Quick fix: 6 steps
- Locked out? Use accounts.google.com/signin/recovery from a device and place you normally use, and answer every question.
- Still in? Open Google Account, Security & sign-in, Review security events and Manage devices.
- Change your password to a new, unique one.
- Turn on 2-Step Verification (passkey, key or app preferred).
- In Gmail, Settings, See all settings, Forwarding: disable forwarding, delete unknown filters.
- Change passwords on other sites that use this address. Full cleanup.
Signs your Gmail account has been hacked
If your Gmail account was hacked, you will usually notice it in one of a few ways: you can no longer sign in, your contacts tell you they received strange emails from you, or Google warns you about unusual activity. Google's own help page on compromised accounts lists the patterns worth checking, and it is worth reading them against your own situation before you start changing things, because the fix for "someone is inside my account" is different from the fix for "someone changed my password and locked me out."
These are the signs Google itself describes:
- Gmail activity that is not yours. You stop receiving email, friends report spam or odd messages coming from your address, emails are missing from your inbox and are not in Trash, or the Sent folder contains messages you never wrote.
- Changed Gmail settings. Unfamiliar changes to automatic forwarding, filters, labels, your vacation responder, your outgoing name or address, blocked addresses, IMAP or POP access, or mail delegation.
- Changed security details. A new recovery phone or recovery email you did not add, a different account name, a changed security question, or 2-Step Verification turned on or off without you.
- Unfamiliar apps or devices. An app listed under "Review apps with access" that you never approved, or a signed-in device you do not own.
- Warnings from Google. Alerts about an unusual sign-in or a new device, a message that a change to your username, password or security settings may not be yours, or a red bar reading "We've detected suspicious activity in your account."
- Money signs. Unrecognized purchases or payment methods in Google Pay or Google Play, or unfamiliar payment details saved in Chrome.
Not every scary email means a breach. A phishing email pretending to be Google ("your account will be closed") is only an attempt. If your sign-in works, your recent security events look normal and nothing in the list above has changed, you were targeted but not compromised. In that case, do not click anything in the message, report it as phishing, and consider turning on stronger sign-in so a future attempt fails. Our phishing explainer shows how to tell the difference.
Quick triage: which situation are you in?
| What you see | What it usually means | Go to |
|---|---|---|
| You can still sign in, but see odd activity or settings | Someone may have your password, or you left a session open somewhere | If you can still sign in |
| Password no longer works, recovery phone or email changed | Account taken over and locked | If you are locked out |
| Warning email or red bar, but all settings look normal | Attempt or blocked sign-in | Security checkup anyway |
| Friends get odd links from you, but your sign-in is fine | Possible stolen password, session or a malicious app | After you are back in |
| Fake "Google" email asking you to verify | Phishing | Phishing section |
If you are unsure which row fits, go through the "still signed in" steps first and then the recovery steps. Doing the cleanup in the correct order matters more than doing it fast, and a few minutes of calm triage beats clicking every warning on the screen.
The first 10 minutes: what to do right now
Here is the short order of operations. The sections that follow explain each step with the exact labels Google uses.
- Use a device you trust. If you suspect malware on your computer, start from your phone or a friend's clean device. A hacker watching your keyboard will see every new password you type.
- Go to Google's account recovery page (accounts.google.com/signin/recovery) if you cannot sign in. If you can, open your Google Account directly at myaccount.google.com.
- Review your recent security events and your devices, and mark anything you do not recognize.
- Change your password to a new, long, unique one.
- Turn on 2-Step Verification, ideally with a passkey, a security key or an authenticator app rather than text messages.
- Check Gmail for forwarding rules, filters and delegates that quietly send copies of your mail to someone else.
- Change passwords elsewhere for any site that uses this Gmail address or the same password.
The tactics attackers use after getting into Gmail are not random. Your inbox is the key to everything else: password reset emails for your bank, shopping, social media and cloud storage all land there. That is why securing the inbox comes before anything else, and why a changed forwarding rule is one of the most dangerous leftovers of a hack. We come back to that in the settings section below.
One more point on timing. If you saved banking, tax or identity details in your Google Account, or someone may be impersonating you to others, Google advises contacting your bank or the local authorities. In Canada, you can also report fraud to the Canadian Anti-Fraud Centre. Do that after you have secured the account, not instead of securing it.
If you can still sign in: lock it down step by step
Being able to sign in is the best case. Work through the steps below in order. Google's help page for compromised accounts describes the same flow, and the menu labels here come from it, though Google moves buttons around from time to time, so treat the wording as a guide and look for the closest match.
