What Happens If Someone Hacks Your Google Account?
When one Reddit user accidentally downloaded ransomware onto their laptop, the virus turned out to be the least of their worries. Just hours after the attack, hackers had taken over the victim’s Gmail account and used it to access other linked accounts — including their YouTube channel, Facebook, Spotify, and more [*].
On average, each American has more than 100 different accounts linked to their email address — making Google accounts prime targets for scammers [*]. Even worse, according to the latest Dark Web data [*]:
A hacked Google account can sell for as little as $60 on the Dark Web — giving hackers easy access to your most sensitive accounts and personal information.
If you’ve seen signs that your Google account is hacked, you need to act quickly. In this guide, we’ll explain how you can tell if your Google account is hacked, how to recover it, and the easiest ways to secure all your online accounts against hackers.
⚡️ Was your Google account hacked? Act fast! Scammers can use your hacked gmail account to access your social media, banking, and more. Identity Guard monitors and protects your finances, online accounts, and identity — Save 33% when you sign up today.
How To Tell If Your Google Account Is Hacked: 7 Warning Signs
Hackers have multiple ways to gain access to your Google account. They could guess weak passwords, buy or find leaked credentials after a data breach, or trick you with phishing attacks.
While Google spends millions of dollars a year on digital security, the company can’t prevent you from clicking on malicious links or reusing passwords across less secure accounts. (For context, more than two-thirds of internet users reuse passwords across platforms [*]).
If you’re noticing something strange about your Google account, look for these warning signs:
Your Google password has been changed
If you receive an unexpected notification that your password has been changed, it means someone is trying to lock you out of your email account. If you don’t have any additional security settings enabled — such as two-factor authentication (2FA) — this warning message could mean your account is now fully compromised.
You’re notified that your recovery email or phone number was updated
Hackers may change your account recovery information to prevent you from regaining access or proving your identity to Google. A notification or email stating that your recovery phone number or email has been updated is a clear indication that your account is hacked.
Unfamiliar third-party apps are connected to your Google account
Hackers sometimes gain backdoor access to your accounts by connecting unusual third-party apps or services. These accounts can be used to access your Google account or even make posts in your name.
There are strange emails in your Gmail “sent” folder
Sometimes, hackers only want access to your Gmail account in order to send emails from your address. Scam messages sent from legitimate email accounts are more likely to trick victims. If you see messages in your “sent” folder that you know you didn’t send, it could mean you’ve been hacked.
Your emails are being automatically forwarded to another address
Email forwarding allows scammers to intercept private messages sent to your email inbox. In this case, both you and the hackers have access to your email inbox. They may not kick you out of your account, but they can see every message you receive.
Someone from a different IP has logged in to your account
Google shows users a history of account activity on the Last Account Activity page. If you see an unfamiliar IP address, device, or location on this page, it means someone has access to your account. Be aware that smartphones and tablets may show mobile carrier information that doesn’t correspond to your location. As long as you recognize the device and carrier, an unfamiliar location is not unusual.
Your contacts are getting strange emails from you
If friends or family members complain about getting unusual messages from you, it might mean hackers are using your email address to scam them. They may be sending automated messages to trick your contacts into downloading malicious files, or they may impersonate you and ask for money directly.
💡 Related: Was Your Email Found on the Dark Web? Do This! →
How To Recover a Hacked Google Account
The moment you notice unauthorized activity in your Google account, you should immediately respond by tightening your security settings.
If you can still sign in to your account, this process is relatively simple. However, if hackers have already locked you out of your account, you’ll need to take extra steps to prove your identity and regain access.
Here’s what to do if your Google account has been hacked:
If You Can Still Sign In: Secure Your Google and Linked Accounts
If you find strange “sent” emails or linked apps in your Google account, you’ll want to secure your account and update your credentials to lock out hackers.
To do so, follow these steps:
Change your Google account password
The first thing you should do is change your Google account password. Make sure you choose a password that is unique and complex — for example, at least 10 characters long, and a combination of uppercase and lowercase letters, numbers, and special characters.
On your computer:
- Open your Google Account and sign in.
- Click on Security, and select Signing in to Google.
- Click on Password. Google may require you to sign in again.
- Enter your new password, and confirm.
On your Android device:
- Open your device’s Settings app, tap on Google, and navigate to Manage Your Google Account.
- Tap on Security, and scroll to Signing in to Google.
- Tap on Password. Google may require you to sign in.
