Hack Email Software: How Accounts Really Get Taken

If you searched for "hack email software", you probably want one of two things. Either you want a program that breaks into an email account, or you're worried someone used one on yours. The answer to both is the same. The downloadable "email hacker" mostly doesn't exist, and the programs sold under that name are usually scams or malware aimed at whoever downloads them.

Accounts do get taken, though. It just happens in dull ways (a reused password, a fake login page, a stealer on a laptop), and you can check for each of them yourself. The inbox checks below take about ten minutes.

Why "hack email software" is mostly a trap

Search for it and you'll find sites that promise to crack any Gmail or Outlook password. You download a tool, type in the address, then pay or fill in a "human verification" survey. Think about who's offering this. Someone happy to break into strangers' accounts isn't running an honest software shop.

What these downloads usually turn out to be:

• Payment and survey scams. You pay or fill in offers and nothing arrives. Or the fake progress bar stops at 99% and asks for more money.
• Malware dressed up as a hacking tool. The "tool" is a password stealer or a remote access trojan. So the person who ends up with a hacked inbox is the one who ran the download.
• A crime, even when it isn't a scam. Getting into an account that isn't yours without permission is illegal in most countries (the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK). "It was my partner's account" or "I was only checking" doesn't change that.

If you're locked out of your own account, the only route that works is the provider's own recovery process, such as Google's account recovery page or Microsoft's account recovery form. No outside tool can do something those can't. Anyone charging for "email recovery software" is running the same scam with a nicer website.

How email accounts actually get broken into

Takeovers come through four ordinary routes.

Your password leaked from a different site

A site you joined years ago gets breached, and your email and password end up in a dump. Attackers feed those pairs into automated tools that try them on Gmail, Outlook, Yahoo and everything else. This is called credential stuffing. If your email used the same password, they're in. It catches people off guard because the breach didn't happen at their email provider.

A fake login page

You get a message saying your mailbox is full, a parcel is waiting or someone shared a document with you. The link opens a page that looks just like a real sign-in screen. Whatever you type goes straight to the attacker. Better phishing kits pass your two-step code along in real time as well, which is why passkeys and app prompts beat codes sent by text. A passkey can't be typed into a fake page at all.

A password stealer on your own device

This is the nearest thing to real "hack email software", and it runs on the victim's computer, not the attacker's. Infostealer malware gets in through cracked software, game cheats, fake updates and, yes, fake hacking tools. It copies the passwords saved in your browser along with your session cookies. Those cookies can let someone into your inbox without your password or your two-step code. Changing your password won't do much until the device is clean.

Account recovery is weaker than the account

Say your recovery email is an old address you no longer use, or your mobile carrier can be talked into moving your number to someone else's SIM. Then an attacker can reset your password through the normal recovery process. It's worth checking where your recovery options actually point.

Signs someone is in your email right now

Some takeovers are loud: the password gets changed and you're locked out. Others are quiet, because an inbox that still works is worth more to an attacker than one that's locked. Look for:

• Sign-in or "new device" alerts you don't recognize, or alerts that have been deleted (check Trash).
• Sent messages you didn't write, or friends asking about an odd link you supposedly sent.
• A forwarding address, filter or rule you didn't set up. A favorite trick is a rule that forwards everything, or that quietly archives security and bank emails so you never see them.
• Password reset emails from other services that you didn't ask for. That's someone using your inbox as the key to your other accounts.

Where to check:

• Gmail: Google Account, then Security, then "Your devices" and "Recent security activity". In Gmail on a computer, the "Details" link at the bottom right of the inbox shows recent access. Then check Forwarding and Filters in Settings.
• Outlook and Microsoft: go to account.microsoft.com, then Security, then sign-in activity. In Outlook settings, check Rules and Forwarding.
• iCloud: Settings, tap your name, then scroll to your device list.

If you see a session you don't recognize, change the password and use the option to sign out of all other sessions. Then delete any rules or forwarding you didn't create.

If a stealer is likely (you recently ran a cracked app, a free cheat or anything from a forum), clean or reset that device first. Then change your passwords from a different device you trust. If you don't, the new password just gets stolen too.

Checking whether your old passwords are already out there

Looking inside your inbox tells you what's happening now. A breach check tells you about the route most likely to hurt you next: an old password sitting in a dump.

Free tools handle part of this well, and you should use them. Have I Been Pwned, run by security researcher Troy Hunt, shows for free which known breaches your address appears in. Google Password Manager's Password Checkup and Apple's Passwords app both flag saved passwords that have turned up in leaks.

What a free breach list usually won't tell you is which password leaked. Knowing your address was in some old forum breach helps less than knowing the leaked password is the one you still use for your bank. LeakNix looks your address up in two breach indexes, merges the results and shows you the actual leaked password wherever the source data had one, so you know exactly which logins to change. A clean result means nothing was found in what's been indexed, not that nothing exists. LeakNix, like the free checkers, searches breach data that has already surfaced. The full report is a one-off payment, not a subscription. If you'd like to know how these lookups work first, read how to find a leaked password by email.

Two things most people never check

The first is apps you've given access to your account. When you click "Sign in with Google" or let a calendar or email app connect, that app gets a grant that can outlive a password change. In Google, look under "Your connections to third-party apps and services". On Microsoft, go to account.microsoft.com, then Privacy, then "Apps and services that can access your data". Remove anything you don't recognize or no longer use.

The second is your phone number. If your carrier will move your number to a new SIM for anyone who calls with a convincing story, every text code and recovery message goes with it. Call your carrier and ask for a port-out PIN or SIM lock. It takes one phone call and closes the recovery route described above.

If your address has already shown up in a breach, what an email data breach means and what to do goes through it one step at a time.

Once your inbox is locked down, put your address into the free scan and see which breaches it turns up in. That's the list of passwords to change next.