Step 1: Review recent security events
Open your Google Account, go to Security & sign-in, and in the Recent security events panel select Review security events. Go through each entry. If something was not you, select No, it wasn't me and follow the on-screen steps. If everything is yours but you still suspect someone has access, keep going: attackers sometimes sign in from a location or device that looks ordinary.
Step 2: Review your devices
In your Google Account, tap Your devices, then Manage devices. Look for devices you do not own or no longer use. If you find one, select Don't recognize a device? and follow the steps. Old phones, a work laptop you returned, or a tablet you gave away should not be there either. Removing them forces those devices to sign in again.
Step 3: Check Gmail's own activity panel
Open Gmail on a computer at mail.google.com and click Details in the bottom right corner. The "Activity on this account" panel shows whether the account is open in another place, how it was accessed (browser, device, or a mail server through POP or IMAP) and the last 10 IP addresses with approximate locations. It is a good second opinion. Note that Google's page describes it as a viewing tool, not a sign-out tool. For ending sessions on devices, use the device list from Step 2.
Step 4: Change your password
Choose a password that is long and used nowhere else. A passphrase of four or five unrelated words works well, and a password manager makes it easy to keep it unique. Our password manager guide explains how to pick and set one up. Google also tells you to change the passwords of any account that used the same password, that emails you through your Gmail address, where you sign in with that address, or where you saved passwords in your Google Account. Google's Check your passwords option helps find weak or reused ones.
Step 5: Turn on 2-Step Verification
Open myaccount.google.com, tap Security & sign-in, and under "How you sign in to Google" select Turn on 2-Step Verification. Follow the prompts. Google's page lists these second-step options:
- Google prompts, which are push notifications to signed-in Android phones or to iPhones with the Gmail, Google, YouTube or Google Photos app. Google recommends these as the default.
- Passkeys and hardware security keys, found under "Use other verification methods". A passkey can use your fingerprint, face scan or device screen lock.
- Google Authenticator or another verification code app, which works even without internet or mobile service.
- Text message or voice call codes, a 6-digit code sent to a phone number. Google's page notes these are more vulnerable to phone number based attacks.
- Backup codes, eight-digit codes you print or download for use if you lose your phone.
If you use a work or school Google account, the steps may not apply and your administrator controls this. After you turn it on, also store the backup codes somewhere safe, offline. For the broader picture see our two-factor authentication setup guide and the passkeys explainer.
Step 6: Check your recovery phone and recovery email
Attackers often swap your recovery phone number or email with their own, so they can get back in later. In Security settings, confirm that your recovery phone, recovery email and any alternate or contact email are yours. Also confirm the 2-Step Verification methods listed are ones you set up. Google lists unfamiliar recovery details and unfamiliar 2-Step Verification methods among its signs of compromise.
Step 7: Remove apps and access you did not approve
Use Review apps with access in your security settings and remove anything unfamiliar. Google also advises turning off less secure app access (View less secure apps), since those sign-in methods skip modern protections. Third-party apps with mailbox access are a common way for spam to keep going out after the password was changed.
The Gmail settings attackers leave behind
This is the step people skip, and it is the one that causes the second hack. Google lists unfamiliar changes to mail delegation, automatic forwarding, scheduled emails, vacation responder, outgoing address, blocked addresses, IMAP/POP access, filters and labels as signs of compromise. A hidden forwarding rule or filter can copy every new email, including password resets, to the attacker even after you changed your password.
Turn off automatic forwarding
- On a computer, open Gmail and sign in to the affected account.
- In the top right, click Settings, then See all settings.
- Open the Forwarding and POP/IMAP tab (or Forwarding).
- In the Forwarding section, click Disable forwarding.
- At the bottom, click Save Changes.
Review filters, labels and the rest
While you are in See all settings, look through the other tabs for filters that delete, archive or forward mail you did not set up, and delete any you do not recognize. Check the vacation responder, the signature, the "Send mail as" address, blocked addresses and delegated access (Accounts and Import). Google's page on forwarding does not describe a dedicated filters tab, so if the tab names look different on your screen, browse each tab in Settings rather than relying on exact names.
Google's help also says that a filter set to forward messages can trigger a notice in the inbox during the first week after it was created. If you see one you did not create, that is a red flag.
Finally, remove labels you did not create, and check Sent and Trash for messages that show what the attacker did. These may tell you whom the attacker targeted next, which helps when you warn contacts.
Seven mistakes that make a Gmail hack worse
- Changing the password from the infected computer. If a keylogger or info-stealing malware is installed, the new password is stolen the moment you type it. Clean the device first, or use another one.
