Gmail Account Hacked? How to Recover It and Lock It Down

If your Gmail was hacked and you can still sign in, change your password right away, run Google’s Security Checkup, sign out of devices you don’t recognize, and check your recovery phone and email. If you’re locked out, use Google’s official account recovery page from a device and location you’ve used before. Either way, then check Gmail’s forwarding, filters and delegated access, because attackers often set these up to keep reading your mail after you’ve changed the password.

Your Gmail is usually the key to your other accounts, since password resets for your bank, social media and shopping sites go there. That’s why a Gmail account hacked is worth treating as urgent, and why the cleanup goes beyond the inbox itself.

Signs your Gmail account has been hacked

• A security alert from Google about a new sign-in or a changed password that you didn’t make.
• Your password no longer works.
• Contacts say they got strange emails or messages from you.
• Emails in your Sent folder you didn’t write, or messages missing from your inbox.
• New forwarding addresses, filters or recovery details you didn’t add.
• Password reset emails from other services you didn’t request.

Some of these can also come from a scam email that fakes a Google alert. Don’t click links in alerts. Instead, go directly to your Google Account and check “Security” and “Recent security activity” there.

If you can still sign in: do this now

1. Change your password. Pick a long, unique password you haven’t used anywhere else.
2. Run Google’s Security Checkup. It’s in the Security section of your Google Account. It walks through recent activity, signed-in devices, third-party access and recovery options.
3. Sign out of unknown devices. In the list of devices signed in to your account, remove any you don’t recognize.
4. Check recovery phone and email. Attackers sometimes change these so they can reset the password later. Put your own details back.
5. Turn on 2-Step Verification or passkeys. A code, prompt or passkey on your device makes a stolen password much less useful. Avoid relying on text messages alone if you can use an authenticator app, Google prompts or a passkey.

If you’re locked out: recover through Google only

If the attacker changed your password or recovery details, start Google’s account recovery process from the Gmail sign-in page by choosing the option for forgotten passwords. Google asks questions to confirm the account is yours.

• Use a familiar device and location. A phone or computer you’ve signed in with before, on your usual Wi-Fi, helps Google recognize you.
• Answer as fully as you can. If asked for a previous password, give the most recent one you remember. Guessing is better than skipping.
• Check your recovery email and phone. If they’re still yours, Google may send a code there.
• If it doesn’t work first time, try again later from the same device. Google may ask different questions.

Google doesn’t charge for account recovery and won’t contact you out of the blue to offer it, so be very wary of anyone who contacts you offering to “restore” your Gmail. Fake support numbers and recovery “experts” who ask for payment or your passwords are a common follow-up scam. Use only Google’s own sign-in and help pages.

Check the hidden settings attackers leave behind

Changing the password isn’t enough if the attacker set up ways to keep seeing your email. Once you’re back in, open Gmail’s settings (the gear icon, then “See all settings”) and check:

Setting	Where to look	What to remove
Forwarding	The “Forwarding and POP/IMAP” tab	Any forwarding address you didn’t set up
Filters	The “Filters and Blocked Addresses” tab	Filters that forward, delete or archive mail, especially ones targeting banks or security alerts
Delegated access	The “Accounts” tab, under granting access to your account	Anyone you didn’t give access to
Send mail as	The “Accounts” tab	Unknown addresses or reply-to settings
Vacation responder and signature	The “General” tab	Any text with links or messages you didn’t write
Third-party app access	Your Google Account, under security and connected apps	Apps or services you don’t recognize or use

Also check your Google Account’s recent security activity for sign-ins from unknown places, and look at Google Drive, Photos and YouTube if you use them, for files shared with strangers or videos uploaded without you.

Protect everything connected to your Gmail

Someone who hacked your Gmail may have used it to get into other accounts. Work through these next:

1. Change passwords on important accounts that use this email, starting with banking, other email accounts, your phone carrier, social media and shopping accounts with saved cards.
2. Check for password reset emails in your inbox, trash and archive from the time of the hack. They show which accounts the attacker may have tried.
3. Review saved passwords. If you use Google Password Manager, run its password check and change anything flagged or reused.
4. Watch your bank and card statements. Contact your bank right away about any charges you don’t recognize.
5. Warn your contacts. Send a short note telling people not to click links or send money in response to recent messages from you.

