Hacked Google Account: How to Recover It (2026)

Quick answer: If you cannot sign in, go to Google's account recovery page (accounts.google.com/signin/recovery) and answer the questions as best you can. Google says to use this page if someone changed your password or recovery phone number, or deleted your account. If you can still sign in, check your devices and recent security events, change your password and turn on 2-Step Verification.

A Google Account covers services such as Gmail, YouTube, Google Drive and Google Photos. If it is hacked, the attacker can reach all of them. Everything below comes from Google's own help pages.

What to do in 3 steps

1. Try to sign in. If you cannot, use the account recovery page above. Answer every question you can. Wrong guesses do not kick you out of the process.
2. If you get in, act at once. Google says that if someone else may be signed in, change your password immediately. Then check your devices and remove any you do not know.
3. Turn on 2-Step Verification and check your recovery phone number and recovery email. Google says 2-Step Verification helps keep hackers out, and that recovery info helps you get back in if someone else uses your account.

If you can still sign in: secure the account now

Google shows separate steps for a computer, an Android phone and an iPhone. The steps below use the wording Google gives for your Google Account at myaccount.google.com. Where the iPhone or Android wording differs, we say so.

• Review recent security events. Open your Google Account, tap Security & sign-in, and on the "Recent security events" panel choose Review security events. If an event was not you, select No, it wasn't me and follow the steps on the screen.
• Check your devices. Go to Security & sign-in, then Your devices, then Manage all devices. You see devices and sessions signed in now or in the last few weeks. To remove one you do not know, tap it, then tap Sign out.
• Change your password. On a computer, go to Security & sign-in, then under "How you sign in to Google" choose Password. On Android, Google starts from your phone's Settings app: Google, then your name, then Manage your Google Account, then the same Security & sign-in and Password steps. On iPhone, Google's steps are different: open the Gmail app, tap your profile picture, then Manage your Google Account, then Personal info, and under "Other info and preferences for Google services" tap Password. Use a password you have not used with this account before. Google says you are then signed out everywhere except some devices, such as devices you use to verify it is you and some devices with third-party apps that have account access.
• Remove apps you do not know. Open Google's linked apps page. Select Access to your Google Account, select the app, choose See details, then Remove access and Confirm.
• Turn on 2-Step Verification. Go to Security & sign-in, and under "How you sign in to Google" select Turn on 2-Step Verification. Google also offers passkeys, which use your fingerprint, face scan or phone screen lock.
• Check your recovery phone and recovery email. Go to Security & sign-in, and under "How you sign in to Google" select Recovery phone or Recovery email. Fix anything you do not recognise. Google says not to use a Google Voice number as the recovery phone.
• Check for "at-risk" sign-in methods. Google says that if it suspects a sign-in method was added without your permission, it restricts it, marks it as an "at-risk" method and sends you a security alert by email. Go to myaccount.google.com/security, select Recent security activity, then select the flagged method. If you do not recognise it, select Remove, and Google strongly recommends you change your password at once. If no one acts, Google says it removes an at-risk method automatically after 30 days.
• Run the Security Checkup. Google describes it as a step-by-step tool with personalised recommendations. It is at myaccount.google.com/security-checkup.

If you are locked out

1. Open the account recovery page. Google says you will be asked some questions to confirm the account is yours.
2. Answer as many questions as you can. If you are unsure, guess. Google says not to skip questions.
3. If asked for the last password you remember, enter the most recent one you recall. If you cannot remember it, use an older one. The more recent, the better. Be exact with capital and small letters.
4. Use a device and browser you have signed in on before, and be in a place where you usually sign in, such as home or work.
5. If asked for an email you can check, use one that is already on the account: a recovery, alternate or contact email address.
6. Reset your password when asked. Choose one you have not used with this account before.

If you do not know which address to use, Google has a username recovery page. It asks for a phone number or recovery email on the account, and the full name on the account.

Someone else is using my account: the attacker changed my password, phone and email

This is the hardest case. Google's hacked-account page tells you to use the same account recovery page. It lists three reasons to use it: someone changed your account info, such as your password or recovery phone number; someone deleted your account; or you cannot sign in for another reason.

