Hacked Google account: what to do, in which order.

You can still sign in

1. Work from a clean deviceA device you normally use that is not involved in the incident.
2. Review recent security activity and your devicesIn your Google Account, under Security: sign out devices you don’t recognise.
3. Change the passwordRight away, with a new, unique password.
4. Check your recovery informationRecovery phone and email: fix them if they changed, before removing anything else.
5. Clean up GmailRemove filters, forwarding and labels you didn’t set up, and check delegates.
6. Remove unknown accessThird-party apps and services with access to your account: remove the ones you don’t recognise.
7. Turn on 2-Step VerificationIt helps keep an intruder out of the account.
8. Change the other passwords concernedOn sites that reuse the same password or reset through this address — banking and payments first.

You can no longer sign in

1. Open the official recovery pageOnly on accounts.google.com. Answer the questions as best you can: a wrong guess doesn’t kick you out of the process.
2. Use a familiar device and locationA computer or phone you often sign in with, the same browser, a usual place such as home or work.
3. Keep the device that is still signed inDon’t sign out of a device that still has access to the account.
4. If money is involved, call your bankBefore anything else, if payment accounts depend on this address.

What not to do

• Never give your password or a verification code: Google states it never asks for them by email, phone call or message.
• Don’t pay a “recovery service”: Google states it works with no such service.
• Don’t delete the account and don’t remove the last recovery method that still works.
• Don’t change security settings from a device you don’t control.

Warning signs

• A Google security alert for a sign-in or change you didn’t make.
• Your password no longer works.
• An unknown device in the list of devices with account access.
• Emails sent in your name, or messages disappearing.
• An automatic forward or a Gmail filter you didn’t create.
• A changed recovery phone or recovery email.
• Unknown purchases or charges linked to your Google Account.

The legitimate options

• Google’s official procedure

  Securing the account if you are signed in, recovery otherwise. It is the only route back to access.

• Google’s Security Checkup

  The tool lists what to fix in your account.

• Reporting to the NCSC

  The Federal Office for Cyber Security collects reports and publishes advice for hacked accounts.

• Police and your bank

  If money was lost or your identity is being used.

When a specialist helps

• The official recovery has failed several times.
• The intruder changed your recovery phone or email.
• Bank, payment or business accounts depend on this address.
• You don’t know whether the intruder keeps access (app, forward, passkey).
• It is a company Google Workspace account: the administrator must be involved.