Google Account Hacked? How to Recover It and Check Every Service

If your Google account was hacked and you can still sign in, change your password, run Google’s Security Checkup, sign out of every device you don’t recognize and restore your own recovery phone and email. If you’re locked out, use Google’s official account recovery page from a device and location you’ve used before. Then check each service the account controls, including YouTube, Drive, Photos, your Android devices and the passwords saved in Google Password Manager, because the attacker may have reached all of them.

A Google account is more than an inbox. One sign-in covers email, files, photos, videos, phones, payments and every site where you use “Sign in with Google”. This guide covers the whole account. If you’d rather close it for good once it’s secure, see how to delete a Google Account. For Gmail’s own hidden settings, such as forwarding and filters, see our guide to a hacked Gmail account.

Signs your Google account was hacked

• A Google security alert about a new sign-in, a password change or new recovery details you didn’t make.
• Your password stops working, or you’re signed out of your phone or browser unexpectedly.
• Videos you didn’t upload on your YouTube channel, a changed channel name, or a livestream you didn’t start.
• Files in Drive shared with people you don’t know, or new files you didn’t create.
• Photos shared through links or albums you didn’t set up.
• Purchases in Google Play or payment activity you don’t recognize.
• An Android phone, tablet or computer listed on your account that isn’t yours.

Fake Google alerts are a common phishing trick. Don’t click links in alert emails or texts. Open your Google Account directly and check the Security section and recent security activity there.

If you can still sign in

1. Change your password to a long, unique one you haven’t used anywhere else.
2. Run the Security Checkup. It’s in the Security section of your Google Account. It walks through recent security events, signed-in devices, recovery options and third-party access in one place.
3. Sign out of devices you don’t recognize. In the list of your devices, remove any unknown phone, computer or browser session.
4. Restore your recovery phone and email. Attackers change these so they can reset the password again later.
5. Turn on 2-Step Verification or a passkey. Google prompts on your phone, an authenticator app, a passkey or a security key are all stronger than text messages alone.

If you’re locked out: recover through Google only

Start from Google’s sign-in page, choose the option for a forgotten password, and follow the account recovery steps. Google asks questions to confirm you own the account.

• Use a device you’ve signed in with before, in a place you usually use it, such as your home Wi-Fi.
• Answer every question as well as you can. A previous password, even an old one, is better than skipping.
• Check your old recovery email and phone in case Google sends a code or a security alert there.
• Try again later from the same device if the first attempt fails. Google may ask different questions.

Google account recovery is free, and Google doesn’t call or message people offering to restore accounts. Anyone who does, including “recovery specialists” in search ads or social media comments, is almost certainly running a scam.

Check every service the account controls

Once you’re back in, work through the services you use. The attacker may have been in them all.

YouTube

• Check your channel name, profile picture, description and links.
• Look for uploaded, deleted or privated videos, and for livestreams you didn’t start. Hijacked channels are often renamed and used for crypto giveaway scams.
• Review who has access to your channel, including any managers or owners on a brand account, and remove anyone you didn’t add.
• If the channel was altered or removed, use YouTube’s help center for hacked channels. It’s the official route to restore a compromised channel. Our guide to a hacked YouTube channel covers the creator-specific steps.

Google Drive

• Sort files by recent activity and look for files you didn’t create or open.
• Check sharing on sensitive documents, such as tax records, ID scans and contracts. Remove unknown people and turn off public link sharing you didn’t set up.

Google Photos

• Check shared albums, shared links and any partner sharing. Remove anyone you don’t recognize and delete links you didn’t create.
• If private photos may have been copied, read our guide on what to do if your photos are leaked.

Android devices

• In your Google Account’s device list, remove any phone or tablet that isn’t yours.
• Use Google’s Find My Device to check where your own devices are, and to lock or erase a lost one.
• If your phone itself behaves oddly, with unknown apps, admin permissions or settings you didn’t change, follow our phone hacked guide.

