How to recover a hacked Google account

Recovering a hacked Google account can be a distressing experience, as it often contains personal information, including emails, documents, photos, and even financial details linked through various services like Google Pay.

The good news is that Google provides several tools and steps to help you regain control of your account and secure it against future attacks. This post will guide you on quickly spotting and recovering a hacked Google account.

Get ExpressVPN

Jump to…
How to secure a hacked or compromised Google account
How can I recover my Gmail password without my phone number and email?
How to tell if your Google Account has been hacked
How do Google account hacks occur?
How to prevent my Google account from getting hacked?

How to secure a hacked or compromised Google account

If you observe any unusual activity on your Google Account, Gmail, or associated Google services, it’s possible that an unauthorized individual has gained access. Should you suspect your Google Account or Gmail has been compromised, taking action immediately is crucial. The following steps will assist you in identifying any suspicious behavior, regaining access to your account, and enhancing its security measures.

1. Sign into your Google account

If you’re still able to, log into your Google account and change your password. Not only does this prevent further access by someone who’s found out your password, but changing it kicks off any devices that are logged in to your account.

If you’re unable to sign in because the attacker changed your password, you’ve simply forgotten it, or for any other reason, go to the account recovery page and answer some questions to verify your identity. If successful, you’ll be prompted to create a new password, and your account will be yours again.

2. Review security events in your account

1. Go to myaccount.google.com.
2. Choose Security from the menu on the left side.
3. Click on Review security events in the “Recent security events” section.
4. Examine any activities that seem unusual.

If you encounter any activity you don’t recognize as your own, click “No, it wasn’t me.” Then, proceed with the on-screen instructions to enhance the security of your account.

If the activity was indeed yours, click Yes.

3. Review the devices where you’re logged in

Another step you can take to check for suspicious access is to see where you’ve logged in to Google in the last 28 days. If there’s any device listed that you don’t recognize, it’s a sign of someone else accessing your account.

1. Go to myaccount.google.com.
2. On the left navigation panel, select Security.
3. On the “Your devices” panel, select Manage all devices.
4. Check if there are any devices that you don’t recognize.
5. If you find unrecognized devices, select Don’t recognize a device? and follow the steps on the screen to secure your account.

You’ll also be shown if you are signed out of devices or sessions. You can sign out from devices by selecting the device and choosing Sign out. If you find sessions on unfamiliar devices, it might mean an intruder has your password and could log back in, so ensure you change your password.

4. Report to the authorities, if necessary

If your Google Account has been compromised and used for financial fraud, identity theft, or illegal activities, report the incident to the authorities. Contacting law enforcement can provide you with additional support and resources to address the breach effectively. Moreover, reporting these incidents helps authorities track and combat cybercrime more efficiently. 

When reporting, be prepared to provide detailed information about the breach, including any evidence of unauthorized transactions, communications from the perpetrator, or other relevant details. Depending on your jurisdiction, you may also want to report the incident to national cybersecurity centers or consumer protection agencies, which can offer guidance on mitigating the hack’s impact and safeguarding your personal information against future threats.

How can I recover my Gmail password without my phone number and email?

If you’ve forgotten your Gmail password, Google can verify your identity through your phone number or a second email that you’ve set up. But if you’ve lost access to both, regaining access to Gmail can be challenging. Still, Google provides alternative methods to help verify your identity and regain access to your account. Follow these steps to attempt password recovery:

1. Go to Google’s account recovery page

Start by visiting the Google Account Recovery page. Enter the email address for the account you’re trying to access and follow the prompts.

2. Select “Try another way”

Since you don’t have access to your phone number or recovery email, you’ll need to click on Try another way when prompted for verification through those methods.

3. Answer the security questions

Google may ask you security questions related to your account. These could include previous passwords you’ve used, security questions you’ve set up, or details about your account usage, like frequently emailed contacts or labels you’ve created. Answer these questions as accurately as possible.

4. Provide additional information

Google might ask for more information to verify your identity, such as:

• An email address you can currently access. Google can use this to communicate with you about your recovery attempt.
• Details about when you created your Google account.
• Names of folders you’ve created in your Gmail.
• Email addresses of contacts you’ve recently communicated with.
• Any Google services associated with the account (like YouTube or Google Drive) and details about your use.

Carefully follow any additional instructions provided by Google. The process might involve waiting for a review from Google’s support team. 

How to tell if your Google Account has been hacked

Here are some common indicators that your account may have been compromised:

1. Unusual activity alerts

Google often sends alerts regarding suspicious activity, such as login attempts from unknown devices or locations. Your account might be at risk if you receive such notifications without recognizing the activity.

2. Unauthorized transactions

Check for any unfamiliar transactions or subscriptions linked to your Google account. Unauthorized purchases are a sign of account compromise.

3. Changes to your account settings or Google profile

If you notice changes in your account settings that you did not make—such as forwarding emails to an unknown address, changes to your recovery information, or altered security settings—it’s likely your account has been hacked.

4. Your Google password has been changed

If you’ve received an unexpected notification that your Google password has been changed, but you did not request the change, it’s likely that someone has hacked your account and is trying to lock you out of it.

