How to Find Out Who Hacked Your Yahoo Email

Co-authored by Luigi Oppido

Last Updated: October 1, 2022

If you feel suspicious that your Yahoo Mail has been hacked, you can do some basic investigation to confirm your doubts. Yahoo Mail keeps a record of all your account’s recent activities, including your login information. If you see something wrong, you can drill down further and get the location and IP address, which you can use to find out who hacked your email account.

Part 1

Part 1 of 2:

Checking Your Account History

1
Go to Yahoo Mail. Go to the Yahoo Mail login page and sign in. Log in using your Yahoo ID, or username, and password in the two text boxes provided. Click Sign In to proceed to your mail account.
2
Access your Account Info. Click the gear button on the top right corner of your Yahoo Mail to bring down the Settings menu. Click the “Account Info” link from here. You will be brought to your Yahoo account data.

Advertisement
3
View the Recent Activity. Click the “Recent Activity” menu from the left panel. All the recent activities made by your Yahoo account will be displayed. Most items here will involve your login or session records, since Yahoo keeps track of these.
4
Review recent activities. Look at all the activities listed on the Recent Activity menu and see if there’s anything out of the ordinary. Check and verify if you are the one who made all these. Yahoo keeps a record of your sign-in history for the past 30 days.
5
Open a record. If you see something suspicious—for example a sign in from a device or a location you didn’t know of—click the record for the activity. A small window will appear displaying the sign-in history under the device for the location for the last 30 days.
6
Get the IP address. The IP address for every sign in is recorded with each entry. You can then use this to track your hacker, since IP addresses are unique. You may need to work with your local Internet service provider and/or law enforcement agency to track down the IP address’ exact location and your hacker.
- It is very unlikely that you will be able to track down the individual who hacked your account via the IP address. The chances are good that a person wasn’t even involved, and that your account was compromised by an automated hacking program. The best thing you can do is change your password to prevent future hacks.

Part 2

Part 2 of 2:

Preventing Future Attacks

1
Change your password. If you’ve confirmed that someone else has access to your Yahoo account, immediately change your password to stop it. Click the “Change your password” link at the top of the page to quickly start the process. You will be brought to the password change page. Enter your new password and save it.
2
Check your recovery account. You can have a recovery account associated with your Yahoo account. Make sure that this account is secured as well, and that it is an account you control. You can change this from the “Account security” section of the Yahoo Mail Settings.
3
Turn on two-step verification. This is an additional layer of security. Yahoo will send you a text message whenever you log into your account. You’ll need to enter the code you receive in order to access the account. This will prevent unauthorized users from accessing your account information.

Image titled Find Out Who Hacked Your Yahoo Email Step 9

Community Q&A

Question

Sometimes my current session is shown as being at a location over 30 minutes away from where I am, while past sessions correctly reflect my location. Is this a sign I'm being hacked?

Community Answer

Mine never shows the exact town I'm in; instead, it registers different nearby towns in my state. The sign in time is always right. The change of address might be due to your internet provider using proxy addresses.
Question

Why does Yahoo show that my account was active somewhere I've not been?

Community Answer

It's possible that someone in that location logged into your account without authorization.
Question

What is an IP address?

Community Answer

An IP address is a unique string of numbers separated by periods identfying each computer using the Internet Protocol to communicate over a network.