Saved passwords

This is the step people miss. If you save passwords in Chrome or Google Password Manager, the attacker may have been able to see them. Run Google’s Password Checkup, then change the password on every important account stored there, starting with banking, other email accounts, your phone carrier and shopping sites with saved cards. Our guide on what to do if your password is leaked helps you prioritize.

Payments, Play and third-party access

• Check payment methods and recent transactions in Google’s payments center and Google Play. Contact your bank about any charges you don’t recognize.
• Review third-party apps and services with access to your account, and remove anything you don’t use or recognize.
• Check the sites where you use “Sign in with Google”. The attacker could have signed into those too.
• If you manage a Google Business Profile, a work account or a family group, check who has access and whether anything changed.

Warn your contacts

Attackers often use a hacked Google account to email or message the people who trust you. A short note is enough:

Hi everyone, my Google account was hacked recently. If you got an email, a shared file or a message from me asking for money, gift cards or to sign in somewhere, please ignore it and delete it. The account is secure now. Sorry for the trouble.

If documents with personal or financial information were in Drive or Gmail, consider a free credit freeze with the three major credit bureaus, and use IdentityTheft.gov, the FTC’s official site, if you see signs someone is using your identity.

A worked example

This scenario is illustrative, not a real client. Nadia, a small bakery owner, finds her YouTube channel renamed after a cryptocurrency and streaming a fake giveaway. Her Google password no longer works.

1. She starts Google’s account recovery from her own laptop at home, answers every question, and gets back in on the second attempt.
2. She changes the password, turns on a passkey and runs the Security Checkup. It shows a recovery email she never added and an unknown Windows computer. She removes both.
3. On YouTube, she finds a new channel owner on her brand account. She removes them, deletes the livestream and restores her channel name, then uses YouTube’s hacked channel help for videos the attacker deleted.
4. In Drive, her tax folder has been shared with an unknown address. She turns off the sharing.
5. Her saved passwords include her bank and her supplier portal. She changes both, then checks her Google Business Profile managers and posts a short note to her customers about the scam stream.

If she’d only recovered the account and changed her password, the attacker would still have had channel ownership and a copy of her bank password.

Common mistakes

• Treating it as just an email problem. YouTube, Drive, Photos and saved passwords all need checking.
• Keeping saved passwords unchanged. If the attacker could view them, every one is at risk.
• Clicking links in alert emails. Some are fake. Go to your Google Account directly.
• Deleting the account in frustration. It can lock you out of every service that uses it for sign-in or resets.
• Paying anyone to help. Recovery is free and happens only through Google.

How to stop it happening again

• Use a passkey or security key, and keep backup codes somewhere safe offline.
• Keep your recovery phone and email current.
• Run the Security Checkup a few times a year and whenever Google flags something.
• Remove third-party access you no longer use.
• Consider Google’s Advanced Protection Program if you’re at higher risk, such as a public figure, journalist or executive.
• Review what your account shares publicly with our guide to Google privacy settings.

For other hacked accounts, start with what to do first when any account is hacked. If the hack left scam videos, leaked files or posts under your name showing up in search, our personal reputation management service can help with removal requests and the wider cleanup, and we’ll tell you honestly what can and can’t be taken down.

Frequently asked questions

What should I do first if my Google account was hacked?

If you can sign in, change the password, run the Security Checkup and sign out of unknown devices. If you can’t, start Google’s account recovery from a device you’ve used before. Then check YouTube, Drive, Photos, your devices and your saved passwords.

Can I recover a Google account if the hacker changed the recovery phone and email?

Often, yes. Google’s recovery process can use other signals, such as a familiar device, your usual location and previous passwords. Try from a device you’ve signed in on before and answer as fully as you can.

Can a hacker see my saved passwords in Google?

Someone with full access to your Google account may be able to view passwords saved in Google Password Manager. After a hack, change the important ones and run Password Checkup.

How do I get my hacked YouTube channel back?

First recover the Google account that owns it. Then remove unknown owners or managers and use YouTube’s help center for hacked channels, which is the official route to restore changes or removed content.