Secure a hacked or compromised Google Account

Go to the account recovery page and answer the questions as best you can. These tips can help.

Use the account recovery page if:

• Someone changed your account info, like your password or recovery phone number.
• Someone deleted your account.
• You can't sign in for another reason.

1. Go to your Google Account.
2. On the left navigation panel, select Security.
3. On the 'Recent security events' panel, select Review security events.
4. Check for any suspicious activity:
   • If you find activity that didn't come from you: Select No, it wasn't me. Then, follow the steps on the screen to help secure your account.
   • If you did the activity: Select Yes. If you still believe that someone else is using your account, find out if your account has been hacked.

1. Go to your Google Account.
2. On the left navigation panel, select Security.
3. On the 'Your devices' panel, select Manage devices.
4. Check for any devices that you don't recognise.
   • If you find a device that you don't recognise: Select Don't recognise a device? Then, follow the steps on the screen to help secure your account.
   • If you recognise all the devices, but still believe that someone else is using your account: Find out if your account has been hacked.

Two-step verification helps keep hackers out of your account. With two-step verification, you sign in with:

• Something that you know (your password)
• Something that you have (your phone, a security key or a printed code)

That way, if your password is stolen, your account is still secure.

Turn on two-step verification

Make sure that someone else didn't give your bank or government instructions, like to open an account or transfer money. This is important if you:

• Have banking info saved in your account, like credit cards saved in Google Pay or Chrome.
• Have personal info like tax or passport info saved in your account. For example, you might have personal info saved in Google Photos, Google Drive or Gmail.
• Think that someone is using your identity or impersonating you.

Some Internet browsers have security weaknesses. Consider using a more secure browser, like Google Chrome.

If you enter your password on a non-Google site, Password Alert on Google Chrome notifies you. That way, you'll know if a site is pretending to be Google to steal your password.

• If access for less secure apps is turned on, we strongly suggest turning it off since it may make your account less secure.
• Use your device's screen lock option if it has one.

• Gmail: Review these security tips and remove any labels, filters or forwarding rules that you didn't set up.
• Chrome: Uninstall extensions that you don't recognise and update Chrome to the latest version.
• Google Drive: Review your activity and file versions for anything unusual.
• Google Photos: If you see album sharing that you don't recognise, stop sharing the album.
• Location: Turn off Location Sharing that looks unusual.

• Your Google Account, if you didn't change it already
• Apps and sites:
  • That you use the same password you used for your Google Account
  • That contact you through your Google Account email address
  • Where you sign in with your Google Account email address
  • Where you saved passwords in your Google Account

You can then check for and remove any unfamiliar devices signed in to your account.

Correct the setting immediately if you see unfamiliar changes to these settings:

• Your recovery phone number.
• Your recovery email address.
• An alternative or contact email address.

Review your emails

• The name on your Google Account.

Review your name

• Your security question. 
  • Tip: Additional security questions are no longer available.
• Apps with access to your account.

Review apps with access

• If this setting was turned on or off without your knowledge:
  • Two-step verification 
  • Less secure app access
• Two-step verification methods. 
• Location Sharing.

Your financial activity might be suspicious if:

• On Google Pay
  • You don't recognise purchases: To request a refund, report unauthorised charges.
  • You don't recognise one or more bank accounts, credit cards, debit cards or gift cards: Remove a payment method that you don't recognise.
• On Google Play, you don't recognise purchases: Report unauthorised charges.
• On Google Chrome, payment info that you don't recognise is set up: Delete unfamiliar payment info.
• On Google Ads, you notice unauthorised charges or ads: Ask the Google Ads team to review your account for unusual activity.
• On Google AdSense, you notice that payments aren't going to the correct bank account: Check your AdSense payment method.

Tip: To tell you about suspicious activity, we'll use your recovery phone number and email address.

Gmail settings

Gmail activity

Your YouTube activity might be suspicious if:

• Your YouTube channel has videos that you didn't upload, comments you didn't make or unfamiliar changes to your:
  • Channel name
  • Profile photo
  • Descriptions
  • Email settings
  • Sent messages

Your Google Drive activity might be suspicious if:

• You find Google Drive activity that you don't recognise.
• Files were deleted from your Drive without your knowledge. You can try to recover your files.

Your Google Photos activity might be suspicious if:

• Your photo albums are shared without your permission.
• Your photos are shared with a partner, and you didn't add a partner account.

Your blogger activity might be suspicious if:

• Posts that you didn't publish appear on your blog.
• You get comments on posts that you didn't publish.
• Your mail-to-blogger address has changed, but you didn't change it.
• Your blog disappeared or was blocked.

Your Google Ads activity might be suspicious if you find unfamiliar:

• Ads that point to unknown links or destinations
• Increases in your ad spend
• Changes to account owners, managers or users