--- title: "Gmail Hacked? What to Do in the First Hour" url: https://playciso.com/blog/gmail-hacked-what-to-do updated: 2026-11-07 section: Blog publisher: PlayCISO --- # Gmail Hacked? What to Do in the First Hour > Gmail taken over? Recover the account, remove hidden forwarding rules, sign out intruders and secure the accounts your email unlocks, step by step. Source: https://playciso.com/blog/gmail-hacked-what-to-do · Published: 2026-11-07 · Publisher: PlayCISO (https://playciso.com) --- **If your Gmail has been hacked, start with Google's account recovery page, answer its questions as best you can, and set a new password. Then go further than the password.** Google's own checklist for a compromised account also covers unfamiliar devices, Gmail forwarding rules and filters, recovery details, 2-Step Verification and third-party apps. After that, turn to the accounts your email can reset, because an email inbox is the master key to the rest of your online life. That last point is why a Gmail takeover is worse than it looks. Many shops, banks, social networks and work tools offer a "forgot password" link that is sent to your email address. Whoever controls the inbox can ask for those links. So the order of work is: get the inbox back, close the back doors the intruder may have left, then protect everything that trusts this address. ## Do this now: the first hour - Try recovery. If you cannot sign in, use Google's account recovery page. Google says to answer the questions as best you can, that wrong guesses do not end the process, and that there is no limit on attempts. If you can sign in, go straight to the next step. - Set a new, strong password that you have never used on this account or anywhere else. Google asks for one that is strong and not used with this account before. - Review security activity. In your Google Account, open Security and sign-in and look at recent security events. Google says to select that it was not you for anything you did not do. Menu names change, so follow the official help page linked below. - Sign out unknown devices. Check the list of devices signed in to your account and remove any you do not recognise. This is how you end other people's sessions. - Check Gmail forwarding and filters. This is the step people skip. In Gmail settings, look at the forwarding section and disable forwarding you did not set up, then review filters and labels and delete rules you did not create. Google's checklist also says to check mail delegation and IMAP or POP access. A common pattern is a rule that forwards copies of your mail to another address, or hides reset emails, so the intruder keeps seeing your mail after you have a new password. - Fix recovery details. Check your recovery phone, recovery email, alternate email and account name. Google says to correct the setting immediately if you see unfamiliar changes. Google also notes that changes to recovery info can take up to 7 days to take effect, so be careful with them. - Turn on 2-Step Verification, or check that it was not switched on or off without your knowledge. Consider a passkey too; see Google's passkey help page. - Remove third-party access. Review the apps with access to your Google Account and remove any you do not recognise. - Look at what was sent. Open Sent and Trash for mail you did not write: scam requests to your contacts, or messages that reset other accounts. This tells you which people to warn and which accounts were probed. - Warn your contacts by phone or messaging, not by email: do not click links, send money or share codes based on messages from your address. Practise these decisions in the [Gmail Hacked Recovery Lab](/tools/gmail-hacked-recovery-lab), a scenario with fictional people where nothing real is at stake. ## The accounts your email unlocks Google tells you to change passwords on apps and sites that use the same password, that email you through your Google Account address, or where you saved passwords. Work through them in order of damage: - Money: banks, cards, payment apps, shopping accounts with saved cards. Check for new payees, address changes and orders, and contact your bank if anything looks wrong. Google's page itself says to check for unauthorized financial activity. - Other email and cloud accounts: a second email address, cloud storage and phone-company accounts. These can be used to reset yet more accounts. - Social media and messaging: these are where contacts get impersonated. - Work and school accounts: if your work email is separate, tell your IT or security team about any shared passwords or forwarded work mail. - Anything with the same password as the hacked account. Change it to something unique. A password manager makes unique passwords practical. Check a candidate with the [Password Strength](/tools/password-strength) tool. ## How to tell if your Gmail was hacked - You cannot sign in and your password no longer works. - Security alerts about sign-ins or changes you did not make. - Sent mail you did not write, or contacts replying to messages you never sent. - Settings changed: forwarding, filters, recovery phone or email, or 2-Step Verification turned on or off. - Unfamiliar devices in your account's device list, or apps you did not approve. - Missing mail: reset and security emails vanishing can mean a filter is hiding them. - Odd activity elsewhere: reset emails you did not request, or order confirmations for things you did not buy. ## Prevent it next time: a checklist - Turn on 2-Step Verification and use a passkey where you can. - Use a unique password for your email, different from every other site. Your email password is the most valuable one you have. - Keep recovery phone and email current and under your control. - Never share verification codes, and ignore anyone offering to "recover" your account for a fee; Google says it does not work with account recovery services. - Review devices, third-party apps, forwarding and filters a few times a year. - Use a separate address for banking and important accounts than for newsletters and shopping. - Be careful with sign-in links in emails. Open the site yourself instead; see the [Account Takeover Lab](/tools/account-takeover-lab) for practice. ## Frequently asked questions ### How do I know if my Gmail has been hacked? Common signs are being unable to sign in, security alerts you did not trigger, sent mail you did not write, contacts reporting odd messages from you, and settings you did not change such as forwarding, filters or recovery details. Google says to review security activity and your device list in your Google Account and mark anything unfamiliar as not you. ### How do I get my hacked Gmail account back? Use Google's account recovery page and answer its questions as best you can. Google says wrong guesses do not end the process and there is no limit on attempts. Never share your password or verification codes with anyone claiming to help, because Google says it cannot help you sign in over the phone. ### Is changing my password enough? No. Google's hacked-account steps also say to remove unfamiliar devices, remove Gmail forwarding rules and filters you did not set up, correct recovery phone and email changes, turn on 2-Step Verification and remove third-party apps you do not recognise. ### Why do I have to check my other accounts? Many sites send password reset links to your email address. Whoever controls the inbox can request those resets. Google tells you to change passwords on apps and sites that email you through your Google Account address, or that use the same password. ### What should I tell my contacts? Tell them, by phone or another channel, not to click links or send money based on messages from your address, and to ignore any request for codes or payments. Do not assume the intruder only used your sent folder; check it, then warn the people who received mail. ### Should I use a passkey? A passkey signs you in with your device's fingerprint, face or screen lock instead of a password, so there is no password to steal. Google supports passkeys on Google Accounts; see its passkey help page for the current steps. ## Sources - [Google Account Help: Secure a hacked or compromised Google Account](https://support.google.com/accounts/answer/6294825) - [Google Account Help: How to recover your Google Account or Gmail](https://support.google.com/accounts/answer/7682439) - [Gmail Help: Automatically forward Gmail messages to another account](https://support.google.com/mail/answer/10957) - [Google Account Help: Sign in with a passkey instead of a password](https://support.google.com/accounts/answer/13548313) *This is general guidance, not legal advice. Google's menus and wording change; follow the official help pages above for the current steps.*