- Skipping the forwarding and filter check. Google lists forwarding, filters, delegation and IMAP/POP changes as signs of compromise for a reason. A password change does not remove them.
- Turning on 2-Step Verification with only a text message and no backup. Text codes are better than nothing, but Google notes they are more vulnerable to phone number attacks, and losing the phone without backup codes is its own lockout.
- Trusting a "recovery service" found through an ad or a comment. Google's help does not mention paid recovery services. Scammers target people who just lost an account.
- Ignoring the accounts that depend on Gmail. Your bank, cloud storage and social media may still accept resets to an address an attacker can read.
- Deleting evidence. Do not empty Sent or Trash before you have looked at what happened. You may need that for the bank, the police or your own peace of mind.
- Never revisiting. Many people fix it once and never check again. Look at Recent security events again after a week and after a month.
Securing Gmail on your phone
Most people read Gmail on a phone, and a phone can hold an open session or a password saved in a browser. After a hack, go through these checks.
- Update the operating system and the Gmail app. Security fixes matter more than features here.
- Set a screen lock. Google's compromised-account help recommends using your device's screen lock, and a passkey is only as strong as the lock that protects it.
- Review installed apps. Remove apps you do not recognize, especially ones that ask for accessibility, notification or device administrator access.
- Review which Google apps are signed in. On an iPhone, Google prompts reach the Gmail, Google, YouTube or Google Photos apps, according to Google's 2-Step Verification page, so make sure that you are signed in on a device you control.
- Check your mobile carrier. If your phone suddenly lost service, call your carrier: a SIM swap would let an attacker receive your text codes. Ask about a port-out protection PIN.
If this was a business or Google Workspace account
If you sign in to Gmail through a company address (a Google Workspace account), Google says the standard steps may not work and you must contact your administrator. In a small business that is often the owner or an outside IT provider. Two quick points. First, ask the administrator to review sign-in activity and reset the user's password. Second, look at what the mailbox could reach: customer data, invoices, shared drives. Under Quebec's Law 25 and Canada's federal privacy rules, a breach involving personal information can trigger assessment and notification duties, so write down what happened and when. This is not legal advice: talk to a lawyer or the Commission d'accès à l'information if customer data may have been exposed.
Also warn customers and suppliers about fake invoices or changed bank details sent from your address. Our guide to invoice and vendor fraud explains how that scam works and how to stop it.
What to document
Write down the date you noticed the problem, the symptoms, the suspicious emails, any losses and what you changed. Take screenshots of Recent security events, the device list, and forwarding settings before you change them. If money was taken, give your bank this timeline right away. In Canada you can report fraud to the Canadian Anti-Fraud Centre and to your local police.
How Gmail accounts actually get hacked
Knowing the cause tells you what to fix. In practice, the most common routes are not movie-style hacking but ordinary mistakes and leaks.
| Cause | How it looks | Best prevention |
|---|---|---|
| Reused password leaked elsewhere | Sign-in from a new place, no phishing involved | Unique password per site, password manager, 2-Step Verification |
| Phishing page that looks like Google | You typed your password after clicking an email link | Passkey or security key (they do not work on fake sites), type the address yourself |
| Verification code given away | A caller or message asked you to "confirm" a code | Never share codes: Google says it never asks for them by email, phone or message |
| Malware or info-stealer on your computer | Saved passwords and sessions copied | Clean device, updates, remove unknown extensions |
| Malicious app with mailbox access | Spam continues after the password change | Review apps with access, remove unknown ones |
| SIM swap or text-code interception | Phone loses service, then the account falls | Use an app, passkey or key instead of text codes, add a carrier PIN |
Fake "Google" emails and calls
A big share of Gmail takeovers start with a convincing message: "Your account will be deleted," "Security alert: new sign-in from another country," or "Your storage is full." Some even include a phone number, so you call the scammer yourself. Rules that protect you:
- Do not click the link. Open your Google Account yourself and check Recent security events.
- Google says it never asks for your password or verification codes by email, phone or message, and that you should enter them only at accounts.google.com.
- Do not call numbers in a message. A scam call that asks you to install remote software is a separate problem, see tech support scam warning signs.
- If a text arrives with a link, see our smishing guide.
Realistic scenarios
Realistic scenario (illustrative, invented numbers).
Scenario 1: The forwarding rule
Marie runs a small bakery in Laval. A customer says her invoice email looks different. She finds her password was changed, recovers the account in 25 minutes using her usual laptop, but three weeks later her bank reset code is again stolen. The hidden culprit was a forwarding rule she never checked. After disabling forwarding and removing a filter that hid replies, the problem stopped. Lesson: always check Settings after recovery.
