You type your password, and Google tells you it was changed. If your Gmail was hacked and the password changed, go straight to Google’s account recovery page at g.co/recover using a device and location you normally sign in from. Keep any phone or computer that still has access signed in.
Changed passwords don’t mean you’re out of options. Google’s recovery process can help you prove the account belongs to you, even when someone has changed your recovery details. Before you work through it, there are a few things to do right now.
Do These Things in the First 10 Minutes
Where do you start when your inbox is suddenly out of reach? Keep the access you still have, begin recovery and protect other accounts that could be affected. Work through these five actions first.
- Keep signed-in devices signed in. Still have Gmail open on an old phone or another computer? Leave it signed in. You may be able to use that device to help recover your account, including if a recovery request gets delayed.
- Use your usual device and home Wi-Fi. Choose the phone or computer you regularly use for Gmail. If you normally sign in at home, try from there using your usual connection and browser.
- Start recovery at g.co/recover. This is Google’s recovery route when your password or recovery information has been changed. Enter passwords and verification codes only on accounts.google.com. Google won’t ask you to send them by email, phone call or message.
- Replace passwords you reused elsewhere. Used the same password for another website or app? Change it there now. Google also recommends changing passwords for services tied to your Gmail address and accounts whose passwords you stored in your Google Account.
- Warn your bank and affected contacts. Contact your bank if someone may be giving instructions in your name or accessing financial information from your account. If someone is sending messages while pretending to be you, let your contacts know.
How to Recover Your Gmail Account Step by Step
Here’s the thing. Recovery is about helping Google confirm that the account is yours, so give the questions your best effort. You may not be able to use every verification option offered, but that doesn’t mean you should stop at the first obstacle. Follow these steps as the prompts appear.
- Enter your Gmail address. Open g.co/recover and enter the address of the account you want back. Unsure which address you used? You can try Google’s username recovery process first.
- Provide the latest password you remember. If Google asks for a previous password, use the newest one you can recall. Type it carefully, including capital and lowercase letters. Can’t remember that one? An earlier password is still worth entering.
- Use an available recovery email or phone. Follow the prompts to receive and enter a verification code through a recovery method you can access. If Google asks for an email address you can check, provide a recovery, alternate or contact address you previously added to the account.
- Choose Try another way when needed. Can’t receive the code through the option shown? Select “Try another way” to see whether Google offers another method. Follow the available prompts.
- Answer as many questions as possible. Don’t skip a question just because you aren’t completely certain. Give your best answer. An incorrect guess won’t remove you from the recovery process.
- Look in your spam or junk folder. If you’re checking for a recovery message, look beyond your inbox. Google’s email may have the subject “Your Google support inquiry.”
Tips That Raise Your Chances of Getting It Back
You don’t need perfect recall to keep going. Google recommends familiar devices, familiar locations and the most accurate answers you can provide, though none guarantees success. Keep these points in mind when you try.
- Same device. Use a phone, tablet or computer you regularly sign in on. If another device still has your account signed in, try recovery there.
- Same browser. Open the browser you normally use for your Google Account. Keep this part of the process familiar too.
- Same place. Try from somewhere you usually access Gmail, such as home or work.
- Best guesses. Unsure of an answer? Give your best guess instead of leaving it unanswered. Getting something wrong doesn’t end the process.
- Older passwords. Start with your most recent remembered password. If that isn’t possible, enter an older one, with the correct capital and lowercase letters.
- Another attempt. A message saying Google couldn’t confirm ownership doesn’t prevent you from trying again. Use its recovery tips when you retry.
The takeaway is simple. Use what you already know about the account, keep any remaining access and give each recovery question a careful answer.
What If the Hacker Changed Your Recovery Email and Phone
Your password no longer works, and the recovery details aren’t yours either. Does that mean you’ve lost the account for good? No, Google’s recovery page is still the route to try when someone changes your recovery information. Start with the options below.
You see, access to your recovery email or phone isn’t the only thing Google’s process can ask about. A password you remember or a device you regularly use may help you complete verification. Keep any device that still has access signed in while you work through recovery.
- Try your signed-in device. If your account is still open on another phone or computer, start recovery from that device.
