Friends are asking why you sent them a strange link. You got an alert about a sign-in from a city you have never been to. Or your password simply stopped working. A hacked Gmail account is scary, because your email is the key to almost everything else: banking, social media, shopping and cloud storage.
Move quickly but calmly. Here is how to recover a hacked Gmail account, kick the intruder out, and make sure it does not happen again.
Signs your Google account was compromised
- Security alerts about new sign-ins or devices you do not recognize.
- Emails in your Sent folder that you did not write.
- Your password, recovery phone or recovery email was changed.
- New filters or forwarding rules you did not create.
- Password reset emails from other services you did not request.
If you can still sign in
Act straight away, ideally from a device you trust.
1. Change your password
Go to your Google Account, open Security, and choose Password under how you sign in to Google. Use a long, unique password you have never used anywhere else. Our guide on how to create strong passwords helps you make one you can remember.
2. Sign out of unknown devices
In Security, scroll to Your devices and click Manage all devices. Click any device you do not recognize and choose Sign out. If in doubt, sign out of everything except the device you are using.
3. Check recovery details
Make sure the recovery phone and recovery email are yours. Hackers often change these so they can take the account back later.
4. Look for hidden forwarding and filters
This is the step most people miss. In Gmail on a computer, click the gear icon > See all settings.
- On Forwarding and POP/IMAP, remove any forwarding address you did not add.
- On Filters and Blocked Addresses, delete filters you did not create, especially ones that forward or delete mail.
Attackers set these up to keep reading your mail quietly even after you change your password.
5. Review third-party access
In Security, open Your connections to third-party apps & services and remove anything unfamiliar.
6. Run Google’s Security Checkup
Google’s Security Checkup walks you through every important setting and flags problems in one place.
If you are locked out
If the hacker changed your password, use Google’s official account recovery page.
- Go to the Google account recovery page.
- Enter your Gmail address.
- Answer the questions as best you can. If asked for a previous password, enter the most recent one you remember.
A few things improve your chances:
- Use a device and location you normally sign in from, like your usual phone or home Wi-Fi.
- Be accurate, but do not skip questions. A good guess is better than nothing.
- Use your recovery phone or email if you still have access to them, since Google can send codes there.
If recovery fails the first time, wait and try again later from your usual device. Be very wary of anyone online offering to “recover your account” for a fee. They are almost always scammers, and Google does not offer paid recovery.
After you are back in: tell people and check linked accounts
- Warn your contacts that any odd messages from you in the past few days were not real.
- Change passwords for other accounts that use the same password, and for any account whose reset emails went to this Gmail, especially banking and social media.
- Check Google Pay and Google Drive for unfamiliar activity or shared files.
- Scan your devices for malware, since a stolen password sometimes comes from a keylogger. Our guide on how to remove a virus from Windows 11 covers the free tools.
How to stop it happening again
- Turn on 2-Step Verification, ideally using a passkey or the Google prompt on your phone. Our two-factor authentication guide shows how.
- Never reuse your email password on any other site.
- Learn the warning signs of phishing, since most account takeovers start with a fake login page. See how to spot a phishing email.
- Keep recovery details current, so recovery is quick if it ever happens again.
Quick recap
If you can still sign in, change your password, sign out of unknown devices, fix recovery details and remove hidden forwarding and filters. If you are locked out, use Google’s official recovery page from a familiar device. Then warn contacts, change related passwords and turn on 2-Step Verification so it is far harder to happen again.