5. You see random third-party apps and extensions connected to your account

It’s possible for hackers to gain backdoor access to your accounts through third-party apps and services. Hackers can access your account through these apps or extensions by designing legitimate versions of these apps that offer enticing features, such as ad blocking, search enhancements, or custom themes. These tools, however, are maliciously intended to gain access to your data by requesting personal information.

6. Your account is set to forward emails to a separate account

Email forwarding is a technique used by scammers to gain access to private messages that are sent to your email inbox. In other words, you and the hackers can both view your email inbox.

7. Your contacts are getting fake emails from your account

When friends or contacts report receiving spam, phishing emails, or messages pretending to be you from your account, it’s a significant red flag indicating that your account security has been compromised. A common attack is using your email to ask friends and family for money.

8. Your account has been logged in on unfamiliar devices or locations

Google provides a feature that allows users to view their account’s recent activity through the Last Account Activity page. If you encounter an IP address, device, or location in this history that doesn’t seem familiar, it indicates that another individual has gained access to your account. 

However, the locations shown for smartphones and tablets might reflect the mobile carrier’s information, which may not always match your location. If the device and mobile carrier are recognizable, encountering a location that aligns differently from your current whereabouts is typically not cause for concern.

How do Google account hacks occur?

Google account hacks can occur through various methods, as hackers continuously develop and deploy sophisticated techniques to gain unauthorized access. Understanding these methods can help users bolster their defenses. Here are some common ways through which Google account hacks happen:

1. Phishing attacks

Phishing is a deceptive technique where hackers send emails or messages that mimic legitimate companies or services. These messages often contain links to fake websites designed to steal login credentials. Unsuspecting users may enter their Google account details into these sites, directly providing hackers access.

Hackers may also use pretexting, which is fabricating scenarios to obtain personal information; baiting, which is offering something enticing in exchange for login info; or scare tactics like convincing users their account is already compromised.

2. Password breaches

If a user employs the same password across multiple platforms, and one of these platforms is compromised, hackers can use the stolen credentials to access the user’s Google account. All the attacker has to do is try it to see. This is why it’s important to use a different password for every account, and it’s also why the use of a password manager is highly encouraged.

Get ExpressVPN

3. Third-party app permissions

Sometimes, users grant permissions to malicious third-party apps. These apps can then access personal information and account details. Users might unknowingly authorize these apps to view, send, delete emails, or even change account settings.

4. Malware and spyware

Malware or spyware, such as keylogging software, can lead to account compromises. If a keylogger is installed on a user’s device, it can capture the user’s Google account username and password as they are entered, transmitting this information back to the hacker.

5. Public Wi-Fi vulnerabilities

Using unsecured public Wi-Fi networks can expose users to hacks. Attackers can intercept data transmitted over these networks, including Google account credentials, especially if the data is not encrypted. This is why it’s best practice to use a VPN when using public Wi-Fi to ensure your connection is secure.

6. SIM swapping

If you use two-factor authentication for your Google account, you’ve increased your account security significantly. But if a hacker is motivated enough, they could use a SIM swap attack to foil your SMS second factor authentication. In SIM swaps, attackers manipulate a mobile carrier into switching a victim’s phone number to a SIM card in the hacker’s possession. Once successful, they can receive two-factor authentication codes sent via SMS, granting them access to the account.

How to prevent my Google account from getting hacked?

Cybersecurity can seem overwhelming. But there are ways to safeguard your important online accounts.

1. Use a strong, unique password

A strong password is one that is long and random. Such a password would take a hacker hundreds of years to guess. It’s also important that you don’t repeat passwords for different accounts (or rely on a formula with repeated elements). The problem with having a different strong password for all your accounts is it’s impossible to remember them. This is where password managers come in. With a password manager like ExpressVPN Keys (included with every ExpressVPN subscription), you can generate random, strong passwords, store them behind the high levels of security we’re known for, and easily retrieve them with a primary password—the only one you’ll need to remember.

2. Enable 2FA

Activate two-factor authentication for an additional layer of security beyond your password. This requires you to authenticate your identity using a second method like a one-time code sent to your phone, email, or authenticator app. Even if an attacker has your password, it won’t be able to access your account without secondary authentication. 

3. Be wary of phishing attempts

Learn to recognize phishing emails or messages that trick you into giving away your personal information. Always think twice and verify the authenticity of messages asking for personal details or directing you to log in somewhere.

4. Review your account permissions

Regularly check and manage which apps and services have access to your Google account. Revoke access to any that you no longer use or trust.

5. Monitor account activity

Occasionally review your account’s sign-in activity. Google provides tools to check from where and when your account has been accessed. Log out all other sessions for peace of mind.

6. Secure your devices

Many people remain signed in to accounts on their personal phones and computers for greater convenience. Ensure all devices you use to access your Google account are secured with passwords, PINs, or biometric locks. Keep your operating system and applications updated to protect against vulnerabilities.

7. Only use secure connections

Using secure connections can protect your accounts and sensitive information from being intercepted. This is especially a concern when accessing the internet on public or unsecured Wi-Fi networks. One effective way to ensure a secure connection is with a VPN download—ExpressVPN encrypts all the data entering and leaving your device, ensuring no-one else can see what you’re doing.

8. Use Google’s Security Checkup tool

Google offers a Security Checkup feature that reviews your account’s security settings and suggests improvements for apps or software that may have been impacted. Make it a habit to perform these checkups regularly.