Your Google account is the master key to everything else: password resets for your bank, your photos, your phone's backups, your contacts. When someone else gets in, the damage spreads fast, and the instinct to "just change the password and turn on 2FA" often leaves the intruder with a back door. This guide gives you the recovery steps in the order that actually closes those doors, plus what to do when Google's recovery form refuses to cooperate.
The seven steps, in the order that closes the back doors
If you only have five minutes, do these in this order:
- Regain access at g.co/recover from a device and location you normally use.
- Change the password to something long and unique you have never used anywhere.
- Sign out every other device from the "Your devices" page in your Google Account.
- Check Gmail for forwarding, filters and delegates the attacker planted.
- Revoke unknown third-party apps and fix your recovery phone and email.
- Change passwords on linked services, starting with anything involving money.
- Only now turn on 2-Step Verification or a passkey.
The rest of this article explains each step, why the order matters, and what to do if step 1 fails.
Signs your Google account has been compromised
Google's own list of warning signs covers most cases: a password or recovery phone number changed without you, sign-in alerts from unfamiliar devices or places, purchases you did not make, and unfamiliar activity in Gmail, Drive, YouTube or Photos. In Gmail specifically, look for messages in Sent that you did not write, contacts complaining about strange emails from you, and, tellingly, an absence of security emails you would expect to have received.
How did it happen? Usually not through anything sophisticated. The most common route, as Hacked.com's recovery guide notes, is phishing: a link in an email or text that led to a convincing fake Google sign-in page. The runner-up is infostealer malware on a computer, which harvests saved passwords and, crucially, browser session cookies. Flashpoint counted more than 3.2 billion credentials stolen in 2024, three quarters of them harvested by infostealers running on more than 23 million infected devices. A stolen cookie lets an attacker into a signed-in session without ever typing your password, which is why several of the steps below matter even after you change it.
Step 1: Regain access via account recovery (and flag it as an incident)
If you can still sign in, skip to step 2 but change your password first. If you cannot, go to the Google account recovery page, enter your address and choose the option that fits, such as "I don't know my password" or the one indicating someone changed your account details. Moonlock's guide points out that picking the option that says someone else is using the account flags the request as a security incident rather than a routine reset.
Google's recovery tips are the difference between success and a dead end:
- Use a computer or phone you normally sign in from, the browser you usually use, and ideally your home or work network. Google weighs familiarity heavily.
- Do not skip questions. A best guess is better than a skip; wrong guesses do not end the process.
- When asked for your last password, give the most recent one you remember, or an older one if that is all you have.
- Have your recovery email or phone available; codes may be sent there.
One warning Google repeats and it is worth repeating here: Google never asks for your password or a verification code by email, phone call or text. Anyone who does is the attacker trying to get back in.
Step 2: Sign out every other session and device
Changing the password does not always end existing sessions, and a session stolen via cookie may not even be tied to the password. Open your Google Account, go to Security, and under "Your devices" choose Manage all devices. You will see every device and browser signed in now or in recent weeks.
Sign out of anything you do not recognize, and sign out of anything you do recognize but are not sitting at. Google's help page notes that a device can hold several sessions, so pick each one and sign out individually. On the same page, review recent security events; if you see a sign-in that was not you, select "No, it wasn't me" so Google applies additional protections.
While you are here, check for app passwords. These are 16-character passwords for older mail clients and a favorite persistence trick, since they bypass 2-Step Verification. Delete any you did not create.
Step 3: Hunt for forwarding rules, filters and delegated access
This is the step most people miss, and it is where an attacker sets up to keep reading your mail after you lock them out. Open Gmail on a computer, click the gear, then "See all settings," and check three tabs.
Forwarding and POP/IMAP. Any forwarding address you did not add should be removed. Also note whether POP or IMAP is enabled; an attacker may have turned it on to pull mail into an external client. Disable it unless you use it.
Filters and Blocked Addresses. Look for filters that forward mail, delete it, or archive it so it skips the inbox. A common pattern, described in buralog's analysis of post-takeover damage, is a filter that sends anything containing "password," "verification" or "security alert" straight to the trash, so you never see the reset emails the attacker is triggering on your other accounts. Delete every filter you do not recognize.
Accounts and Import. Scroll to "Grant access to your account." Gmail's delegation feature lets another Google account read, send and delete your mail without knowing your password, and it survives a password change. Remove any delegate you did not add. In the same tab, check "Send mail as" and "Check mail from other accounts" for addresses you did not set up.
Finally, empty the trash and check Sent for messages the intruder sent from your address, so you know who to warn.
