You can have a strong password, two-factor authentication and a spotless Google Security Checkup and still have another person quietly sitting inside your Gmail inbox. The culprit is a little-known Gmail feature called delegation. It lets you give another Google account direct access to your inbox without sharing your password.
That person can read your emails, send messages from your account and delete messages. And because they sign in through their own Google account, changing your password or turning on 2FA won’t kick them out. The really sneaky part is that Gmail doesn’t automatically expire the permission, and personal accounts don’t show you when a delegate opens your inbox.
Your Gmail password is not the whole story
Gmail delegation is designed for legitimate situations. Maybe you are sharing a business inbox with a colleague or letting an assistant manage your email. The problem is forgetting that you ever turned it on.
A delegate can access your entire inbox from their own Gmail profile. They don’t need your password, and they don’t have to pass through your two-factor authentication. So if you gave someone access years ago for a project that no longer exists, that permission can just sit there. And Google’s regular Security Checkup won’t necessarily flag it.
Someone could be reading your inbox without you knowing
Delegates can read conversations, send emails and delete messages. Gmail also has a setting that determines whether messages opened by a delegate are marked as read. If that option is enabled, someone could potentially browse through your inbox without leaving the usual “unread” clues.
It gets worse for personal Gmail accounts, as you can’t see whether a delegate has actually been reading your messages. The Last account activity page does not record delegate sessions, either. Google Workspace accounts have more auditing capabilities, but personal Gmail users don’t get the same visibility.
Here is what to do
To start, know that you will need to do this from Gmail on the web. The delegation setting isn’t available in the mobile app. On a desktop or laptop, open Gmail and click the gear icon in the top-right corner. Select See all settings and navigate to Accounts and Import. Find Grant access to your account and look through the list of delegates. If you see someone you don’t recognize or simply don’t need anymore, click delete next to their address. The change takes effect immediately.
While you are there, check the options underneath the delegation section. They control things like whether messages opened by a delegate are marked as read and how messages sent by a delegate appear.
Changing your password is not a fix
Because a delegate uses their own Google account, their access isn’t dependent on your Gmail password. That means changing your password won’t remove them. Enabling two-factor authentication would also not help.
So you can spend five minutes strengthening your login security and still leave an old delegate with access to your inbox. That is why this particular setting is worth checking every so often, especially if you have ever shared an inbox with a coworker, friend, assistant or collaborator.
Source: Make Use Of