A security alert in Gmail is a prompt to check the settings that quietly control where your mail goes and who can see it. This guide walks through a focused audit of forwarding, filters and delegated access. It does not assume a breach; it gives you a repeatable way to compare what you see against what you expect, and to act on anything unfamiliar.
Step 1: Establish a baseline of expected settings
Before changing anything, write down what you expect to be there. Open Gmail settings and record:
- Any forwarding address you set up yourself.
- Any filter you created, especially ones that forward, delete or mark as read.
- Any delegate who should have access to your mailbox.
- Whether POP or IMAP access is enabled and why.
A baseline turns a vague feeling of unease into a comparison. If you cannot remember setting something up, treat it as unfamiliar until you can confirm otherwise.
Step 2: Audit forwarding and POP/IMAP
In Gmail settings, review the Forwarding and POP/IMAP section. Look for a forwarding address you do not recognise, and for POP or IMAP being enabled when you never turned it on. These settings can move copies of your mail outside your mailbox.
Filters using Forward to or Delete it and forwarding, POP and IMAP settings can affect where messages go. Source
If you find an unfamiliar forwarding address, remove it and save the change. Then check whether any filter also forwards mail, because removing one setting does not remove the other.
Step 3: Audit filters, including Send mail as
Filters are rules that act on incoming mail. A filter that forwards to an outside address, or deletes messages matching a pattern, can hide activity from you. Review every filter and read the action, not just the name.
Also review the Accounts and Import section for Send mail as addresses. An unfamiliar address there can be used to send mail that appears to come from your account.
Google recommends checking unfamiliar Send mail as addresses and delegated access when reviewing suspicious Gmail access. Source
For each unfamiliar entry, note what it does, when it may have been added, and whether removing it would break a workflow you rely on. Remove only what you cannot explain.
Step 4: Audit delegated access
Delegation lets another account read and send mail on your behalf. In the Accounts and Import section, review the list of delegates. A delegate you did not add, or no longer recognise, should be removed. Removing a delegate does not delete the other account; it only ends that access.
Delegated access is different from forwarding. Forwarding sends copies; delegation gives ongoing access. Check both, because fixing one does not fix the other.
Expected versus unfamiliar entries
The table below is a decision aid. It does not prove who added a setting; it only helps you sort what to keep, question or remove.
| Setting | Expected entry | Unfamiliar entry | Follow-up |
|---|---|---|---|
| Forwarding address | An address you set up and still use | An address you do not recognise | Remove it, then recheck filters |
| POP/IMAP | Enabled only if you use a mail client | Enabled with no known client | Disable it and review connected apps |
| Filter action | Labels, stars or archives you created | Forwards, deletes or marks as read | Read the full action and remove if unexplained |
| Send mail as | An alias you created | An address you never added | Remove it and review sent mail |
| Delegate | A person you knowingly granted access | A delegate you cannot identify | Remove access and change your password |
Use the table as a checklist, not a verdict. A setting can be unfamiliar and still be legitimate, for example one added by a family member or a former assistant. Confirm before you remove.
Common mistakes
- Changing the password only. A password change does not remove forwarding, filters or delegates. Audit the settings as well.
- Removing a filter but leaving forwarding. These are separate controls. Check both.
- Treating a removed delegate as a deleted account. Removing access ends that connection; it does not delete the other account or its data.
- Assuming an empty profile means deletion. An edited or empty profile does not establish that stored data has been deleted.
- Skipping Send mail as. An unfamiliar sending address can be missed if you only review filters.
- Acting on a public username match as proof. A public match is a lead, not proof of ownership.
Protecting your own footprint
After the audit, reduce what can be changed without your knowledge. Use a recovery method you control, and keep it active until you have finished any account closure. Do not delete recovery options before closure is complete. If you are closing an account, preserve access until the process is finished.
Review connected apps and third-party access, and remove anything you no longer use. Then look at your public footprint. If your email address or a username appears in public profiles, a username search can show where a handle is in use. TraceSeek checks 3,000+ platforms and returns results in 20-30 seconds, with a free first scan that does not require registration or login. Those results are public matches, not proof of who owns an account, and TraceSeek cannot change Gmail settings or expose private records.
For a broader review of where an email address may be linked, see /guides/find-accounts-by-email-address/. For older accounts you may have forgotten, see /guides/find-forgotten-online-accounts/.
Key facts
- Google recommends checking unfamiliar Send mail as addresses and delegated access when reviewing suspicious Gmail access.
- Filters using Forward to or Delete it and forwarding, POP and IMAP settings can affect where messages go.
- TraceSeek checks 3,000+ platforms and returns results in 20-30 seconds, with a free first scan.
- A public username match is a lead, not proof of account ownership.