- Enter your new password, and confirm.
On your iOS device:
- Open the Gmail app on your iPhone or iPad.
- Tap on your profile picture (or your initials) and choose Google Account.
- Tap on Personal info, and then Password.
- Enter a strong password, and confirm.
When you change passwords, you should create a brand-new gmail password that is strong and unique. It should have no connection whatsoever to your old password – simply adding characters to an existing password isn’t enough.
Change your Google account recovery details
At the same time that you update your password, you should make sure that you have up-to-date and accessible account recovery options.
On your computer:
- Open your Google Account and click on Personal info.
- Next, click on Contact info, where you will see both Phone and Email listed.
- Enter a phone number and new recovery email address that you trust, and confirm.
On your Android device:
- Open your device’s Settings app, tap on Google, and navigate to Manage Your Google Account.
- Tap on Security; you will see Recovery Phone and Recovery Email.
- Enter a phone number and email address that you trust, and confirm.
On your iOS device:
- Open the Gmail app on your iPhone or iPad.
- Tap on your profile picture (or your initials) and choose Google Account.
- Tap on Security and look for Recovery Phone and Recovery Email.
- Enter a phone number and email address that you trust, and confirm.
Enable two-factor authentication on your account
Two-factor authentication (2FA) helps secure your account against hackers who know your password. With 2FA enabled, you’ll be required to provide a secondary “authentication” method when signing in to your account — such as a one-time-use code sent to your phone or via an authenticator app like Authy.
Enabling 2FA makes your account much more secure. If you haven’t done it already, this should be high on your list of steps to take.
Here’s how to set up two-factor authentication on Google:
On your Android device:
- Make sure your Android phone has updated Google Play services. This is required to support Google authentication prompts.
- Sign in to your Google account and select Security.
- Select 2-Step Verification and tap on Get Started.
- Follow the on-screen instructions.
On your iOS device:
- Make sure your iPhone has Google Smart Lock, Gmail, Google Photos, YouTube, and the Google app signed in to your Google account.
- Google will automatically send authentication prompts to your device as long as you’re signed in.
- When someone attempts to access your account, you’ll receive a notification.
Update your security settings on linked accounts
If hackers break into your Google account, they can easily request password changes to all of your connected third-party apps and accounts. This includes everything from your social media profiles to your bank account and credit card information.
Take a moment to categorize your connected accounts and review your account settings.
Prioritize changing passwords and enabling two-factor authentication on your most sensitive accounts. These will generally be financial and work-related accounts. You should also tighten security for your social media accounts in case hackers try to use your identity to scam your friends and family members online.
💡 Related: Social Media Security: How To Secure Your Profile →
If You’re Locked Out: Recovering a Hacked Google Account
If you’re locked out of your Google account, you’ll have to verify your identity with Google before it will give you permission to enter your account.
Here’s what you need to do:
Answer the security questions on Google’s account recovery page
Start by signing in to Google and clicking on Forgot password, or accessing Google’s Account recovery page directly. This will launch the account security process to verify your identity.
This process involves multiple steps, and it isn’t always the same for every user. Here are some tips on how to succeed:
- Use a familiar device and location. Google will compare your device, browser information, and IP address data from your previous logins while you recover your account. If you usually access Google from your phone’s Chrome web browser, trying to access recovery options from a different device might look like suspicious activity to Google.
- Answer as many questions as you can. Google will ask you a series of questions to verify your identity. Many of these questions will draw on your memory, usage history, and personal details that you’ve shared with Google. You can skip questions, but it’s usually better to guess even if you’re unsure of the answer.
- Be detailed and exact with previous passwords. Google may ask you to provide previous passwords you’ve used. Avoid typos, and pay attention to uppercase and lowercase letters. The more accurate your answers are, the better chances you have of passing the security test.
Use Google’s “Security Checkup” feature
Once you regain access to your account, review your Security Checkup page. Google will alert you if there is anything that requires your immediate attention.
Afterwards, you can investigate your security data to find out how hackers gained access to your account. Consider taking time to go through your password and authentication information to tighten your account against hackers.
Here are two things you should do once you regain access to your account:
- Update your passwords. Even if hackers only had temporary access to your Google account, they may have figured out how to hack your other accounts. Use Google’s Security Checkup feature to change your passwords for connected third-party apps and services.
- Enable dual-factor authentication. You can set up two-factor authentication (2FA) for connected third-party services through Google’s Security Checkup menu. Enable this feature for every connection that supports it so that hackers need more than your password to infiltrate your accounts.
