Someone is viewing my emails without my knowledge

Question

How do I find out if there is some hacker trying to read my emails without my knowledge?

If confirmed, what steps should I take or follow?

Will changing my password keep them away forever or is that just a temporary fix?

Are my photo and email attachments private and accessible only to me or should I be worried about them gaining access to those?

Answer 1

Speaking as someone who reads other people's email as part of my job, it really, really, REALLY depends on what your mail environment looks like.

The short answer is:

If they don't want you to know, generally there is a way to prevent you from knowing about it.

Some examples:

Exchange with Outlook
The system does track the Last Logged In user for a mailbox, but that attribute isn't easily viewable without the Admin Tools. The Admin Tools that would be used to view the same mailbox.

Generic IMAP4 + Thunderbird
Unless the mail administrators have taken the effor to publish your last login list somewhere, the only way you'll know is if mails get their read/unread status changes, or mail moves mysteriously.

GMail
Google does in fact publish the last few IP addresses that logged into the account. Its at the bottom of the page. Check that, and if you find addresses you don't know about, it's a good sign that something strange is going on.

Generic Corporate email systems, not just Exchange
All incoming mail is copied to a specific address. Or perhaps only people of interest. Since this copy happens while the mail is still just a text-file in a mail-spool somewhere, you'll never know. This kind of setup is very, very common in E-mail Archiving setups.

---

Steps to take
Changing your password is a good first step if the mail is being monitored by an actual login. It won't help if the mail is being copied out of a mail-spool before it actually gets into your mailbox; there is exceedingly little you can do about that scenario. If it happens again after your password has been changed, then something else is going on, and it's time to take it up with your mail administrator.

Answer 2

There is no way to prove someone is not viewing your email, you can only prove they are. One way to confirm if they are, even when you cannot see IP addresses connected to the mail server, is to trick them into alerting you.

Make an email with a link. You need to be able to monitor visits to that link. This could be a server you maintain and can check logs, or just a public website where you can see visitors to the pages. Obfuscate the link, if useful, with tinyURL or some other service. Send the email to yourself from an interesting account. Add text around the link that makes it even more interesting and very very hard to not visit the link to see what is there.

Be careful that what you think are "secret" webpages are often found and visited by web crawlers. With this caveat in mind, if the link gets visited, and it isn't by you, then maybe someone read the email.

Answer 3

There is simply no way to know as it could happen at any level.

I manage a server for a few clients and host their emails - a few times I have needed to go in to their mailboxes (at their request) to for general support, or retrieve a deleted message etc. There has to be trust between you and your host because they will have full access to everything.

As for hacker, they could get a job at your host! Other than that, they could always be viewing your messages - SMTP/POP3, they could simply be downloading and IMAP, viewing and then resealing or just not marking as read to begin with.

Gmail and a few other places allow you to see logs of who has last accessed your mailbox and you can always ask your host the same (if you use Hotmail or a host that has many accounts, I wouldn't expect an answer).

The only true secure way where only you would have access is to host the email server yourself, restrict access to your ip (or monitor logs regularly). Even this could still allow someone to view if they have a trojan on your own machine, but I don't want to send you down the paranoia route as this would still be the best solution.

As for what to do, honestly, unless you are a celebrity, politician or some sort of public figure/well known person, I doubt anything will be done - even if you provide all the logs/evidence. You can always go to your local law enforcement and try to show them - if it is someone out to get you/stalker, it could be something bigger that they would be willing to help with.

Answer 4

There is a good answer here.
It said: DMARC also helps in detecting attacks against your domain by allowing you to supply an email address where you will receive a statistical report of how many emails have failed the DKIM signature check. ...
And DMARC must be used with DKIM, both of which have been offered by GMAIL and some big names (in 2016 Aug).

Answer 5

Mankoff had by far the best idea. Use bit.ly to both mask and time how many clicks the link has received and base your findings off this data. This isn't the most intricate or absolute way; however, is the easiest with immediate results.