Google Account Hacked? How to Secure It Immediately

1. Signs your Google account was hacked

You do not always get a loud warning. These are the usual signs:

• Google emails you about a sign-in from a new device or place you do not recognize.
• Your password suddenly stops working, or Google says your recovery phone or email was changed.
• Your Sent folder has messages you never wrote, or friends say you sent them strange links.
• Gmail has a new forwarding address, a new filter or a vacation reply you never set up.
• There are purchases in Google Play or Google Pay that you do not remember.
• Files in Drive or photos have been shared, changed or deleted.

One sign on its own can be a false alarm. Two or more mean you should act now.

One important rule before you start: use a device you trust, like your own phone or a clean computer. If the hacker put malware on the computer you normally use, typing a new password there could hand it straight to them.

2. Get back in first (account recovery)

If you can still sign in, skip to the next section. If you are locked out, go to Google's official recovery page (search for "Google account recovery" or open g.co/recover) and enter your email address.

Make recovery easier

• Use a device and a place you have used before: your home Wi-Fi, your usual phone or your usual browser. Google trusts these far more than a new device.
• Answer as many questions as you can. If asked for a password, enter the last one you remember, even if it is old.
• Use your recovery phone number or recovery email if they are still yours.
• If a code or prompt is sent to a device, approve it only if you started the request yourself.

If the request is refused, do not spam the form. Wait a little, then try again from the same device and the same place. Keep an eye on your recovery email for replies from Google.

Be careful with fake help. Nobody can "recover your account for a fee", and Google will never call you to ask for a verification code. Anyone who does is trying to hack you again.

3. Change your password and sign out other devices

Once you are in, change the password straight away. Open myaccount.google.com, go to Security and choose Password.

Pick something long and unique. A passphrase of four or more random words works well and is easy to remember. Do not reuse a password from any other site, because hackers try stolen passwords everywhere.

Changing the password signs out most devices, but not always all of them. So check manually. In Security, open Your devices, then Manage all devices. Select every device or session you do not recognize and choose Sign out.

If a device looks unfamiliar, sign it out first and ask questions later. You can always sign back in on a real device.

4. Check apps, activity and Gmail settings

Hackers rarely stop at the password. They often leave a "back door" so they can return even after you change it. Check these four places.

Recent security activity

In Security, open Recent security activity. Look for sign-ins, password changes or new recovery details you did not make. If something is marked as not you, follow the prompts Google gives you.

Third-party app access

In Security, find Your connections to third-party apps and services. Remove anything you do not recognize or no longer use. An app with access to your account can keep reading your data even after a password change.

Gmail forwarding and filters

This is the most common trick. In Gmail, click the gear icon, choose See all settings, then check:

• Forwarding and POP/IMAP: delete any forwarding address that is not yours.
• Filters and Blocked Addresses: delete filters that skip your inbox, delete mail or forward it.
• Accounts and Import: check "Send mail as" and "Grant access to your account" for people you did not add.
• General: turn off any vacation reply or signature you did not write.

Recovery details

Make sure your recovery phone number and recovery email are really yours. Hackers often swap them so they can lock you out again later.

5. Turn on stronger protection

A new password alone is not enough. The best defense is making a stolen password useless.

Turn on 2-Step Verification in Security. This means Google asks for a second proof, like a prompt on your phone, when someone signs in. Even if a hacker knows your password, they are stopped.

Add a passkey. A passkey lets you sign in with your fingerprint, face or screen lock instead of a password. It cannot be typed into a fake website, so it is very hard to phish. If your devices support it, this is the best option.

Be careful with text messages. SMS codes are better than nothing, but they can be intercepted. Prefer a passkey, Google prompts or an authenticator app, and keep SMS only as a backup.

Finally, save your backup codes somewhere safe offline, and run Security Checkup (myaccount.google.com/security-checkup). It lists any weak spots in one place. Menu names can change slightly between updates, but the options are easy to find.

6. Clean up outside your Google account

Your Google account is often the key to other things. Once it is safe, spend ten more minutes on the rest.

• Change reused passwords. Start with banking, other email accounts, social media and shopping sites. A password manager makes this much faster.
• Scan your device. On Windows, run a full scan with Microsoft Defender. On Android, check Play Protect. Remove any extension or app you do not remember installing.
• Check money. Review Google Play, Google Pay and your bank statements. If you see charges you did not make, contact your bank and ask them to block them.
• Warn your contacts. Message friends and family through another channel. Tell them not to click links or send money based on emails from you.
• Review saved passwords in your browser, because a hacker may have seen them.

If money was stolen or someone is blackmailing you, report it to your local cybercrime unit or police.

7. How to stay safe afterwards

Most hacks start with a phishing message: a fake email or text that looks like Google, your bank or a delivery company. A few habits remove most of the risk.

• Never share a verification code with anyone. Not with "support", not with a friend asking for a favor.
• Type the address yourself or use your saved bookmark instead of clicking a link in an alarming message.
• Use a different password for every site, kept in a password manager.
• Keep your system, browser and phone updated.
• Run Security Checkup every few months and remove old devices and apps.

Treat any surprise "security alert" with suspicion. Open your account yourself and check from there.