How to recover a hacked Gmail account, step by step

Guide type

Incident response

Risk

High

Time

30–60 min

Cost

Free

Works on

Computer or phone

Last verified

2026-10-05

Signs your Google Account was taken over

• Your password stopped working, or you get "password changed" or "new sign-in" emails you did not trigger.
• Friends receive messages from you that you did not send.
• Emails are missing, already marked as read, or appear in Sent without you writing them.
• Your recovery phone or email was changed.
• Google shows a "critical security alert" in your phone's notifications or in your security events.

Which situation are you in?

Situation	Start at
You can still open Gmail on at least one device	Part 2, right now. Speed matters.
The password was changed and you cannot get in anywhere	Part 1: account recovery
Recovery failed twice	"If recovery keeps failing", further down

Part 1: get back in with account recovery

1. Use a device and network Google already knows

   Recovery works far better from a phone, tablet or computer where you have signed in to this account before, in the same browser you usually use, and from your usual location, such as home Wi-Fi. Google compares these signals with your history. Avoid VPNs and borrowed computers for this step.

2. Open the official recovery form

   Type accounts.google.com/signin/recovery yourself and enter your Gmail address. Do not use links from emails or texts that claim to help.

3. Answer every question, even if unsure

   Google's own advice: do not skip questions; take your best guess. If you cannot remember your latest password, enter an older one you do remember. Pay attention to uppercase and lowercase letters.

4. Check your other inboxes and phone

   Verification codes go to your recovery phone or recovery email. Look in spam and junk folders too. If the attacker changed your recovery details, act quickly: Google says it may still send codes to your previous recovery phone or email for 7 days after a change.

5. Set a new password immediately

   Once in, choose a long password you have never used anywhere, ideally created by a password manager. Then go straight to Part 2.

Part 2: kick the attacker out

1. Sign out every device you do not recognise

   Open Your devices and sign out anything unfamiliar. When in doubt, sign out everything except the device in your hand.

2. Fix your recovery phone and email

   In your Google Account, open Security & sign-in and check the recovery phone, recovery email and the name on the account. Attackers change these so they can take the account back later.

3. Turn on 2-Step Verification, or check it

   Open 2-Step Verification. If it is on, remove any phone, authenticator or security key you did not add. If it was off, turn it on now. A passkey is the strongest option, because it cannot be phished.

4. Remove apps you did not approve

   Open Third-party apps & services and remove anything you do not recognise. A connected app can read mail even after a password change.

5. Change the password everywhere you reused it

   If the same password protected other accounts, change those too, starting with banking, shopping and social media.

Part 3: find what the attacker left in Gmail

This is the step most guides skip, and the one that matters most. Attackers who expect to lose the password set up quiet ways to keep receiving your mail. On a computer, open Gmail, click the gear icon, then See all settings, and check each tab below.

Settings tab	What to look for	Why attackers use it
Forwarding and POP/IMAP	Any forwarding address you did not set up. Disable it and remove the address. Also check POP and IMAP if you do not use a mail app.	Copies of all new mail go to the attacker, including password-reset emails.
Filters and blocked addresses	Filters that forward, delete, archive or mark as read, especially ones matching words like "bank", "security", "invoice" or "password".	Hides alerts from you and steals specific messages.
Accounts and Import	Under Grant access to your account, remove anyone you do not know. Under Send mail as, remove unknown addresses.	Delegated access lets another account read and send as you, without your password.
General	An out-of-office auto-reply or a signature you did not write.	Used to spread scam links to everyone who emails you.

Also look in Sent, Drafts and Trash for messages you did not write. They show who the attacker contacted in your name.

Part 4: limit the damage outside Gmail

• Warn your contacts if messages went out from your account: a short note saying "my email was hacked on [date], ignore any request for money or codes" is enough.
• Check accounts linked to this Gmail. Any site that sends password resets to this address may have been reset. Look for "password changed" emails from banks, shops and social networks in the last few days.
• Check Google Pay and saved cards for purchases you did not make, and call your bank if you find any.
• Scan your devices. If you did not click a phishing link, the password may have been stolen by malware. Google recommends removing malware and, if in doubt, resetting the computer.
• Report identity theft in the US at IdentityTheft.gov if the attacker used your account to open accounts or borrow money in your name.

If recovery keeps failing

• Wait a few days, then try again from the device and network you used most with this account. Repeated attempts in a short time do not help.
• Make sure you are entering the exact address, including dots or a custom domain if it is a Google Workspace account. Workspace users should ask their administrator, who can reset the password directly.
• If the account cannot be recovered, create a new one, update the email address on your important accounts, and tell your contacts. Keep a note of the old address in case you need to prove ownership to other services later.

Make it hard to happen again

• Use a passkey or an authenticator app instead of text-message codes.
• Keep recovery phone and email current, and print your Google backup codes.
• Learn the warning signs in our guide on what to do after clicking a phishing link; most Gmail takeovers start with a fake sign-in page.
• If you are a journalist, an activist, an executive or the admin of a business account, consider Google's Advanced Protection Program.
• For a business, make this part of the routine in our small business cybersecurity checklist, which covers separate admin accounts and multi-factor authentication for everyone.

Sources

• Google — Secure a hacked or compromised Google Account
• Google — Tips to complete account recovery steps
• Google — Set up a recovery phone number or email address
• Google — Google Account security scam via phone call
• Google — Advanced Protection Program
• FTC — Refund and recovery scams
• FTC — IdentityTheft.gov