Hacked on Google Account

Your Google Account was taken. Here's the next hour.

Your Google Account is the master key to Gmail, YouTube, Drive and every password reset. Recover it first.

Does this look familiar

  • Password doesn't work and the recovery phone or email was changed
  • Gmail filters or forwarding rules you didn't create
  • YouTube channel, Drive files or Photos altered
  • A "critical security alert" you dismissed last week
  • Sign-ins from devices or countries you don't recognize

Do these, in order

  1. Email and carrier first

    Before touching Google Account: from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.

  2. Start recovery at accounts.google.com/signin/recovery from a device, browser and location you've used with the account before. Answer as accurately as you can; guesses hurt more than "I don't know."

  3. Once in: myaccount.google.com/security. Change the password, review "Your devices" and sign out everything unknown, check recovery phone and email, and review two-step verification methods. Add a passkey or hardware key.

  4. Gmail → Settings → Forwarding and POP/IMAP, and Filters and Blocked Addresses. Attackers add silent forwarding and filters that hide security alerts. Delete anything you didn't create.

  5. Security → Third-party apps with account access, and App passwords. Revoke everything unused.

  6. Check Drive sharing, Google Pay methods and YouTube Studio permissions for changes. Then run the full Security Checkup once more.

Avoid

  • Calling any "Google support" number. There isn't one for consumer accounts.
  • Skipping the forwarding and filters check. It's the most common thing left behind.
  • Keeping SMS as your only second step after this.

After you're back in

Make sure it can't happen the same way twice.

  • Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
  • Close that door specifically, then the ones next to it.
  • Assume the same people will try again. They usually do.
  • Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.