Secure a Google Account after suspected compromise

If a Google Account may be compromised, secure access from a trusted device and then inspect recovery methods, sessions, third-party access and Gmail rules. Work through Google’s official recovery flow if you cannot sign in.

Recover access through Google

If you suspect someone accessed your Google Account, use Google’s official account recovery flow from a device and network you trust. Change the password to a unique one, then review recent security activity and signed-in devices. If you cannot sign in, follow the recovery prompts; avoid anyone claiming they can restore access for a fee.

Remove unknown sessions and access

Once access is restored, sign out devices you do not recognize and review recovery email addresses, phone numbers, passkeys and two-step verification methods. Remove unknown third-party app access. Check Gmail forwarding, filters and delegation because an attacker may create rules that keep copies of messages or hide security alerts.

Check Gmail forwarding and filters

If you reused the compromised password elsewhere, change it on those services too, starting with email, banking and password manager accounts. Use a password manager to create distinct passwords. Turn on a stronger second factor such as a passkey or security key where supported, and store recovery codes somewhere private.

Rotate reused passwords

Check the devices you used to sign in for unwanted browser extensions, malware and outdated software. Do not approve unexpected prompts or share verification codes. Google support will not ask you to disclose a one-time code in a public forum or to a stranger.

Confirm recovery and monitoring

After cleanup, review account activity again and keep recovery options current. If the account is managed by a school or employer, contact its administrator through a verified channel. Google’s recovery and security pages are the current source for exact steps, which can differ by account and sign-in state.

Official reference

Consult the official documentation for current instructions and applicable terms.