How to Recover a Hacked Gmail / Google Account

Last updated: October 8, 2026

Step-by-step flow for recovering and securing a hacked Google account, from a familiar device to a final security checklist

A Google account is more than an inbox. It can hold your photos, documents, contacts, saved passwords, YouTube channel, phone backups and the "sign in with Google" links to dozens of other services. If someone takes it over, the damage can spread fast, so it is worth moving carefully and quickly.

This guide covers how to tell whether your Google account was compromised, how to use Google's official recovery process, and how to clean up and secure the account afterward. Google changes the layout of its account pages from time to time, so menu paths are described generically.

Signs Your Google Account May Be Compromised

Your password stops working, or you are asked to verify your identity more than usual.
Google sends security alerts about a new sign-in or device you do not recognize.
Your recovery email or phone number was changed.
Sent mail contains messages you did not write, or messages you sent are missing.
Emails are being forwarded elsewhere, or filters have appeared that you did not create.
You notice password-reset emails for other services that you did not request.
Friends receive spam or requests for money from your address.

Step 1: Try to Sign In and Use Google's Recovery Tool

If you cannot sign in, go to Google's account recovery page at accounts.google.com/signin/recovery, or use the "Forgot password?" link on the Google sign-in page. Google's help article How to recover your Google Account or Gmail explains the process. Check that the address in your browser belongs to Google before entering anything. Google says it never asks for your password or verification codes by email, phone call or message, and that you should only enter them at accounts.google.com.

Tips from Google's account recovery tips page that improve your chances:

Use a device and location you have used before. Recovery works best from your usual phone or laptop, on your home Wi-Fi, in the browser you normally use.
Enter the last password you remember. Even an old password can help Google confirm it is you.
Answer every question you can. Google advises not to skip questions; if you are unsure, take your best guess rather than moving on. It may ask about passwords you used before, or the email addresses and phone numbers you have added. Be exact with passwords, including uppercase and lowercase letters.
Use a phone you were already signed in on. Prompts on trusted devices are often the easiest way through.
Do not give up after the first fail. Google says wrong guesses do not end the recovery process and there is no limit on attempts. If you see "Google couldn't verify this account belongs to you", Google says you can try again. Try on another trusted device.
Check your spam folder. If you expect a reply from Google, look in spam or junk for an email titled "Your Google support inquiry".

If recovery succeeds, you will be asked to create a new password. Use a strong one that you have never used elsewhere. Our guide to creating a strong password you can remember can help.

Forgot Which Gmail Address It Was?

Google has a separate path for finding your username. According to its help page, you need a phone number or the recovery email address for the account, plus the full name on the account. After you confirm it is yours, Google shows a list of usernames that match.

Which Route Fits Your Situation?

Your situation	What to do
You can still sign in	Change your password, then go to Step 2
Password changed, recovery phone or email still yours	Use accounts.google.com/signin/recovery and get a code
Recovery details changed too	Use the recovery page from a familiar device, browser and location; answer every question
You do not remember the address	Use Google's "Forgot email" path with your recovery phone or email and full name
Recovery keeps failing	Retry later; as a last resort, create a replacement account (see below)

Step 2: Sign Out Everywhere and Check Devices

Once you are back in, open your Google Account page (the "Manage your Google Account" option from your profile picture) and go to the security section. Google's page on securing a hacked or compromised account describes two checks:

Recent security events: select Review security events. For any activity that did not come from you, choose No, it wasn't me and follow the on-screen steps to secure the account.
Your devices: open Manage devices. For any device you do not recognize, choose Don't recognize a device? and follow the steps.

If you are unsure, you can sign out of everything and sign in again on your own devices. Our guide on checking which devices and apps have access to your account has more detail.

Google also offers a Security Checkup tool inside the same security area. It walks you through recent security events, recovery information, connected apps and saved passwords. Run through it and fix whatever it highlights.

Step 3: Review Recovery Options

Check the recovery phone number and recovery email address. Attackers often add their own so they can get back in. Remove any you do not recognize and confirm the correct ones are set. Make sure your recovery email account is itself secured, as it can be used to reset yours.