- Use a previous password. Enter the newest password you remember when asked. If you can only recall an older one, use that.
- Allow for a security hold. Google may delay processing your recovery attempt. That wait alone doesn’t mean your request has failed.
- Check for recovery notices. Google uses recovery information and other account details to send alerts about recovery requests. Check any notices you receive through recovery channels you still control.
Why Google Recovery Can Take Days
Waiting is frustrating when someone else may have access to your inbox. But Google can place a security hold between your recovery request and its review when the request appears unusual. Here’s what that delay means and when trying again may help.
The wait can range from several hours to several days, depending on the risks Google identifies, and 2-Step Verification can extend it. During this time, Google sends recovery notifications so you can reject a request you didn’t make. If you gain access to another way of proving ownership, such as a device you regularly use or one that’s still signed in, restart recovery there. That may help you regain access sooner, though it isn’t a guarantee.
Once You’re Back In, Lock Everything Down
Seeing your inbox again is a relief. Still, getting back in doesn’t mean every unauthorized change has been removed. Work through these six checks to secure your account and deal with access you didn’t approve.
1. Change your password and reused passwords.
Change your Google Account password right away, then replace it anywhere else you used it. Don’t stop with reused passwords. Google also recommends changing passwords for services that contact you through Gmail, use your Gmail address for sign-in or have passwords stored in your Google Account.
Once you’ve made those changes, run Google’s Password Checkup. Getting back into Gmail is your starting point, and the accounts connected to it need attention too.
2. Review security events and devices.
Was that recent activity yours? Check before assuming the account is clear. Review both security events and signed-in devices through your Google Account.
- Open your Google Account and choose “Security & sign-in.”
- Find “Recent security events” and select “Review security events.”
- For activity you didn’t carry out, choose “No, it wasn’t me” and complete the instructions shown.
- Open “Your devices” in your Google Account, then select “Manage devices.”
- For a device you don’t recognize, choose “Don’t recognize a device?” and follow the instructions to remove unauthorized access.
3. Fix your recovery phone and email.
Check that your recovery phone number and email address belong to you. Correct any details someone changed, and review your alternate and contact email addresses too.
Keep these details current after the immediate cleanup. You want recovery messages reaching an account or number you can actually access.
4. Remove apps you didn’t approve.
Open myaccount.google.com/permissions and review the apps allowed to access your account. Remove access for anything you didn’t authorize.
Here’s the thing. Your password isn’t the only item on the cleanup list. App permissions deserve their own check.
5. Turn on 2-Step Verification.
Enable 2-Step Verification once you regain control. If it was already enabled, review its verification methods and correct any changes you didn’t make.
Add backup verification methods too. Google recommends them to help reduce delays if you need to recover your account again.
6. Scan your computer for malware.
Use antivirus software you trust to check your computer and remove harmful software. Back up your files before you begin the cleanup. Google also lists a factory reset as an option.
If you use Chrome, remove extensions you don’t recognize and update the browser. Your account and the computer you use to access it both need attention before you call the job finished. If your phone is acting strangely too, check these signs your phone is hacked.
Hidden Gmail Changes Hackers Leave Behind
Your password is yours again. But what about the rules controlling your mail? Google recommends checking for unauthorized changes inside Gmail too, so work through the items below.
| What to check | Why hackers change it | What to do |
|---|---|---|
| Automatic forwarding | Your incoming mail can be sent to another address. | Remove forwarding instructions you didn’t create. |
| Filters and labels | Rules can change how incoming messages are handled. | Delete unfamiliar filters and labels. |
| Mail delegation | Another person can be given access to your mailbox. | Remove anyone you didn’t authorize. |
| IMAP or POP access | These methods allow mail access outside Gmail. | Review remote access and correct unauthorized changes. |
| Vacation reply | An automatic message can reply on your behalf. | Remove or correct a reply you didn’t write. |
| Outgoing email address | The address used for outgoing messages can be altered. | Restore the address you intended to use. |
| Blocked addresses | Messages from particular senders can be blocked. | Undo blocks you didn’t put in place. |
| Scheduled emails | Messages can be queued to go out from your account. | Check the queue and remove emails you didn’t schedule. |
“Getting your inbox back is one task. Checking what changed inside it is another.”
