Unusual Account Activity
Unexpected behaviour can be a key indicator of unauthorised access. Pay close attention to these signs in your Google account.
- Check your Gmail for emails you didn't send, especially those in your 'Sent' folder or 'Spam' that look suspicious.
- Look for unfamiliar contacts in your Google Contacts or changes to your profile information you didn't make.
- Review your Google Drive for new files or documents you don't recognise, or files that have been moved or deleted without your knowledge.
- See if any new or unknown devices are logged into your Google account by visiting your Google Account security settings at
myaccount.google.com/device-activity. - Look out for alerts from Google about unusual sign-in attempts or security changes you didn't authorise.
Important
Even a minor change could indicate a compromise; don't dismiss small discrepancies.
Chromebook Performance Issues
A compromised Google account might indirectly affect your Chromebook's performance or behaviour. These issues can sometimes point to unauthorized activity.
- Be wary of slower-than-usual performance or frequent crashes on your Chromebook, especially if you haven't installed new apps.
- Look for new or unfamiliar apps or extensions installed on your Chromebook that you don't recall adding.
- Notice if your Chromebook's settings, like the wallpaper or default search engine, have changed without your input.
- See if unusual pop-ups or advertisements appear more frequently whilst browsing, even on trusted websites.
- Check your Chromebook's storage for unexpectedly low space, which could be due to malicious software.
Good to know
Some performance issues can be general, but multiple issues together warrant closer inspection.
Reviewing Google Sign-in and Security Events
Google provides tools to help you review recent activity and security events on your account. Checking these can help confirm a compromise.
- Go to
myaccount.google.com/securityand review the 'Recent security event' section for any alerts about sign-ins or changes you don't recognise. - Click on 'Manage devices' under 'Your devices' to see all devices currently logged into your Google account and identify any unfamiliar ones.
- Examine 'Third-party apps with account access' to find any apps you haven't authorised or don't recognise.
- Check your 'Sign-in & recovery' options to ensure your recovery phone number and email haven't been altered.
Tip
Regularly checking your Google security settings is good practice, even if you don't suspect a compromise.
Confirming Without Making Changes
It's important to confirm a compromise without alerting the attacker or making changes that could hinder investigation. These steps help you gather information discreetly.
- Take screenshots of any suspicious activity or settings changes you find in your Google account or on your Chromebook.
- Do not sign out of any suspicious devices or apps; this might alert the perpetrator.
- Avoid changing your password immediately; gather all possible evidence first.
- Make a note of the dates and times of any unusual activity.
- Consider using a different, secure device (like a friend's phone or computer) to access your Google account's security centre if you suspect your Chromebook is compromised.
Important
Making immediate changes could erase evidence or tip off the attacker, making recovery harder.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers