Google Account Hacked? Here’s Exactly What You Must Do Right Now

Discovering that your Google Account may have been hacked is one of the most stressful digital emergencies you can face. Your Gmail inbox, Google Drive files, photos, YouTube channel, payment methods, and the dozens of other services tied to that single login suddenly feel exposed. The good news is that Google provides clear recovery tools. The bad news is that speed is everything. Hackers who gain access often move quickly to change your password, recovery phone number, recovery email, and two-step verification settings. In many cases, you have roughly seven days after those recovery options are altered before your original methods stop working.

This guide walks you through every critical action, drawn from Google’s official account recovery and security recommendations. Follow the steps in order. Do not skip the early ones even if you are panicking.

Recognize the Warning Signs

Before diving into recovery, confirm the problem. Common red flags include:

• Sudden inability to sign in with your usual password
• Unexpected security alerts from Google about new sign-ins or password changes
• Emails or messages you never sent appearing in your Sent folder
• Unfamiliar devices listed under “Your devices”
• Changes to your recovery phone, recovery email, or account name that you did not make
• Filters or forwarding rules in Gmail that redirect messages somewhere else
• Unauthorized purchases or activity in Google Pay or linked services

If any of these appear, treat the account as compromised and act immediately.

Step 1: Attempt to Sign In Immediately

Open a browser and go to accounts.google.com. Try signing in with your email and the last password you remember.

• If you get in, go straight to the securing steps later in this article.
• If you are locked out, head to the official recovery page: accounts.google.com/signin/recovery (or the shorter g.co/recover).

Google’s recovery system works best when you use a familiar device, the same browser you normally use (Chrome or Safari preferred), and a location (home or office Wi-Fi) where you have signed in before. These signals help Google confirm you are the legitimate owner.

Answer every question as completely as possible. Wrong guesses do not remove you from the process. When asked for the last password, enter the most recent one you can recall. If you cannot remember it, try an older password or your best estimate. Provide any recovery email or phone number that was ever linked to the account, even if the attacker has changed them. Check your spam or junk folder for a message titled “Your Google support inquiry.”

Important: Google never asks for your password or verification codes by email, phone call, or text message. Only enter sensitive information on official Google pages.

Step 2: Complete the Recovery Process Thoroughly

The recovery flow is fully automated. There is no phone hotline or live agent for standard consumer accounts. Success depends on how well the information you provide matches what Google already knows about your account history.

If the system offers multiple verification methods (recovery phone, recovery email, backup codes, or a prompt on a trusted device), try every available option. Select “Try another way” when one method fails. Persistence often helps. If the first attempt fails, wait a short time and try again from the same familiar device.

Once Google verifies your identity, you will be prompted to create a new password. Choose a strong, unique password that you have never used anywhere else. Write it down securely or store it in a reputable password manager.

Step 3: Lock Down the Account the Moment You Regain Access

Gaining entry is only half the battle. You must immediately remove the attacker’s access and close every possible backdoor.

1. Change the password again if you have not already done so at myaccount.google.com under Security → Password.
2. Review recent security events. Go to Security → Recent security events and examine every entry. Mark anything you did not do as “No, it wasn’t me” and follow the on-screen instructions to secure the account.
3. Sign out of unknown devices. Under Security → Your devices, remove every device you do not recognize. This ends active sessions the attacker may still be using.
4. Audit and correct recovery options. Check both the recovery phone and recovery email. Delete any numbers or addresses the hacker added and restore your correct ones. Make sure these recovery methods are ones only you control.
5. Enable stronger sign-in protection. Turn on 2-Step Verification if it is not already active. Prefer a passkey (the strongest current option) or an authenticator app over SMS codes. SMS can be intercepted; passkeys and app-based codes are far more resistant to phishing.
6. Revoke third-party access. Visit myaccount.google.com/permissions and remove any apps or sites that look suspicious or that you no longer use.
7. Clean Gmail thoroughly. Open Gmail settings and inspect Filters and Forwarding, labels, vacation responder, and IMAP/POP access. Delete any rules or forwarding addresses you did not create. Attackers frequently set up silent forwarding so they continue receiving your mail even after you change the password.
8. Run Google’s full Security Checkup at myaccount.google.com/security-checkup. Complete every section it presents.

Step 4: Protect Everything Connected to the Account

Your Google Account is often the master key to much of your digital life. Immediately:

• Change passwords on every important account that used the same password or that receives mail at this Gmail address (banking, shopping, social media, government portals, work accounts).
• Review bank and payment activity for unauthorized transactions. Contact your bank or card issuer if anything looks wrong.
• Scan every device you use for malware, especially the one you were using when the compromise occurred.
• Check Google Drive, Photos, YouTube, and any other Google services for unexpected file sharing, deleted content, or new uploads.
• If you have Google Pay or saved payment methods, review them and remove cards if necessary.

Step 5: What to Do If Recovery Fails

If you cannot regain access after multiple careful attempts, the situation becomes harder. Google does not offer manual review for most consumer accounts. Options narrow to:

• Trying recovery again later from a different trusted device
• Checking whether a linked YouTube channel gives additional recovery paths (YouTube has its own hijacking report process in some cases)
• Accepting that the account may be permanently lost and creating a new one while securing all connected services

Prevention is far easier than recovery. Going forward, keep recovery phone and email current, enable a passkey, never reuse passwords, and treat unexpected emails or login prompts with extreme caution.

Final Advice

A compromised Google Account is serious, but it is often recoverable if you move fast and follow the official process carefully. Start the recovery page the moment you suspect a problem. Secure every setting the instant you regain control. Then treat the experience as a hard lesson: strengthen authentication, separate critical accounts, and stay alert to phishing attempts.

Acting within the first hours or days gives you the best chance of fully reclaiming your account and limiting the damage. Do not wait.

About The Author