Google Account Hacked: How to Recover It and Lock It Down Afterwards

To recover a hacked Google Account, go to Google's account recovery page and answer the questions as best you can: there is no limit on attempts, and wrong guesses do not end the process. Once you are back in, change the password, review recent security events and devices, check Gmail for forwarding rules and filters you did not create, and turn on 2-Step Verification.

Who this is for and what you will have at the end

This guide is for anyone whose Gmail or Google Account has been taken over, or who suspects it has: a changed password, a changed recovery phone, strange sent mail, or sign-in alerts you did not cause. At the end you will have regained access (or know the limits of what is possible), removed the attacker's footholds, and tightened sign-in so it is much harder to repeat.

The steps follow the Google Account Help pages in the References. Google changes its menus, so use the page titles as a guide if a label differs. This article covers personal Google Accounts. For a work or school account, ask your administrator, since Google notes those accounts may not work with the standard recovery steps.

Step 1: Try to get back in

If you can still sign in, skip to Step 2. If you cannot:

1. Open the account recovery page at accounts.google.com/signin/recovery. If you are unsure which account you use, try recovering your username first.
2. Answer the questions as best you can. Google says wrong guesses do not end the recovery process and there is no limit to the number of times you can attempt it.
3. When asked for a password, enter the most recent one you remember, or an older one if that is all you recall.
4. Reset your password to a strong one you have not used on this account.

Tips that improve the chance of success

Google's page "Tips to complete account recovery steps" advises:

• Answer as many questions as you can and do not skip any. Make your best guess when unsure.
• Use a familiar setup: the device, browser and location you normally sign in from.
• Enter passwords exactly, watching for typos and capitalization.
• Give a backup email if you can: a recovery, alternate or contact address you added to the account. If you cannot access a verification code sent to your account's email, choose Try another way.
• Check your spam or junk folder for an email titled "Your Google support inquiry".

Google also notes that changes to recovery information can take up to 7 days to take effect, so if you changed it recently and recovery fails, retry in a few days.

Do not trust anyone offering recovery help

Google says it cannot help you sign in by phone and does not work with third-party services that offer account or password support. It also states that it never asks for your password or verification codes over email, phone call or message. A "recovery specialist" who contacts you, or a number in a search ad, is a second scam, not help. Do not share your password or any verification codes.

If recovery fails

Google's page says that if you still cannot recover the account, you can create a new Google Account. A permanently deleted account cannot be recovered; for a recently deleted one, use Google's deleted-account recovery steps. Tell people who may receive mail from the old address, and change the passwords of accounts that used it for sign-in, which Step 5 covers.

Step 2: Review what happened

Once in, look at what the attacker did before you change settings, because it tells you what else to fix.

1. Open your Google Account and select Security & sign-in (or Security).
2. Under "Recent security events", select Review security events.
3. If you see activity you did not make, select No, it wasn't me and follow the on-screen steps.

Then check devices:

1. In your Google Account, select Your devices, then Manage devices.
2. For any device you do not recognize, select Don't recognize a device? and follow the prompts to remove it.

Step 3: Change your password

Change your Google Account password right away if you have not already. Google's guidance then says to change the password on any other site or app where you:

• reused the same password,
• are contacted through your Google Account email,
• sign in with that email, or
• saved passwords in the Google Account.

Use Google's Password Checkup to find weak or exposed passwords. A password manager makes unique passwords easier; the point is that a reused password turns one breach into many.

Step 4: Turn on 2-Step Verification and add a passkey

Google describes 2-Step Verification as requiring a second factor, such as a phone, security key or code, in addition to your password, so a stolen password alone is not enough. Turn it on if it is off, and check that the methods listed are ones you set up. Our guide on enabling two-step verification for Google, Microsoft and Apple walks through it.

