How to recover a hacked Gmail account

To recover a hacked Gmail account, go to Google's account recovery page at accounts.google.com/signin/recovery, enter your Gmail address, and answer Google's questions as best you can, even if the hacker changed your password and recovery phone. Once you are back in, use Google's own checks to find what the intruder changed and lock them out.

This guide follows Google's hacked account page step by step. If the hacker deleted the account instead, see how to recover a deleted Gmail account.

Step 1: Try to sign in

Start with the obvious. If your password still works, sign in, change it right away, and skip to step 3. Use a strong password you haven't used before with this account.

If it doesn't work, go to step 2. Google says to use the recovery page if someone changed your account info, like your password or recovery phone number, or if you can't sign in for any other reason.

Step 2: Use Google's account recovery page

1. Go to accounts.google.com/signin/recovery.
2. Enter your Gmail address. If you're not sure which address it was, Google's username recovery at accounts.google.com/signin/usernamerecovery can find it with a phone number or recovery email plus the full name on the account.
3. Answer each question Google asks. Don't skip any. If you're unsure, give your best guess.
4. When prompted, choose a strong password that you haven't already used with this account.

Google says wrong guesses won't kick you out, and there is no limit to the number of times you can try. If you get the message "Google couldn't verify this account belongs to you," you can try again.

If the hacker changed your password, phone and recovery email

This is the hard case, and the one most people searching are in. Google's recovery tips page is where the answers are. The points that matter most when every detail has changed:

Give an old password. If you're asked for the last password you remember, enter the most recent one you knew, which is likely the one the hacker replaced. If you don't remember it, use an older one. Google says the more recent, the better.

Use your usual device, browser and place. Use a computer or phone you often sign in on, the browser you usually use, and somewhere you usually sign in, like home or work. This is the biggest thing in your favor, because the intruder's device is none of these.

Try any email you ever added. If Google asks for an email you can check now, any address you added to the account counts: a recovery email, an alternate email you can sign in with, or a contact email.

If Gmail still reaches you somewhere. Google may send a code to the Gmail address itself. That helps if you still read that inbox in a mail app on another device, or forward it elsewhere. If not, select Try another way.

Check your spam folder. If Google's team emails you, look for a message titled "Your Google support inquiry".

If you can't get in, our guide to recovering an email account without a phone number covers Google's options when the phone is gone. Google also notes that recovery info changes may take up to 7 days to take effect, so if you changed something recently, try again in a few days. If you still can't recover the account, Google suggests creating a new one.

Step 3: Check what the hacker did

Once you're in, go through Google's checks. From your Google Account:

1. Open Security & sign-in. On the "Recent security events" panel, select Review security events. For anything that wasn't you, select No, it wasn't me and follow the steps.
2. Under Your devices, open the device list. For any device you don't recognize, select Don't recognize a device? and follow the steps. Google's device help says to sign out of every session with that device name, since several sessions can come from different devices.

Then correct any of these that you didn't change yourself. Google lists them as critical security settings:

• Your recovery phone number
• Your recovery email address
• An alternate or contact email address
• The name on your Google Account
• Apps with access to your account (myaccount.google.com/permissions)
• 2-Step Verification, or its methods, turned on or off
• Less secure app access
• Location Sharing

Google adds one detail worth knowing. If it detects a suspicious sign-in method on your account, it disables it and notifies you. You then have 30 days from that warning to confirm you added it, or it is deleted.

Step 4: Clean up Gmail itself

A new password does not undo the changes inside Gmail. On a computer, open Gmail, click Settings, then See all settings, and check each item on Google's list:

Google's hacked-account page also lists scheduled emails, labels, your name in Gmail and the address on outgoing mail. Delete anything you didn't set up. If emails are missing and not in Trash, Google lets you report missing emails and possibly recover them.

Step 5: Lock the door behind you

Turn on 2-Step Verification. Google's reasoning is simple: if your password is stolen, your account is still secure. Our guide to which two-factor methods are safest compares the options.

Remove app access. Google revokes app passwords when you change your Google Account password, but apps granted access to your account are a separate list. On the linked apps page, select Access to your Google Account, open anything you don't recognize, select See details, then Remove access.

Clean your device. Google says to install and run trusted anti-virus software if you think your account had suspicious activity, and to uninstall Chrome extensions you don't recognize.

Run the Security Checkup. Google's Gmail security tips start with it, and it catches recovery options and account permissions in one pass.

Step 6: Protect everything the account touched

Your Gmail address is the key to your other accounts, so the job isn't done at Google. Google says to change your password for apps and sites where you used the same password, that contact you at your Gmail address, where you sign in with it, and where you saved passwords in your Google Account. Start with banking, payment apps and shopping sites with saved cards.

If you had card details, tax or passport information in Gmail, Drive, Photos or Google Pay, Google says to contact your bank or local authorities to make sure nobody gave them instructions in your name.

Finally, tell your contacts. A short note is enough: your account was hacked between these dates, ignore links or money requests sent from it. For the full checklist across other providers, see what to do if your email is hacked.

Don't pay for help

Google is clear: you can't call Google for help to sign in, and it doesn't work with any service that claims to provide account or password support. Google also never asks for your password or verification codes by email, phone call or message, and you should only enter them at accounts.google.com. Anyone offering to recover your Gmail for a fee is not working with Google, and the recovery page above is free.

Frequently asked questions

Can I recover a hacked Gmail account without a phone number?

It can be possible. The recovery page can use an email address you added to the account, your old password, and the device and place you usually sign in from. A recovery phone helps, but Google's tips page lists other ways to prove the account is yours.

How do I recover my Gmail if the hacker changed everything?

Use the recovery page from a device and location you normally use, and enter the last password you remember. Answer every question and guess rather than skip. If it fails, you can try again, since Google sets no limit on attempts.

Will the hacker be logged out when I change my password?

Don't rely on it. Sign out of unknown devices on the device list, check apps with access, and remove forwarding rules and filters in Gmail. Those steps are separate from the password.

Does this work for a work or school Gmail account?

Maybe not. Google says these steps might not work for an account through your work, school or another group, and to check with your administrator.

When the address itself is the problem

If you got the account back but the address is now flooded with spam or keeps getting targeted, a fresh start is an option. Secria Mail signs you up with a name, the address you want and a password, with no phone number and no card. You can give each site its own alias, so a leak can be traced to the site it came from and stopped by deleting that alias. You can bring your old mail with you, including a Gmail export. The free plan includes 1 GB and 2 aliases.