Gmail account hacked? Recover access and check what was changed

In brief

There are two starting points: you can still sign in, or you have lost access. If you are locked out, use Google’s account-recovery process. If you can sign in, secure the account from a device you trust and investigate the changes rather than stopping at a new password.

Email is often the recovery route for other accounts. Restoring it matters, but so does checking whether messages were forwarded or another service was changed while someone else had access.

Choose the right starting point

If the password or recovery contact was changed, follow the account-recovery link in Google’s official instructions. Use accurate answers and a device you reasonably trust. For a work or school account, involve the administrator because the personal-account process may not apply.

If a safe session is still open, do not sign out everywhere just to imitate a tutorial before checking your recovery options. Review the available security controls and keep access to your genuine recovery contact. Record what the account actually shows, not what a threatening message claims.

Documentation for these steps: Google — Secure a compromised account ↗ · Google — Recover your account ↗

After access returns, inspect the security settings

Use a new password that you have not reused elsewhere. Review recent security events, recovery information, unfamiliar devices and third-party access. A device name alone can be ambiguous, so compare the activity with your own use while removing access you cannot explain.

For example, if you changed your password at noon but a recovery email remains unfamiliar, the incident is not finished. Work through the account settings deliberately. If the device itself appears compromised, obtain help securing it rather than repeatedly signing in from the same unsafe environment.

Documentation for these steps: Google — Secure a compromised account ↗

Check forwarding and filters inside Gmail

Review Gmail’s forwarding destination and mail filters for changes you did not authorize. Forwarding is a mailbox setting, not simply another browser tab that disappears when a session ends. Remove unauthorized rules after checking what they do.

Keep a private incident note with the date, affected account and settings you corrected. If important messages were sent in your name, warn the affected contacts through a trustworthy route. Do not forward your entire mailbox to a helper who says they need it to inspect the account.

Documentation for these steps: Gmail — Automatic forwarding ↗

Close the recovery gaps

Check accounts that use this email for password resets, especially if you found related security notices. Where a password was reused, replace it with a unique one. Configure two-step verification and keep a separate recovery route so a lost phone does not become the next lockout.

Stop engaging with anyone advertising guaranteed Gmail recovery or asking for an advance payment or verification code. Google’s recovery guidance explicitly warns against password-recovery services. A clear account record and the official process are more useful than an urgent promise in a direct message.

Documentation for these steps: Google — Recover your account ↗

What to do next

1. Open Google’s official recovery process if you cannot sign in; otherwise use a trusted device to review security.
2. Change the password when appropriate and check recovery contact details and security events.
3. Review unfamiliar sessions, connected access and Gmail forwarding or filters.
4. Secure other affected accounts and enable a second sign-in method you can recover.