Passkeys

A passkey is a sign-in method that can replace your password. Google's page says you confirm it with your fingerprint, face scan or phone screen lock PIN, and that, unlike passwords, passkeys cannot be shared, copied, written down or accidentally given to someone else, which makes them more resistant to phishing. If your account uses 2-Step Verification, a passkey also counts as the second step.

To create one:

1. Go to myaccount.google.com/signinoptions/passkeys.
2. Select Create a passkey and unlock your device.

Do not create a passkey on a shared device. Google notes a new passkey may take up to 7 days before it works at sign-in. To manage them, go to Google Account > Security & sign-in > Passkeys and security keys. If you lose a device, sign in on another and remove its passkey.

Step 5: Verify recovery settings and look for foothold changes

Attackers often change recovery details so they can return. Correct any unfamiliar changes to:

• Recovery phone and recovery email
• Alternate or contact email
• Account name
• Security question
• 2-Step Verification settings and methods
• Location Sharing (turn off anything unusual)

Check apps with access

Under the Google Account permissions page, use Review apps with access to remove apps you do not recognize.

Check Gmail settings

Google lists these Gmail settings to review for anything you did not set up. Remove what is unfamiliar:

Forwarding and filters are worth special attention. They can quietly copy password-reset emails or hide security alerts even after you change your password.

Review other Google products

• Chrome: Remove extensions you do not recognize and update Chrome.
• Drive: Review activity and file versions.
• Photos: Stop sharing any albums you do not recognize.
• YouTube and Blogger: Check for uploads, posts or messages you did not make.

Step 6: Check money and identity

Google's guidance covers financial activity linked to the account:

1. Review Google Pay, Google Play, Chrome payment info, Google Ads and AdSense.
2. Report unauthorized charges and remove payment methods you do not recognize.
3. If you use AdSense, check that payments go to the correct bank account.
4. If your bank details or personal documents are saved in the account, or someone may be impersonating you, contact your bank or local authorities.

If personal details could have been exposed, consider a credit freeze. See our guide on credit freeze vs fraud alert. If the attacker used your account to ask your contacts for money, tell them, and see what to do after sending money to a scammer.

Step 7: Clean the device

If the attack began with malware or a fake sign-in page, changing the password on an infected computer will not help.

1. Run trusted anti-virus software. If needed, back up your files first, then consider resetting the computer and reinstalling the operating system, as Google's page suggests.
2. Use a secure browser, and consider Chrome's Password Alert, which warns you when you enter your password on a non-Google site.
3. Use your device's screen lock.

How accounts usually get taken, and how to avoid it

Without describing methods in detail, the common themes are a reused password from an unrelated breach, a sign-in page reached through a link in a message, and a code given to someone who asked for it. The defenses match: unique passwords, a passkey or 2-Step Verification, going to the sign-in page yourself, and never sharing a verification code. Google states it never asks for them.

Troubleshooting

• Google says it cannot verify the account is yours: this usually means recovery details were missing or changed. Try again from a familiar device and location, add a backup email, and retry after a few days if recovery information changed recently.
• No verification code arrives: check the recovery email's spam folder, and choose Try another way if you cannot access it.
• A work or school account: ask your administrator.
• You are still locked out: keep trying, since attempts are unlimited, or create a new Google Account and move to it.

Checklist

• Recover at accounts.google.com/signin/recovery, answering every question.
• Review security events and remove unknown devices.
• Change the password and any reused passwords elsewhere.
• Turn on 2-Step Verification and create a passkey.
• Fix recovery phone and email, and review apps with access.
• Remove unfamiliar Gmail forwarding, filters, delegation and send-as addresses.
• Check payments, then clean your device.

References

• Google Account Help, Secure a hacked or compromised Google Account: https://support.google.com/accounts/answer/6294825
• Google Account Help, How to recover your Google Account or Gmail: https://support.google.com/accounts/answer/7682439
• Google Account Help, Tips to complete account recovery steps: https://support.google.com/accounts/answer/7299973
• Google Account Help, Sign in with a passkey: https://support.google.com/accounts/answer/13548313