After saving, operate from a trusted device. If you suspect that your current computer or phone may have malware, do not enter a new password on the same device; instead, switch to a clean phone, computer, or browser session.

Step 2: Check Forwarding, POP, and IMAP Settings

Gmail's forwarding settings are the first area to check. You need to confirm whether there are unfamiliar forwarding addresses, especially those you have never set, addresses that resemble gibberish, or external accounts unrelated to your work or backup email. If the forwarding address is not one you set, record the screen and then remove it.

POP and IMAP relate to third-party email software. If you regularly use Outlook, Apple Mail, Thunderbird, or your phone's built-in email app, having IMAP enabled may be normal; however, if you do not use these tools at all and discover access statuses that do not align with your usage habits, this should raise suspicion. The key point here is not to assume that having IMAP means you’ve been hacked, but to confirm that the settings match your usage.

Step 3: Check Filters for Hidden Security Notifications

Gmail filters can be used to organize messages, but they may also be misused to conceal signs of intrusion. You should specifically check whether there are rules dealing with critical emails from Google, Facebook, Instagram, PayPal, banks, exchanges, security notifications, verification codes, and password resets.

Common risks with suspicious rules stem not from the forwarding itself, but rather from automatically marking important emails as read, archiving, deleting, skipping the inbox, or moving them to labels you usually do not check. If the rules were not established by you, save the rule content first, then delete it, and continue checking logins and authorizations, as filters are seldom an isolated issue.

Step 4: Check Google Account Login Devices and Third-Party Authorizations

Gmail is part of your Google account. Even if the email settings appear normal, check recent login activities, currently logged-in devices, backup email addresses, phone numbers, two-factor authentication methods, and third-party app authorizations. Simply signing out of unfamiliar devices is not enough, as they may have already altered other security settings.

Third-party app authorizations are particularly easy to overlook. Many tools ask for access to your Google account, such as cloud drive tools, social media management tools, browser extensions, AI tools, or automation services. Removing unknown or unused authorizations can help reduce the risk of exposing data outside of Gmail.

Step 5: Determine Next Steps Based on Risk Level

If you only find old devices or forwarding addresses you set up yourself, you can typically adjust the settings and continue monitoring. However, if you discover unfamiliar forwarding addresses, suspicious filters, or modifications to your backup data, you should immediately change your Google password, recheck two-factor authentication, log out from unknown devices, and review recent security notifications.

If Gmail may have been accessed by others, check other accounts that rely on this email, including social media platforms, payment tools, cloud drives, YouTube, work systems, and cryptocurrency exchanges. Attackers might not be after Gmail itself, but rather aim to access reset points for other platforms.

Gmail security checks should not stop at 'Can I still log in?' If the flows of emails, important notifications, login devices, third-party authorizations, and account recovery data are still controlled by you, it becomes easier to confirm that the risk has subsided; simply changing the password is usually insufficient to eliminate the backdoors left by forwarding and filters.