Review which devices have access to your Google account
Google’s Security Checkup feature can show you which devices have access to your Google account. Take time to confirm that you recognize every device that has access to your account, and disconnect as many as possible — even devices that you own but rarely use. If hackers locked you out, you should see at least one connection that shouldn’t be there.
As an added precaution, use antivirus software to verify that all of your devices are free from malware and keyloggers before signing back in to Google.
Run a full antivirus scan on your device
Many malware variants can grant attackers access to your Google account. Some of them log your keyboard input and send the data to hackers, allowing them to learn your password. If your device is infected with this kind of malware, changing your password won’t protect you from getting your account hacked.
Be aware that many free antivirus scans actually distribute malware to unsuspecting users, or sell their information to cybercriminals running tech support scams. You should only trust antivirus scans from reputable companies. While most of these scans require purchasing a subscription, the added security they provide is well worth the cost.
Revoke app passwords on your account
Your Google account supports app passwords that allow certain apps to access your account separately from the way most apps do. These app passwords allow devices that don’t support two-step authentication to access your account.
App passwords are not as secure as Google’s preferred two-factor authentication process. Hackers may be able to gain access to your account by abusing these special connections, so you should remove them until you’re sure your account is safe.
To remove an app password, simply access your App Passwords page and then add, edit, and delete any unrecognized or unused apps directly from the list.
Check for — and unlink — unfamiliar third-party apps and accounts
You may be surprised to discover how many third-party apps and accounts you’ve connected to your Google account (i.e., any account that supports “sign in with Google”). If someone has attempted to break into your account, you may need to verify each of these connections and delete ones you don’t use or recognize.
Here’s how you can find every connection linked to your gmail account:
- Enter your Google Account on a PC, and click on Manage Your Google Account.
- Select Security on the left menu. Scroll down to Google apps with account address.
- Click on Manage access, and scroll down to the bottom to edit Linked Accounts.
- Here you’ll find every third-party account you’ve linked to your Google account. Review them, and remove the ones you no longer need.
Start using a secure password manager
Password managers make it much easier to create, assign, and manage complex passwords without relying on memory. If you are changing your passwords in response to an account takeover attempt, you should consider using a password manager to make the process faster, easier, and more secure.
Identity Guard provides a professional password manager to customers alongside 24/7 fraud protection and sophisticated credit monitoring.
🏆 Save on award-winning protection. Save 33% when you sign up for Identity Guard today, and safeguard your accounts with industry-leading security tools backed by a $1 million insurance policy against identity theft.
How To Protect Your Google Account From Hackers
Recovering a hacked Google account can be challenging, but the longer you delay the more damage hackers can do. Once you’ve regained access to your account, you should secure it against future hacks.
Here are some ways you can safeguard your Google account:
- Use strong, unique passwords for every account you own. Don’t leave weak or compromised passwords on old accounts. If you’re not sure if your passwords are safe, use a free Dark Web scanner to see if they’ve been leaked online.
- Always enable two-factor authentication, preferably by using an authenticator app. Avoid relying on SMS verification codes for two-factor authentication as they don’t offer the same security as purpose-built authenticator apps like Google Authenticator.
- Periodically review your account’s contact and recovery information. If your contact and recovery information is out of date, this will make it much harder for you to regain access to your account following an attack.
- Sign up for Google password alerts. Google can warn you when someone uses your password to sign in to non-Google websites. This provides you with an early warning that one of your passwords may be compromised.
- Secure your devices and accounts with digital security tools. Digital security providers like Identity Guard protect you from many of the scams that hackers use to gain unauthorized access to your accounts. When you sign up for Identity Guard, you get 24/7 protection and monitoring against the latest scams, along with White Glove Fraud Resolution support and sophisticated Safe Browsing tools.
The Bottom Line: Keep Your Google Account Safe From Hackers
Google accounts are valuable targets for cybercriminals who want to gain access to a wide variety of third-party accounts and services. Safeguarding your Google account makes it much harder for scammers and hackers to take advantage of those connections.
This doesn’t mean you need to memorize dozens of unique passwords or constantly monitor the Dark Web for leaked credentials. Instead, you can rely on Identity Guard to provide you with industry-leading digital security tools, 24/7 award-winning identity and credit monitoring, and comprehensive protection against fraud – including $1 million in insurance coverage for eligible losses due to identity theft.
