Explainer
Secure your Google Account after a hack
Short answer
Regaining sign-in is only the first checkpoint. Review settings that could keep another person connected and protect other accounts tied to the same address.
Open Google Account securityWe never ask for your account address, password or verification code. AccountsAid cannot recover an account for you.
Review the account in layers
Work from active access outward.
-
Change the password
Use a unique password, and replace it anywhere it was reused.
-
Check security events and devices
Mark events that were not yours and sign out unfamiliar sessions.
-
Inspect methods and apps
Review recovery contacts, two-step factors and third-party access.
-
Check connected products
Look for unfamiliar Gmail forwarding, Drive sharing and other changed settings.
High-impact data
Note: If banking or identity details could be exposed, Google's guidance says to contact the relevant bank or authorities as needed.
After access returns, close the remaining doors
Recovery of the password is only the entry point. Work through controls that can keep access open or redirect information after you sign in again.
-
Sign-in
Replace a compromised password and review the methods that could let someone sign in again.
-
Sessions
Check recent security events and devices; sign out sessions you do not recognize.
-
Recovery contacts
Check whether the recovery phone, email and other methods still belong to you.
-
Connected access
Review third-party access and product-level changes such as Gmail forwarding or filters.
Official sources
Primary Google guidance referenced on this page.
- Google Account Help · Compromised account — support.google.com
- Google Account Help · Account devices — support.google.com
- Open Google Account security — myaccount.google.com