How to Tell If Your Yahoo Mail Has Been Compromised

Start by seeing where your account has been used. Sign in to Yahoo on a computer, click your profile icon (top-right) and choose Manage your account:

1. On the Overview page, under Looking for something else?, click View current sign-ins
2. Read down the list — each session shows the device, browser, app and approximate location, and Yahoo flags ones it doesn't recognise as Unrecognised
3. Click Details on anything that isn't you to see its full sign-in history, then click Sign out and confirm

Unfamiliar sign-ins — especially from another country — are the clearest confirmation someone else has been in. You can also review the full log any time at login.yahoo.com/account/activity.

Attackers add their own sign-in and recovery methods so they can get back in — or reset your password — later. From your account, open the Security tab and review everything under Ways of signing in:

1. Go through each method — phone numbers, additional emails, passkeys, authenticator apps and app notifications (the devices allowed to approve a sign-in)
2. Open anything you don't recognise and choose Remove

Leave only the methods and recovery details you set up yourself — anything else is a backdoor.

On Yahoo, every external mail app connects using an app password — there's no separate ‘connected apps’ list. An app password is a long code that lets an app sign in without your password or two-step verification, so any the attacker created is a direct line into your mailbox. Still on the Security page, scroll to External connections:

1. Read through every app password listed — each shows only the name whoever created it gave it, so look for anything you didn't set up
2. Remove any you don't recognise. If in doubt, remove them all — that cuts off every external app at once, and you can recreate the ones you genuinely use afterwards from a device you trust

Because app passwords are the only way an outside app can reach your Yahoo Mail, clearing them means no external app can get in until you deliberately set one up again.

To quietly route a copy of your mail to themselves, an attacker needs to connect a mailbox and switch on auto-forwarding — and auto-forwarding is a paid Yahoo Mail Plus feature. So this is really only a concern if you subscribe to Mail Plus. If you do, open Yahoo Mail on the web and click More (bottom of the left sidebar) → Settings → Mailboxes:

1. Switch off any Auto-forwarding you didn't set up
2. Remove any connected mailbox or send-only address in the Mailbox list that you don't recognise

Your own Yahoo address will always be in the list — anything beyond it that you don't recognise should go.

Still in Settings, open Filters from the left menu. Filters can auto-move, archive or delete incoming mail, so attackers use them to bury security alerts:

1. Read every filter and what it does — be suspicious of broad rules like ‘if From contains “@”’, which quietly matches almost every email you receive
2. Click any filter you didn't create to open it, then choose Delete (bottom right)

A rogue filter that sends your mail straight to Archive, Trash or Spam is a classic way to hide a break-in — and they're often named something blank or meaningless to blend in.