Signed-in devices are only one way into your inbox. Delegates, forwarding rules and linked apps can read your mail too, and most people never look.
To check who has access to your Gmail, start with Google's Security Checkup: review signed-in devices, remove old third-party apps and confirm your recovery details. That part takes about two minutes, and it catches the obvious problems, such as a lost phone that's still signed in.
Then look inside Gmail's settings on a computer, where two less obvious ways in hide. Delegates, listed under Accounts and Import, can read, send and delete your mail. Forwarding rules and filters can copy your messages to someone else without them ever signing in.
Here’s how to check who has access to my Gmail, or yours: open Google’s Security Checkup and review your signed-in devices and connected apps, then look inside Gmail’s settings for delegates and forwarding rules. The first part takes about two minutes. The second part is the one almost everyone skips, and it’s where a quiet snooper is most likely to hide.
Why bother? A stranger signed in on a phone is the obvious risk, but it isn’t the only one. Someone can read every email you get without ever signing in, simply by setting up a forwarding rule while they had your password. An old app you connected years ago may still be able to read your inbox. Google has just nudged people to run its checkup, so here is the full version, step by step.
Go to your Google Account, choose Security & sign-in, then under Your devices pick Manage all devices. You’ll see every phone, computer and tablet that’s signed in now or was in the last few weeks.
Don’t panic at every unfamiliar line. One device can show several sessions, because a new session starts each time you sign in on a new browser, use a private window, re-enter your password or grant an app access. Times can look newer than your last visit, too, because apps sync in the background. A nearby town instead of your exact location is normal. A different browser you never use, or a place you’ve never been, is not.
Next, open the linked apps page in your Google Account. It splits connections into three kinds:
There’s a newer filter worth checking as well: Agent access. It shows apps that Gemini or other Google AI agents can use on your behalf, and you can stop an agent from using any app without unlinking it.
Gmail lets you hand your inbox to another person as a delegate. A delegate can read, send and delete your email, though they can’t chat as you or change your password. A personal Gmail account can have up to 10 of them, and nothing on your phone tells you they exist.
To check, open Gmail on a computer (you can’t do this in the app), click Settings, then See all settings, and open Accounts and Import. Look at the section called Grant access to your account. If there’s an address there you didn’t add, click Delete next to it and change your password straight away. On a work or school account, your admin may have added delegates, so ask them before removing one.
Forwarding is the silent way in. In the same Settings page, open Forwarding and POP/IMAP. If a forwarding address is listed and you didn’t set it, choose Disable forwarding and save.
Then open the Filters and Blocked Addresses tab. A filter can forward only certain messages, such as anything containing the word invoice or password, which is harder to spot than full forwarding. Delete any filter you don’t remember making.
Gmail does help here. For the first week after forwarding or a forwarding filter is switched on, it shows a notice saying your mail is being forwarded. If you see that and didn’t set it up, Google says to change your password immediately.
At the bottom of your Gmail inbox on a computer, next to Last account activity, click Details. This page shows whether you’re signed in to Gmail somewhere else right now and how each session connected, such as a browser, a phone or a mail program using POP or IMAP. It lists the last 10 IP addresses and rough locations that opened your account, and up to 3 more flagged as suspicious if Google warned you about something.
Some odd entries have innocent causes. Reading Gmail in Apple Mail or Outlook adds their locations, and a mobile carrier can make you appear far from home. Also visit Recent security events in your Google Account and answer No, it wasn’t me for anything you don’t recognize.
Your Gmail is often the master key to everything else, because password resets for banks, shopping and social media land there. If you find a device, app, delegate or forwarding rule you didn’t set up, work in this order:
Doing this every few months, or whenever you replace a phone, keeps the list short and makes anything strange easier to spot.
Yes, if they set up forwarding or a forwarding filter while they had access. Check the Forwarding and Filters tabs in Gmail’s settings.
Click Details next to Last account activity at the bottom of your inbox, or check Manage all devices in your Google Account.
No. Signing out a device ends that session, but you should still change your password if you think someone else had it.
You're reading the quick version.
Read next
How to set up passkeys and stop typing passwords for good
Passkeys let you sign in with your face, fingerprint or PIN, and they can't be phished or pasted into a chatbot. Here's how to start without getting locked out.
Strava subscribers in the US can now let Gemini read their workouts. Here is the setup, what Gemini can see, and where its answers fall short.
Microsoft's new recovery option reinstalls Windows on a PC that won't even start, no USB stick needed. It also wipes everything, so read this first.
Google's Gemini app now lets you build a PDF in the chat, then type changes or highlight a passage for the AI to rewrite. Here's how, and where it stops.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
