Gmail account hacked, and how to get it back

Someone else is in your Gmail, or you have been kicked out of it. Treat the inbox as the master key. Almost every other account you own will send a password reset there.

If you can still sign in, change the password now and then clean the settings listed below. If you cannot sign in, skip to recovery. The longer checklist, including Outlook and iCloud Mail, is Personal email account hacked. Google’s own page for this is Secure a hacked or compromised Google Account.

If you cannot sign in

Go to Google’s account recovery page. Google says to use it when someone changed your password or recovery phone, when the account was deleted, or when you cannot sign in for another reason. Answer the questions with what you actually remember. Guessing wildly does not help.

If you are not sure which address you are recovering, Google also says you can try recovering the username first, so you are not resetting the wrong account.

When you get back in, set a password you have never used on this account. Then do the cleanup below. A recovery that stops at the new password leaves the door they used.

If Google will not let you back in, and nobody else is using the account, you are in a different incident. That one is Locked out of your Google or Apple account. There is no attacker in that playbook. Here, there is.

If you can still sign in

Change the Google password immediately if you have not already. Google says to change it for this account, and also for:

• sites where you reused the Gmail password
• sites that contact you through this address
• sites where you sign in with this address
• passwords you saved in the Google Account

Then review what the account has been doing.

1. Open your Google Account, then Security & sign-in.
2. On Recent security events, select Review security events.
3. If a line is not you, select No, it wasn’t me and follow the steps Google shows.

Then check devices:

1. Open your Google Account, then Your devices, then Manage devices.
2. If a device is not yours, select Don’t recognize a device? and follow the steps.

Turn on 2-Step Verification after that. Google describes it as something you know, the password, plus something you have, such as a phone, a security key, or a printed backup code. If the password leaks again, the second step still has to fail.

The Gmail settings that survive a password change

Google tells you to correct these if they look unfamiliar. This is the list that matters more than the inbox view:

• Mail delegation, meaning other people with access to your Gmail
• Automatic forwarding
• Filters
• Scheduled emails you did not create
• Your name in Gmail
• The vacation responder
• The address on outgoing mail
• Blocked addresses you did not block
• IMAP or POP, which is remote access to the mailbox
• Labels that are sorting mail away from you

Also look at Sent. Google lists mail you did not write as a sign of compromise. If messages vanished and they are not in Trash, Google says you can report missing mail and may be able to recover it. Follow the link on their hacked-account page for that. We are not repeating a click path they did not print in the summary.

Friends receiving spam from you is on the same list. So is a username that changed, and a recovery phone or recovery email you do not recognise. Fix the recovery phone and recovery email before you close the laptop. Otherwise the next reset goes to them.

Money, files, and YouTube

Google says to contact your bank or local authorities if the account held financial or identity documents. They name cards saved in Google Pay or Chrome, and personal papers in Drive, Photos, or Gmail. Look for purchases you do not recognise in Google Pay and Google Play, payment methods you did not add, and Chrome payment details you do not recognise. Remove those.

If the YouTube channel on this login has videos you did not upload, the channel was hacked because the Google Account was. Clean the account first, then the channel. That order is YouTube’s, and the playbook is YouTube channel hacked.

In Drive, review activity and old versions. In Photos, stop sharing any album you do not remember sharing. If Location Sharing is on for someone you did not add, turn that off.

If you think the computer itself is infected, Google says to run trusted antivirus, and that a factory reset of the computer is an option after you have backed up files you still need. Do the Gmail cleanup from a different device if this one is the one that got phished.

What good looks like

A new browser asks for the new password and for 2-Step Verification. Forwarding is off, or it points only at an address you chose. No unfamiliar device remains. Sent mail from the last day is mail you recognise.

Tell your bank if a reset email for them went out during the window you did not control the inbox. Then open the playbook and do the prepare list, because the next attempt will be the same password on a site you forgot you reused.

The next page is Personal email account hacked. If YouTube moved as well, do that playbook in the same sitting, after Gmail is yours again.

Related playbooks

• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.
• Locked out of your Google or Apple account. Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.
• YouTube channel hacked. Your channel is posting videos you did not make, or the Google Account that owns it is no longer yours.