A short message is enough:

Hi everyone, my Gmail account was hacked recently. If you got an email from me asking for money, gift cards or to click a link, please ignore it and delete it. I’ve secured the account now. Sorry for the trouble.

If the attacker got into social accounts too, our guides on an Instagram account being hacked and a business social media account being hacked cover recovery for those platforms.

If personal or financial information was exposed

Inboxes often hold tax documents, ID scans, bank statements and medical letters. If the attacker could have seen those:

• Consider a credit freeze with each of the three major credit bureaus. It’s free and makes it much harder for someone to open new credit in your name.
• Report identity theft at IdentityTheft.gov, the FTC’s official site, if you see signs someone is using your information. It creates a recovery plan for you.
• Follow our guide on what to do if your identity is stolen for the full set of steps.

A worked example

This is an illustrative scenario, not a real client.

Leila gets a text from a friend asking whether she really needs gift cards. She checks her Sent folder and finds dozens of emails she didn’t write. Her password still works, so she changes it at once and runs the Security Checkup.

• She finds a laptop she doesn’t own signed in from another country and removes it.
• Her recovery email has been changed to an address she’s never seen. She restores her own.
• In Gmail’s settings she finds a filter sending any email containing “bank” or “security” to trash, and a forwarding address. She deletes both.
• She turns on 2-Step Verification with Google prompts and adds a passkey on her phone.
• She changes her bank and Amazon passwords, since both used the same password as her old Gmail one, and emails her contacts a warning.

Without the settings check, the attacker would have kept getting copies of her mail and hidden any alerts from her bank, even after she changed her password.

How to stop your Gmail being hacked again

• Use a unique password for your email, stored in a password manager.
• Keep 2-Step Verification or passkeys on, and keep backup codes somewhere safe.
• Keep recovery details current so you can get back in if something goes wrong.
• Treat unexpected sign-in links with suspicion. Go to your account directly instead of clicking.
• Review third-party app access a few times a year and remove anything you don’t use.
• Consider Google’s Advanced Protection Program if you’re at higher risk, such as a journalist, activist, executive or public figure.

Be aware of “you’ve been hacked” scam emails that claim to have your password or webcam footage. They’re usually extortion attempts built on old breach data, not proof of a new hack. Our guide on the “you’ve been hacked” email scam explains how to tell the difference.

Common mistakes

• Changing the password and stopping there. Forwarding rules and delegated access can survive a password change.
• Clicking links in alert emails. Some are fake. Go to your Google Account directly.
• Reusing the old password somewhere else. If it was stolen, every account that shares it is at risk.
• Paying a recovery “expert.” Recovery is free and happens only through Google.
• Not warning contacts. Attackers often use the account to scam the people who trust you most.

When a hack becomes a reputation problem

Sometimes a hacked account is used to send embarrassing messages, post content in your name, or leak private emails. If that’s happened, and the fallout is showing up in search results or on social media, our personal reputation management service can help with the removal requests and the wider cleanup. We’ll be straightforward about what can be taken down and what can only be answered.

Frequently asked questions

What should I do first if my Gmail was hacked?

If you can still sign in, change the password and run Google’s Security Checkup immediately. If you can’t, start account recovery from the Gmail sign-in page on a device you’ve used before. Then check forwarding, filters and delegated access in Gmail’s settings.

Can someone get into my Gmail even with 2-Step Verification on?

It’s much harder, but not impossible. Attackers can trick people into approving a sign-in or entering a code on a fake page. Passkeys and security keys resist this kind of phishing better than codes. Never approve a sign-in prompt you didn’t start.

Someone hacked my Gmail and changed the recovery phone. Can I still get it back?

Often, yes. Google’s recovery process can still verify you using other signals, such as a device you’ve signed in on before, your usual location and previous passwords. Try from a familiar device, answer as fully as you can, and try again later if the first attempt fails.

Should I delete my Gmail account after it was hacked?

Usually not. Deleting it can lock you out of every account that uses it for password resets. It’s normally better to recover, secure and clean up the account.