Step 4: Review third-party app access and recovery contacts
Open the third-party connections page in your Google Account and remove any app or site with account access that you do not recognize or no longer use. Pay particular attention to anything with Gmail or Drive access; an OAuth grant keeps working after a password change.
Then go to Security and verify your recovery phone number and recovery email. Attackers routinely swap these to their own so they can "recover" the account back later. Replace anything that is not yours, and make sure your own recovery details are current.
Step 5: Change passwords on linked services, starting with banking
Assume the attacker read your inbox. That means they have seen which banks, shops, exchanges and services email you, and they could have requested password resets for any of them. Change those passwords now, in rough order of damage: financial accounts, your phone carrier (to head off a SIM swap), Apple or Microsoft accounts, shopping sites with saved cards, then social media.
If you reused your Google password anywhere, change it there too; infostealer data shows reuse is the norm rather than the exception. A password manager makes this step much faster and makes the next compromise far less likely. If you do not have one yet, our comparison of Bitwarden, 1Password and Proton Pass will help you choose.
Also scan your Google Drive, Photos and Contacts for deleted or shared items, and check your Google Play and Google One billing for purchases you did not make. Google's guidance is to contact your bank if any financial details were exposed.
Step 6: Turn on 2-Step Verification or a passkey (only now)
With the intruder's sessions, filters, delegates and app grants gone, lock the door properly. Go to Security in your Google Account and turn on 2-Step Verification, choosing an authenticator app or a security key rather than SMS where you can. Our guide to 2FA methods explains why SMS is the weakest option.
Better still, create a passkey. Google lets you sign in with your fingerprint, face or screen lock instead of a password, and a passkey cannot be phished because it only works on Google's real domain. Google's one caution is to create passkeys only on devices you own and use regularly, because anyone who can unlock the device can then unlock the account. Step-by-step instructions are in how to set up passkeys on Google, Apple and Microsoft.
Finally, generate and save your backup codes, and run Google's Security Checkup once more to confirm nothing was missed.
Why the order matters: the most common mistake people make
People who get hacked tend to do two things immediately: change the password and turn on 2-Step Verification. Both are right, but doing them first and stopping there leaves the attacker with everything they set up in steps 2 through 4. A delegate can still read your mail. A forwarding rule still copies it out. An app password still bypasses your shiny new 2FA. A stolen session cookie may still be valid.
The correct sequence, which Hacked.com also stresses, is recover, evict, clean up, then harden. Turning on 2SV last does not make it less effective; it just means you are locking a house that is actually empty.
Two more mistakes worth avoiding. Do not run the recovery process from a device that may be infected; if malware stole your credentials, it will steal the new ones. Scan the computer first or use your phone. And do not delete the intruder's sent emails before noting who they went to; those people may be the next victims.
Recover access, sign out every session, strip out forwarding rules, filters, delegates and rogue app grants, change the passwords on everything your inbox could reset, and only then turn on 2-Step Verification or a passkey. That order closes the back doors instead of locking them in. Fifteen careful minutes now saves weeks of cleanup later, and a passkey plus a password manager makes a repeat far less likely.
If recovery fails: what Google can and can't do
Google's recovery is automated, and there is no phone line for consumer accounts. If your first attempt fails:
- Try again from a more familiar setup. Same device, same browser, same Wi-Fi network you used for years. Google's algorithm treats those as strong evidence.
- Wait and retry. Repeated attempts in quick succession from an unfamiliar place look like an attack. Give it a day, then try once more with answers you are confident about.
- Use every recovery option. When recovery details change, Google typically notifies the previous recovery email address, and that notice can include a way to review or undo the change. Check that older inbox, including its spam folder.
If you never set up recovery options and cannot answer the questions, be realistic: Google may not restore access, and no third party can do it for you. Anyone offering to "recover your Google account" for a fee is almost always a scam. In that case, warn your contacts from a new address, treat any information in the old account as exposed, and change passwords everywhere that account could reset. Then set up recovery options and a passkey on the new account on day one.
Sources and further reading
- Secure a hacked or compromised Google Account (Google Account Help)support.google.com
- Tips to complete account recovery steps (Google Account Help)support.google.com
- See devices with account access (Google Account Help)support.google.com
- Set up mail delegation (Gmail Help)support.google.com
- Create a passkey for your Google Account (Google Account Help)support.google.com
- Gmail Account Hacked? Recovery, Session Cleanup, and Strong Sign-In (Hacked.com)hacked.com
- Gmail hacked? How to secure and recover your Google account (Moonlock)moonlock.com
- Flashpoint 2025 Global Threat Intelligence Report (Flashpoint)flashpoint.io
- Why Gmail auto-forwarding and filters amplify post-takeover secondary damage (buralog)buralog.jp