How to Recover a Hacked Google Account and Lock It Down Afterwards

A message from a friend asking why you sent a strange link, a password that suddenly stops working, or a security alert you did not trigger can all point to the same problem: someone else got into your Google account. It feels alarming, but most accounts can be recovered if you act in the right order. The goal is simple. First get back in, then push the intruder out, then close the gaps they used.

Step 1: Try to sign in, and use account recovery if you cannot

Start on a device you trust, ideally your own phone or computer, not a public machine. Go to your Google sign in page and try your usual password. If it works, change it right away to a long, unique password you have not used anywhere else, and move to Step 2.

If your password no longer works, use Google’s account recovery flow. You will be asked questions meant to prove you own the account, such as a recovery email address, a recovery phone number, or a code sent to a device where you are already signed in. Answer as accurately as you can. Never share a recovery code with someone who contacts you claiming to be from Google. Google will not ask you for it in a call, text, or chat message.

If recovery asks you to wait, that is normal. Try again with your most recent recovery details.

Step 2: Kick out intruders and undo what they changed

Once you are signed in, open your Google Account security page and look for recent security activity and your signed in devices. Sign out any device, browser, or session you do not recognize. This can cut off an intruder still logged in elsewhere.

Next, check the places intruders love to quietly change. In Gmail, open Settings and look at forwarding addresses, filters, and blocked addresses. A forwarding rule that sends copies of your mail elsewhere is a classic trick, and it can survive a password change if you miss it. Also check your recovery email and recovery phone number in your Google Account settings. If either one was changed to an address you do not own, replace it with your own right away.

Then review third party access, the list of apps and sites that can access parts of your Google account. Remove anything you do not recognize or no longer use, especially apps with broad access to Gmail or Drive.

Step 3: Turn on stronger protection

With the intruder out, now make a repeat visit much harder. Turn on 2-Step Verification in your Google Account security settings if it is not already on. This means a password alone is not enough to sign in. You will also need a second factor, such as a prompt on your phone, an authenticator app code, or a security key.

Authenticator apps are a solid choice, because they work even when your phone has no signal. A prompt on a trusted phone is also convenient. Text message codes are better than no second factor at all, but they are the weakest option, since phone numbers can be targeted by SIM swap scams. Pick the strongest option you will actually use every day.

While you are in security settings, remove passkeys from devices you no longer own. Add a recovery email and phone number that only you control, and save backup codes in a password manager or a locked drawer at home, not in an email draft or a phone photo.

Step 4: Check your mail, Drive, and other Google services

A hacked account is not only about the login. Check your Gmail sent folder for messages you did not send, and warn contacts if a scam message went out in your name. Check Google Drive for files shared with strangers or deleted.

If money is involved, check Google Pay activity and any subscriptions tied to the account. If you see a purchase you did not make, report it through the payment provider and your bank as well as through Google.

Step 5: If you are completely locked out

Sometimes the intruder changed the recovery details before you noticed, and the standard recovery flow fails. In that case, keep trying from a device and location you have used before, since Google weighs familiar devices and networks. Do not pay any third party service that promises to recover your account for a fee. Those services cannot bypass Google’s checks, and many are scams themselves.

If you run a business or school account, contact your administrator instead. Workspace accounts are managed by the organization, and an admin can reset access in ways a personal account owner cannot.

Habits that keep the account safe after recovery

Once you are back in control, a few habits make a second incident far less likely. Use a password manager so every account gets a unique password, and never reuse your Google password elsewhere. Review signed in devices and third party access every few months, and remove anything stale. Be wary of sign in links in unexpected emails. When in doubt, type the address yourself instead of tapping a link.

Recovery follows a clear order: regain access, remove the intruder, fix hidden changes, strengthen sign in, and then check for damage. Work through those steps calmly, and your account will end up stronger than before.

Frequently Asked Questions

How do I know if my Google account was hacked?

Warning signs include a password that stops working, security alerts you did not trigger, sent messages you did not write, unfamiliar devices in your security activity, or forwarding rules and recovery details you did not set. Check your Google Account security page for recent activity and signed in devices to confirm.

What should I do first if I cannot sign in?

Use Google’s official account recovery flow from a trusted device, and provide your recovery email or phone number when asked. Do not share recovery codes with anyone who contacts you, and do not pay a third party service that promises to unlock the account, since those services cannot bypass Google’s checks.

Does changing my password alone remove a hacker?

Not always. Change your password, then sign out unfamiliar devices, remove suspicious forwarding rules and filters in Gmail, check your recovery email and phone, and remove third party apps you do not recognize. Turn on 2-Step Verification afterwards so a password alone is not enough to get back in.