• Keep trying. If you see "Google couldn't verify this account belongs to you", Google says you can try again.
• Wait a few days if you changed recovery info. Google says changes to recovery info can take up to 7 days to take effect, so try again after a few days.
• Old phone or email may still get codes. Google says that if recovery info is changed, it may send codes to the previous info for 7 days. Check any old phone number or email you used.
• You may be asked for a selfie video. Google says that if you cannot sign in, you may be asked to record a short video of your face and do an action such as turning your head. It is compared with a selfie video you added earlier, so this only helps if you added one before. Google says not every recovery option is available in every region or on every account.
• A recovery contact may help. If you added a trusted person as a recovery contact, Google says they can help you get back in. You may be asked to tap Get number and give that number to your contact; Google says it expires in 15 minutes. Google says you must wait 7 days after they accept before you can use them, and you cannot add a recovery contact while you are locked out.
• You may see a security hold. Google says a recovery request can be held for a few hours or a number of days if something about it looks unusual, and that it uses this time to alert the real owner. If you get access to a device where you normally sign in during the hold, Google says you can start recovery again from it.

Once you are back in, check for "at-risk" sign-in methods the attacker may have added (see the steps above).

Check Gmail forwarding rules and filters

Google says to correct at once any unfamiliar change to these Gmail settings: mail delegation (people with access to your Gmail), automatic mail forwarding, scheduled emails, your name in Gmail, automatic reply (vacation responder), the address on outgoing mail, blocked email addresses, IMAP or POP access, filters and labels. It also says to look for sent emails you did not write.

If the account was deleted or went inactive

Google says a recently deleted account may still be recoverable through the same recovery page. It says that if the account was deleted a while ago, you may not be able to recover it. Google also says it can delete an account that has not been used for 2 years, after sending notices to your account and recovery email.

After you are back in

• Look at Gmail, YouTube, Drive and Photos for things you did not do, such as sent mail, videos, shared albums or deleted files.
• Check Google Pay and Google Play for purchases you do not know. Google's page links to ways to report unauthorised charges.
• Change the password on other sites that used the same password as your Google Account. Google's page says to do this.
• If bank, tax or passport details were saved in your account, or you think someone is using your identity, Google says to contact your bank or local authorities.
• Tell your contacts not to trust messages sent in your name. If money was lost, see The Second Scam and report it to your bank and the police.

Warning: fake "recovery" services

Google says you cannot call Google for help signing in, and that it does not work with any service that claims to give account or password support. Do not pay anyone who offers to get your account back. Google also says it never asks for your password or verification codes over email, phone call or message, and that you should only enter them at accounts.google.com.

If you are being threatened or blackmailed

If someone with access to your photos, files or messages threatens to share them, do not pay. See our sextortion and blackmail guide and report it to the police.

If it is a child's account, or a work or school account

If the account belongs to a child, ask a parent or trusted adult to help. For a child under 13 (or the age that applies in your country), Google says you can reset your child's password, and links to its families help page for the steps. For a work or school account, Google says the normal steps might not work, so ask your administrator.

What Google does not promise

Google says you cannot call it for help signing in. Its pages do not promise that recovery will work. The only timing it gives is that a request on security hold can take a few hours or a number of days. If you still cannot recover the account, Google's page says you can create a new Google Account.

We checked the steps against Google's own help pages on 27 October 2026; menus change, so follow the on-screen prompts if they differ.

Sources

• Secure a hacked or compromised Google Account
• How to recover your Google Account or Gmail
• Tips to complete account recovery steps
• Set up recovery options
• Add, manage & use recovery contacts
• Why your account recovery request is delayed
• Manage at-risk or new sign-in methods on your Google Account
• See devices with account access
• Change or reset your password
• Manage links between your Google Account and apps from other developers
• Share some access to your Google Account data with apps from other developers
• Turn on 2-Step Verification
• Sign in with a passkey instead of a password
• Recover a recently deleted Google Account
• Inactive Google Account Policy
• Automatically forward Gmail messages to another account
• Security Settings and Tools for Your Protection (Google Safety Center)

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.