4 Gmail Settings to Check Today to Make Sure No One Else Is Reading Your Email
Someone does not need your current password to receive copies of your email. An old forwarding rule or permission you granted years ago could still be working quietly in the background.
That does not mean every unfamiliar setting is a break-in. You may find a former assistant, an old work address, or a connection you set up and forgot. But those leftovers deserve attention.
If you are wondering how to tell if someone has access to your Gmail, start with the four checks below. They help you spot ways someone could read your messages, along with signs of recent account activity. No single screen can prove that nobody else has access.
Before you start: open Gmail on a computer
These checks are easiest in a computer’s web browser, rather than the Gmail phone app.
Open Gmail, select the gear icon, then choose See all settings. The first three checks happen here. For the fourth, you will return to your inbox.
Keep a short note of anything unfamiliar. Do not share passwords, verification codes, or screenshots containing private messages when asking someone for help.
If you use Gmail through an employer or school, some settings may be controlled by your organization. Ask its technology support team about anything you cannot change.
1. Check who has permission to use your inbox
Open Accounts and Import. In some accounts, this tab is called Accounts. Look for Grant access to your account.
This is Gmail’s delegation setting: permission for another person to use your mailbox through their own account. According to Google’s Gmail delegation help page, a delegate can read, send, and delete messages. They cannot change your password.
Delegation is useful when someone is helping manage your email. It also makes forgotten access worth removing. The other person doesn't need to know your current password to keep an active delegation permission.
Check every listed person:
Do you recognize the address?
Does that person still need access?
Is the permission appropriate for your relationship today?
Remove anyone you do not recognize or no longer need. Even a trusted friend’s access should end when the reason for sharing ends.
A general security review is not a substitute for checking this setting. Someone may have deliberately granted an old permission, even if it no longer belongs there.
2. Check where Gmail sends copies of your messages
Check two places because Gmail can forward incoming mail broadly or only messages that match a rule.
Look at automatic forwarding
Open Forwarding and POP/IMAP and find the forwarding section.
Check whether forwarding is enabled and which address receives the messages. An address may be familiar but still wrong for your current life: perhaps a previous job, an abandoned mailbox, or an account you once shared.
If mail is being forwarded somewhere it should not go, disable forwarding and save your changes. A listed forwarding address alone does not necessarily mean forwarding is currently active; read the selected setting.
Look at forwarding filters
Next, open Filters and Blocked Addresses. Review the filters for a Forward it to action.
A filter can forward only certain messages. That could include messages from a particular person or containing particular words. Your inbox may otherwise look unchanged.
Remove unwanted forwarding filters. Also notice unfamiliar rules that delete messages or skip the inbox. Those actions don't prove outside access, but they can explain why important messages seem to disappear.
If sorting out old addresses and permissions becomes confusing, you can take the 2-minute organization test or book a free 20-minute discovery call at Tidy Haus. A digital organizing consultant can help turn the loose ends into a clear plan you can use with us or on your own, at your pace and with your resources.
3. Review connected addresses and sending identities
Return to Accounts and Import. Look for Send mail as and, if it appears in your account, Check mail from other accounts.
These settings do different jobs:
Send mail as lists addresses Gmail can use when you send a message.
Check mail from other accounts, where available, brings messages from another mailbox into Gmail.
Every address should be yours or one you are currently authorized to use. An old business address may be legitimate, but it shouldn't stay connected just because nobody remembered to remove it.
An entry here does not automatically mean someone can read your Gmail. These are connections to review, not a list of people currently watching your inbox.
Watch for unfamiliar sending and reply-to addresses. A reply-to address can direct responses somewhere other than the address the recipient sees as the sender.
Remove connections you no longer need. If a work address is involved, check with your organization before disrupting a shared workflow.
4. Review recent activity, then your Google Account
Return to your Gmail inbox. At the bottom right, look for Last account activity and select Details. You may need to scroll down.
This window shows recent mailbox access information, including access types, times, and IP addresses. It may also show approximate locations. It is not a complete list of named devices or people who have read your messages.
Look for patterns you cannot explain: access at unexpected times, unfamiliar access types, or locations that don't match your activity.
Location alone is not proof. Mobile networks, workplace connections, and privacy services can make an internet connection appear to come from somewhere other than your actual location.
Next, open your Google Account and run Security Checkup. Review signed-in devices and third-party connections. Remove unfamiliar access or connections you no longer use.
These checks complement each other. Account security tools help you review devices and connected services; Gmail’s settings help you find mailbox-specific leftovers such as delegates and forwarding rules.
If something looks wrong, secure the account
If you find access you did not authorize, act promptly from a device you trust:
Remove the access. Delete unwanted delegation permissions, forwarding rules, and connected-service permissions. Sign out unfamiliar devices through your Google Account.
Change your Google Account password. Choose a strong, unique password you don't use anywhere else. Do not assume a password change removes every forwarding rule or permission.
Turn on 2-Step Verification. This adds another check when you sign in. Keep recovery options and backup codes somewhere secure.
Check recovery details. Make sure the recovery email address and phone number belong to you.
Removing access prevents further use through that route. It cannot take back messages someone already copied or downloaded. If sensitive work, financial, or personal information may have been exposed, contact the relevant organization for help.
Keep a small record of access you choose to keep
For each permission or connection you retain, note who or what it is for and when it should end. Do not include passwords.
Review that note when an assistant leaves, a project finishes, or you stop using an email address. Tying the review to a real change is easier than relying on memory—and helps keep yesterday’s useful arrangement from becoming tomorrow’s forgotten access.
Still struggling? Let's find your next step
You don't have to figure everything out alone. Take our 2-minute organization test, or book a free 20-minute discovery call with Tidy Haus.
Here is what you get from your discovery call:
20 minutes with a digital organizing consultant, at no cost to you.
A plan/proposal with solutions for moving forward that you can use with Tidy Haus or without us.
A couple of hints or quick fixes we can show you on the call.
A clear, coherent, and organized plan for moving forward at your pace, with your resources.
Book your free discovery call and let's work out a way forward that fits you.