Step 4: Check Gmail for Hidden Changes

Hackers frequently leave settings behind that continue to harm you even after the password changes. Our general guide to telling whether your email has been hacked lists the same signs for any provider. Open Gmail's settings (the gear icon, then "See all settings") and check each item Google lists:

Mail delegation: Google's delegation help page says a delegate is someone who can read, send and delete emails in your account. Check Accounts and Import → Grant access to your account and delete anyone you did not add. This setting is easy to miss.
Forwarding and POP/IMAP: Look for a forwarding address you do not recognize. Remove it.
Filters and blocked addresses: A filter could be silently deleting or forwarding messages, such as security alerts or bank emails. Delete anything suspicious.
Vacation responder or auto-reply that you did not enable.
Scheduled emails: look in the Scheduled folder for messages set to go out later.
Your name in Gmail and the address shown on outgoing mail.
Labels you did not create, which can be used with filters to hide mail.
Send-mail-as and other accounts: Remove addresses you did not add.
Sent, Trash and All Mail: Look for messages that show what the attacker did, such as password-reset requests to other services.

Step 5: Review Third-Party Access

In your Google Account security section, look for "Your connections to third-party apps and services" or a similar heading. Remove apps you no longer use or do not recognize. Also review App Passwords if you have created any, and remove those you do not need.

Step 6: Turn On 2-Step Verification, Ideally Stronger Than SMS

Enable 2-Step Verification in the security settings if it is not already on. You can use Google prompts on your phone, an authenticator app, backup codes, or a physical security key. Security keys and passkeys offer the strongest protection against phishing. Google's Advanced Protection Program is a free option for people at high risk. It requires you to sign in with a passkey or security key, and it limits third-party app access, blocks app passwords and tightens account recovery. Read its current requirements before enrolling.

Save your backup codes somewhere safe, offline or inside a password manager, in case you lose your phone. If you use Google Authenticator, our Authenticator setup and backup guide explains how to avoid losing your codes.

Step 7: Secure Other Accounts

Because your email is the reset point for many other accounts, treat everything tied to it as at risk: If a social account was also affected, see how to recover a hacked Facebook account.

Change passwords for banking, shopping, social media and cloud storage, starting with the most important.
Use different passwords everywhere. A password manager makes this practical.
Watch bank statements and credit notifications for unusual activity, and contact your bank through its official number if something looks off.
Tell your contacts that your account was compromised so they can ignore suspicious messages.

If Google Recovery Does Not Work

Sometimes recovery fails, especially if the attacker changed every detail and Google cannot verify you. You can:

Try again from your most trusted device and network, with as many correct details as possible.
Use any other recovery options you set up in the past, such as a second email address.
Change the passwords of accounts that used this Gmail address, using another email if you can, so the attacker cannot reset them.
Read Google's Help Center for current guidance on a compromised account.
As a last resort, Google suggests creating a replacement Google Account, then following its steps to avoid getting locked out again. Move your important services to it over time.

Beware of anyone offering to recover your account for payment. Google says: "For your security, you can't call Google for help to sign into your account." It also says it does not work with any service that claims to provide account or password support, so any "Google recovery" phone number or agent is a scam. Google adds that changes to recovery details can take up to seven days to take effect. Legitimate recovery is done through Google's own tools.

Frequently Asked Questions

Can I call Google to get my account back?

No. Google says you can't call it for help signing in to your account. Anyone who answers a "Google support" number and offers to recover your account is not Google.

How can I tell whether someone else is reading my Gmail?

If available, check the "Last account activity" details at the bottom of the Gmail inbox on a computer for recent access, and review your security settings for unfamiliar devices. Also check forwarding and filters.

Will changing my password be enough?

Not by itself. Attackers can leave forwarding rules, recovery details and app connections behind. Work through the checks above.

Do I need to worry about my YouTube channel or Google Drive?

They belong to the same account, so review them for changes, shared files and unfamiliar activity.

Can I get deleted emails back?

If the hacker deleted mail recently, check Trash. Deleted messages may be available there for a limited time. Beyond that, recovery is not guaranteed.

Is a security key worth buying?

For an account as important as your main email, it can be a worthwhile investment because it resists fake login pages. Many people are well protected with an authenticator app or passkeys. Buy from a reputable seller and keep a backup key.

Related Guides

Conclusion

To recover a hacked Google account, start with Google's official recovery process from a familiar device, then clean up: sign out unknown devices, check recovery details, remove forwarding rules and filters, and revoke suspicious app access. Finish by turning on strong 2-Step Verification and changing passwords elsewhere. Do all of this and the account will often end up better protected than before.

Search This Blog

Safe Sign In