Hacked Google account: what to do in the first hour

Whoever controls your Google account controls far more than Gmail: it receives the "forgot password" codes for your bank, social networks and shops, and it holds your photos, documents, calendar and, often, the passwords saved in your browser. A Google account takeover is not just an email problem. It is the master key to almost everything you have online, and it deserves to be handled as an incident.

This checklist covers both scenarios: you can still sign in, or you have already lost access. Google's menus change names and places often, so use the Google Account Help Center as the final reference for exact clicks. The logic below does not change.

How do you know your Google account was hacked?

What are the signs that Gmail was hacked?

The most common signs are Google security alerts you didn't expect, a password that stopped working, sent emails you didn't write and settings changed without your action. Any one of them is enough to act as if it were a break-in.

• Security alert from Google about a new sign-in from a device or location you don't recognize.
• Password rejected though you didn't change it, or a recovery email/phone different from the one you set.
• Messages in the Sent folder you didn't write, or contacts telling you they got a strange link from you.
• Hidden rules: automatic forwarding to an unknown address, or filters that delete security notices.
• Password resets from other services landing in your inbox without you requesting them.

Beware of the fake alert: scammers send "your account has been suspended" emails to steal your real password. When in doubt, don't click the link; open the account address directly in the browser. The signs of a scam are in how to identify a phishing email.

Step by step if you can still sign in

Order matters here, because the intruder may be logged in at the same time as you:

1. Change the password to one you have never used anywhere else. If the old one was reused, change it on other services too, because the intruder will try the same password elsewhere (the attack described in credential stuffing).
2. Run the Security Checkup (at myaccount.google.com). It lists connected devices, recent security events and third-party access.
3. Sign out of unknown devices and revoke access for apps and sites you don't recognize.
4. Check the recovery email and phone. If either isn't yours, change it. That is the route the intruder would use to retake the account later.
5. Look for what was "planted" in Gmail: in settings, check forwarding, filters, delegated access and auto-reply. Remove anything you didn't create.
6. Turn on or review 2-Step Verification, preferably with an authenticator app or security key, not SMS. The walkthrough is in how to set up TOTP 2FA on Gmail, Instagram and WhatsApp.

What if you lost access?

How do you recover a hacked Google account?

Use Google's official recovery page (g.co/recover), enter the account email and, if possible, do it from a device and network you already used with it. Google asks for information only the owner should know, such as an old password or a code sent to your recovery contact.

1. Start with the official flow. Answer the questions in as much detail as you can and use the phone or computer where you usually signed in; that device's history helps verification.
2. Try old passwords. If the intruder changed the password, an earlier one you remember can still serve as proof the account is yours.
3. Be patient and don't repeat endlessly. There is no guaranteed official deadline; be wary of anyone promising a date.
4. Protect everything else while you wait. Change the password on accounts that use this email for recovery, starting with banking, social networks and WhatsApp.

A warning: there is no Google phone support for people locked out. Anyone calling and claiming to be "from Google" to "help" is a scam, in the same mold as vishing. Also be wary of "account recovery" services that charge a fee or ask for the code that arrived on your phone. A verification code is never handed to anyone.

How does the intruder usually get in?

Understanding the path helps you not repeat it. The most common ones:

• Reused password that leaked from another site and was tried on the Google account. Checking whether your email appears in breaches is simple, as shown in how to know if your email was leaked.
• Phishing that imitates the login page and captures the password and code.
• Infostealer: malware on the computer that steals passwords and sessions saved in the browser. See what an infostealer is and how to tell if you were infected.
• Session cookie theft, which skips the password because the intruder "inherits" the login already made. Explained in session cookie theft.

If the computer may be infected, changing the password from it doesn't solve anything: the malware captures the new one too. Clean or reinstall the system, or change the password from another trusted device.

How to lock the account down afterwards

• Passkey or security key instead of password and SMS. It is the strongest defense against phishing, because login only works on the genuine site. Details in passkeys and FIDO2.
• Password manager with a unique password per site. The free option is in how to use Bitwarden.
• Up-to-date recovery details: a phone and backup email that are yours and that you can access.
• Periodic review of the Security Checkup, to prune old devices and apps.

The bigger lesson

Your email account is the most valuable link in your digital life, because every other recovery goes through it. Protect email before any other account. If the problem was on a social network, the equivalent checklist is in hacked Instagram: what to do in the first 30 minutes, and if the target was the messenger, in cloned WhatsApp: how to tell and recover the account.

Sources consulted

• Google — Account Help: secure a hacked or compromised account
• Google — Secure a hacked or compromised Google Account