Scenario 2: The old password
Daniel sees a sign-in alert from another country. He still has access, changes his password, turns on 2-Step Verification with an authenticator app and reviews devices. An old tablet he sold two years earlier was still signed in. He removes it. Total time: 20 minutes, zero money lost. Lesson: the device list is not decoration.
Scenario 3: Locked out before a trip
Sophie's recovery phone was replaced by the attacker and the password stopped working. She uses the account recovery page from her home computer and her home Wi-Fi, answers every question including her oldest remembered password, and gets back in on the second try. Her first attempt from a hotel computer failed. Lesson: familiar device and place.
Hacked Gmail checklist
Print or copy this
- ☐ Used a clean device (phone or friend's computer if malware is possible)
- ☐ Reviewed Recent security events, marked "No, it wasn't me" where needed
- ☐ Removed unknown devices in Manage devices
- ☐ Changed Google password to a long unique one
- ☐ Turned on 2-Step Verification (passkey, key or app preferred)
- ☐ Saved backup codes offline
- ☐ Checked recovery phone and recovery email
- ☐ Disabled automatic forwarding, reviewed filters and delegates
- ☐ Reviewed apps with access, turned off less secure app access
- ☐ Changed passwords on sites linked to this Gmail address
- ☐ Scanned the computer, removed unknown Chrome extensions
- ☐ Warned contacts, watched bank statements for two weeks
What it costs: DIY versus paying a technician
Recovering Gmail yourself costs nothing but time. Google does not charge for account recovery and says it never asks you to pay or to share codes. Count on 20 to 60 minutes for a standard cleanup if you can still sign in, and longer if you are locked out and need several attempts. Optional costs are a password manager (often a few dollars a month, check current pricing), a hardware security key (a one-time purchase, often in the tens of dollars CAD) and antivirus if your computer is infected.
| Route | Cost | Best for |
|---|---|---|
| DIY with Google's recovery and this guide | Free, 20 to 60 min | Most people who can still sign in or who have a recovery option |
| DIY plus hardware key and password manager | Small one-time and monthly cost | Anyone who stores business or financial info in Gmail |
| Guided remote session with a technician | One 119.99$ CAD session (60 min Expert Consultation) | Hard cleanups: malware, several accounts, small business |
Important: nobody outside Google can recover a Google Account on Google's behalf. If someone offers to "hack back" or to recover your account for a fee, be careful. A technician can help you with everything around the account: cleaning your computer, securing your phone, setting up stronger sign-in, going through your other accounts and checking settings. IT Cares is not affiliated with Google.
How to prevent the next hack
- Use a passkey or security key for Google where possible: they are tied to the real Google site and do not work on a fake one.
- Keep a second recovery method current: a recovery email and phone you control, plus saved backup codes.
- Use unique passwords through a password manager.
- Install updates on your computer, phone and browser.
- Keep Chrome extensions to a minimum and use Google's Password Alert in Chrome, which warns you when you enter your Google password on a non-Google site.
- Run a security checkup every few months: devices, apps with access, recovery details.
Our broader hacked account recovery guide and the email account hacked guide cover other providers, and the older Gmail account hacked recovery article remains available. This page focuses on the fastest path and the exact settings to check.
When to call a pro
Consider help if you run a business on this Gmail address, if you see signs of malware on the computer, if the same attacker has touched several accounts, or if you are simply stuck in the recovery flow and stressed. IT Cares offers remote support across Canada, and we can work with you on screen: we do not ask for your password and we do not recover accounts on Google's behalf. Call 1 (888) 711-9428 or use the booking button above.
Still stuck? Get a technician on it now
Remote support from IT Cares: we connect to your device, fix it with you watching, and explain what happened.
Frequently asked questions
Related guides
- Gmail account hacked recovery guide (earlier article)
- Email account hacked: recovery guide
- Recover a hacked account
- How to set up two-factor authentication
- Passkeys explained
- Lost authenticator app: recover 2FA access
- Password manager guide
- What is phishing
- Identity theft recovery guide
- IT Cares AI services shop
Sources and official references
Last verified: November 13, 2026
- Google Account Help: Secure a hacked or compromised Google Account (opened 2026-11-13)
- Google Account Help: How to recover your Google Account or Gmail (opened 2026-11-13)
- Google Account Help: Turn on 2-Step Verification (opened 2026-11-13)
- Gmail Help: Check Gmail activity (opened 2026-11-13)
- Gmail Help: Forwarding (opened 2026-11-13)
- Canadian Anti-Fraud Centre: report fraud