A hacked Gmail account is urgent because attackers can search old email for passwords, reset other accounts, read private documents, or send scams to your contacts. Secure access first, then investigate.
Does this affect you?
Use this for any Google Account used with Gmail when you see sent mail you did not write, password rejection, changed recovery details, unfamiliar devices, or a Google alert about someone else being signed in.
You can still sign in
Lock the intruder out before anything else.
- Go to myaccount.google.com > Security.
- Review Your devices and Recent security activity for sign-ins you do not recognize.
- Change the password under Security > Password and use one not reused elsewhere.
- Check Recovery phone and Recovery email. Put your real details back if they were changed.
- Open Third-party apps with account access and remove anything unfamiliar or unnecessary.
- Turn on 2-Step Verification if it is not already enabled.
- In Gmail settings, check Forwarding and POP/IMAP plus Filters and Blocked Addresses. Delete forwarding rules or filters you did not create.
You have been locked out entirely
Use Google’s official recovery page.
- Go to g.co/recover.
- Enter the Gmail address.
- Use any verification method still available, such as recovery phone, recovery email, backup codes, or another trusted device.
- If Google asks questions, answer with the most accurate old passwords, dates, and account details you can remember.
- Wait for Google’s decision, which may take minutes or a couple of days.
- After access returns, complete every security step from the previous section.
More control
Recover from a familiar place
If recovery fails, try again from a device, browser, and Wi-Fi network you used with the account before. Google weighs familiar sign-in signals heavily.
Warn contacts and secure reused passwords
If spam or phishing messages went out, tell contacts not to click them. Change the same password anywhere else you reused it, because one leaked password can lead to several takeovers.
Add backup codes and stronger 2FA
After recovery, generate backup codes and add an authenticator app or security key. SMS alone is better than nothing, but it is not the strongest option.
Sources
- Google Account Help – Secure a hacked or compromised Google Account (2025)
- Google Account Help – Sign in with your Google Account (2025)
- Google Safety Center – What to do if your account is hacked (2025)