ChromeOS · Recovery Guide

How to Tell If Your Google Account Was Compromised on a Chromebook

Spot the signs of a compromised Google account on your Chromebook and confirm your suspicions without making immediate changes.

Unusual Account Activity

Unexpected behaviour can be a key indicator of unauthorised access. Pay close attention to these signs in your Google account.

• Check your Gmail for emails you didn't send, especially those in your 'Sent' folder or 'Spam' that look suspicious.
• Look for unfamiliar contacts in your Google Contacts or changes to your profile information you didn't make.
• Review your Google Drive for new files or documents you don't recognise, or files that have been moved or deleted without your knowledge.
• See if any new or unknown devices are logged into your Google account by visiting your Google Account security settings at myaccount.google.com/device-activity.
• Look out for alerts from Google about unusual sign-in attempts or security changes you didn't authorise.

Chromebook Performance Issues

A compromised Google account might indirectly affect your Chromebook's performance or behaviour. These issues can sometimes point to unauthorized activity.

• Be wary of slower-than-usual performance or frequent crashes on your Chromebook, especially if you haven't installed new apps.
• Look for new or unfamiliar apps or extensions installed on your Chromebook that you don't recall adding.
• Notice if your Chromebook's settings, like the wallpaper or default search engine, have changed without your input.
• See if unusual pop-ups or advertisements appear more frequently whilst browsing, even on trusted websites.
• Check your Chromebook's storage for unexpectedly low space, which could be due to malicious software.

Reviewing Google Sign-in and Security Events

Google provides tools to help you review recent activity and security events on your account. Checking these can help confirm a compromise.

1. Go to myaccount.google.com/security and review the 'Recent security event' section for any alerts about sign-ins or changes you don't recognise.
2. Click on 'Manage devices' under 'Your devices' to see all devices currently logged into your Google account and identify any unfamiliar ones.
3. Examine 'Third-party apps with account access' to find any apps you haven't authorised or don't recognise.
4. Check your 'Sign-in & recovery' options to ensure your recovery phone number and email haven't been altered.

Confirming Without Making Changes

It's important to confirm a compromise without alerting the attacker or making changes that could hinder investigation. These steps help you gather information discreetly.

• Take screenshots of any suspicious activity or settings changes you find in your Google account or on your Chromebook.
• Do not sign out of any suspicious devices or apps; this might alert the perpetrator.
• Avoid changing your password immediately; gather all possible evidence first.
• Make a note of the dates and times of any unusual activity.
• Consider using a different, secure device (like a friend's phone or computer) to access your Google account's security centre if you suspect your Chromebook is compromised.