How Your Gmail Probably Got Hacked
How did someone get in? You may not know yet, and suspicious activity alone doesn’t identify the cause. Start by checking these possible routes.
- A reused password. If your Google password was used on other websites, those accounts need attention too. Replace the shared password wherever you used it.
- A fake sign-in page. Google recommends Password Alert for Chrome, which warns you when you enter your Google password on a website outside Google.
- Harmful software. Malware on your computer may be involved. Run a scan with trusted antivirus software and remove anything harmful.
- Unfamiliar browser extensions. Check Chrome for extensions you don’t recognize, remove them and update the browser.
Fake sign-in pages usually arrive by email, so it helps to know the phishing email examples scammers send right now.
What to Do If Recovery Fails
Google couldn’t confirm the account is yours. Frustrating? Absolutely, but you’re allowed to try again. Before deciding what comes next, work through these options.
You can repeat recovery using a familiar device, browser and location, answering as many questions as possible. If you still can’t regain access, Google lists creating a replacement account as an option.
- Try again carefully. Use the most recent password you remember and give your best answer when you’re unsure.
- Create a replacement account if needed. Add recovery information and review Google’s advice on avoiding another lockout.
- Update your bank and contacts. Let them know if someone is impersonating you. Contact your bank if someone may have issued instructions in your name, especially when financial information was stored in your account.
- Keep passwords and codes private. Don’t send them to anyone claiming to help. Google doesn’t request them through calls, emails or messages. Enter them only on accounts.google.com.
Scammers pose as payment and support services too, so watch for tricks like the Apple Pay scam text.
Set Up Recovery Contacts Before You Need Them
A recovery contact is a trusted person who can help you recover your account, but you must add them before you’re locked out or recovery has begun. You can choose up to 10 people with Google Accounts, ideally people who can respond within 15 minutes. If your account is eligible, here’s how to add one.
- Open myaccount.google.com.
- Select “Security & sign-in.”
- Find “How you sign in to Google” and choose “Recovery contacts.”
- Select “Add recovery contact.”
- Enter the person’s email address and choose “Send request.”
Your contact has seven days to accept, followed by a further seven-day wait before they can help with recovery. When you need their help, select “Get number” and share the number with them within its 15-minute validity period. They’ll see three choices on their device and select the matching number.
This feature isn’t available for Google Workspace accounts, child accounts or accounts enrolled in the Advanced Protection Program. Check eligibility and arrange your contacts while you still have access.
FAQs
Google directs you to its online recovery page at g.co/recover to regain access to a hacked account. Start there using a device and location you normally sign in from. Google won’t ask you to disclose your password or verification codes during a phone call, so keep those details private.
Your recovery request may face a security hold lasting several hours or days, depending on the risks Google identifies. That delay doesn’t automatically mean recovery has failed. If you can try again from a device that’s still signed in, doing so may help you regain access sooner.
Yes, you can still attempt recovery after someone replaces your recovery phone number and email, though success isn’t guaranteed. Use g.co/recover from a familiar device and provide the most recent password you remember when asked. If a verification option is unavailable to you, select “Try another way.”
Review your signed-in devices, recent security activity and Gmail delegation to check for access you didn’t authorize. In your Google Account, open “Your devices,” then “Manage devices,” and investigate anything unfamiliar. Check app permissions and Gmail forwarding rules too, since your device list isn’t the only place unauthorized access or changes may appear.
Yes, having 2-Step Verification enabled can lengthen a recovery security hold, though it doesn’t mean every request will take longer. Google still recommends enabling it to protect your account. Add backup verification methods and keep your recovery details current to help reduce future recovery delays.
No, an incorrect guess won’t get you removed from the recovery process. Give the best answer you can instead of skipping a question because you’re unsure. If Google can’t confirm ownership after your attempt, you can try again.
Final Word
If your Gmail was hacked and the password changed, begin at g.co/recover using a familiar device and location. Keep any remaining session signed in, answer the recovery questions carefully and allow for a security delay.
Once you’re back, finish the cleanup. Review devices, app access and Gmail rules, then update your recovery information and verification methods. Take it one step at a time, and give those final checks the same attention you gave recovery.
