Hacked Gmail or Google account: how to get it back

How to recover a hacked Google or Gmail account

Act in this order. If you can still sign in, check Gmail’s forwarding and filters first, then change your password, review your security events, and sign out of devices you do not recognize. If you cannot sign in, go to Google’s account recovery page and answer every question from a device and place you have used before. Both paths are part of taking back control of an account, and Google’s own page on securing a hacked or compromised account lists the same steps.

The signs Google lists

According to Google’s help pages, someone else may be using your account if:

• your recovery phone number or email, your account name, the apps with access, or your 2-Step Verification settings changed without you;
• you received alerts about a sign-in or a new device you do not recognize, or saw a red bar warning about suspicious activity;
• Gmail stopped receiving mail, messages disappeared outside the trash, or your contacts received emails you did not write;
• you see purchases in Google Pay or Google Play, or Google Ads spending, that you did not make.

When Google detects a suspicious new sign-in method, it turns it off and gives you 30 days to confirm you added it; otherwise it is removed.

If you can still sign in

1. Check forwarding and filters in Gmail. On a computer, open Settings, See all settings. In Forwarding and POP/IMAP, choose Disable forwarding if you did not set it up. In Filters and Blocked Addresses, delete any filter that forwards or deletes mail you did not ask for. The NCSC puts this first because a forwarding rule sends the attacker a copy of every password reset.
2. Change your password. Google Account, Security & sign-in, How you sign in to Google, Password. Google says this signs you out almost everywhere and revokes app passwords.
3. Review recent security events. Under Security & sign-in, open Recent security events and choose No, it wasn’t me for anything you do not recognize.
4. Sign out unknown devices. Your devices, Manage all devices; select each device you do not recognize, then Sign out.
5. Check your recovery phone and email, and turn on 2-Step Verification, ideally with a passkey or a security key.
6. Remove apps you do not trust, at myaccount.google.com/linkedapps. Removing access does not delete your data held by the app.
7. Check the rest of Gmail: who has delegated access, the “Send mail as” addresses, the vacation responder, scheduled emails, and IMAP or POP access in Accounts and Import and General.
8. Run the Security Checkup at myaccount.google.com/security-checkup.

Gmail also helps you spot what happened: the Details link at the bottom right of the inbox shows the last 10 IP addresses and approximate locations that accessed your mail.

Then change the password of every other site where you used the same one, starting with sites that send email to this address. Google also advises checking that nobody contacted your bank or a government office in your name.

If you are locked out

Go to Google’s account recovery page through g.co/recover and follow these tips from Google:

• use a device, a browser, and a location you usually sign in from;
• answer every question, and guess rather than skip: wrong guesses do not end the process;
• give the last password you remember.

If verification fails, you can try again. Google says recovery without any other sign-in method can take three to five business days. Beware of “Google support” contacts during this time: Google says it never asks for your password or verification codes by email, phone, or message. If nothing works, Google’s last resort is to create a replacement account and update your contacts and services.

If it is a Google Workspace account

A work account belongs to your organization, and its administrator manages it. In a small business, that is usually whoever set up your email or website. Google’s checklist for compromised accounts tells administrators to suspend the account, which resets sign-in cookies and app tokens, investigate the sign-in logs, revoke passwords, tokens, and app passwords, then restore access with 2-Step Verification and check filters and forwarding.

If the only administrator is locked out, recovery requires proving ownership of the domain by adding a DNS record; Google says the attempt fails if the record is not found within 48 hours. That is one more reason to keep a second administrator and to secure your domain registrar.

The Microsoft side

If your business also uses Outlook or Microsoft 365, the steps differ in important ways. See how to recover a Microsoft account.

If it started with a breach alert

Many takeovers begin with a password leaked from another site. Our page on what to do when your email appears in a data breach covers that step.