Gmail Hacked Recovery Lab: Your First Hour
Your email password stops working and a friend gets a strange message from “you”. Your inbox is the key to your bank, shops and social accounts. Live the first hour, make the calls, and see what gets the account back and keeps everything behind it safe. Prefer to read first? Start with the step-by-step guide to a hacked Gmail.
You are Marcus Webb. This morning your email password stopped working, and a friend says they got an odd message from you. Across 11 decisions you live the first hour: getting back in, closing the back doors, and protecting the accounts that rely on this inbox to reset their passwords. Everything here is fictional: the people, shops and addresses. Each call is scored 0 to 10, with reasons based on Google's own help pages.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab: a fictional person's email password stops working, a friend gets an odd message, and you have an hour to put it right.
- You make 11 scored decisions: account recovery, devices, forwarding and filters, recovery details, 2-Step Verification, third-party apps, warning contacts, and the bank and shop accounts that reset through this inbox.
- The reasoning follows Google's own Account Help pages on securing a hacked account, recovering an account and Gmail forwarding.
- Free to play. You get a final score and grade, a shareable scorecard and next-step links. A downloadable debrief is available with a paid plan.
- Defensive and educational only. Every person, shop and address is fictional and no real accounts or links appear.
Frequently asked questions
Is this a real Gmail account or real attack?
No. The people, the shop and the addresses are fictional and use reserved example names. Nothing connects to Google or to your account.
Where does the advice come from?
From Google's own Account Help pages on securing a hacked Google Account, recovering your account and forwarding Gmail. The blog guide links each page so you can check the current steps.
Is changing my password enough after a Gmail hack?
No. Google's checklist also covers unfamiliar devices, forwarding rules and filters you did not set up, recovery phone and email, 2-Step Verification and third-party apps.
Why does the lab focus on other accounts?
Many sites send password reset links to your email. Whoever controls the inbox can request them, so the bank, shop and social accounts behind it need attention too.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum. Every answer comes with a short reason, so you learn why a choice helps or hurts.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.