How to Recover Your Google Account After Being Hacked

Open Settings from your home screen and tap Google, then your name, then Manage your Google Account. Whatever loads next answers the big question: does this phone still hold your account?

A Google Account page showing your name, email and settings — like this one — means the phone is still signed in, and the hard part is already over. The next step resets your password from right here.

Lock the intruder out with a fresh password:

1. Tap your account, then Google Account
2. Find Google password under Security & sign-in
3. Set something long and unique, then tap Change password

Google sometimes wants proof it's you before showing the password screen. A passkey or sign-in prompt already on this phone clears that in a couple of taps and drops you straight into the reset.

A password change from a signed-in device doesn't reliably end the attacker's other sessions — close them yourself:

1. Open Security (or Security & sign-in info) in your Google Account
2. Head to Your devices → Manage all devices
3. Sign out everything you can't place

Skim the recent security activity while you're in there — the follow-up guide below covers the full sweep.

Open Gmail and tap your profile picture top-right, then Manage your Google Account. The next screen tells you whether this session survived.

Seeing the Google Account page with your name and email means the app's session is intact — you're still signed in here, and full recovery won't be needed. Straight on to the password reset.

Shut the intruder out from here:

1. Tap your profile picture → Manage your Google Account
2. Open Google password under Security & sign-in
3. Enter a long, unique replacement and tap Change password

Expect Google to double-check it's you — a passkey or a sign-in prompt on this phone settles it in seconds.

The reset alone may leave the attacker's sessions running — end them deliberately:

1. In your Google Account, open Security (or Security & sign-in info)
2. Go to Your devices → Manage all devices
3. Anything unfamiliar gets Sign out

And glance at the recent security activity before you leave.

Don't open the recovery page from just anywhere. Use the phone or computer this account has lived on, connected to your usual home Wi-Fi — familiarity is the heaviest single weight on Google's scales, and it can decide the whole attempt.

1. Open g.co/recover (the short link for accounts.google.com/signin/recovery)
2. Type the account's email address and continue
3. Answer every prompt Google offers — what appears depends on what's still attached to the account

Google offers whatever verification routes it can. Take them in this order — the top one carries the most weight:

• Google prompt on a signed-in device — any phone still holding a session (even just the Gmail app) can receive the tap Yes prompt. The strongest signal there is.
• Passkey or security key — use it immediately if one exists
• Recovery phone — punch in the texted code
• Recovery email — dig the code out of that inbox (check spam)
• Old password + account facts — a previous password and details like the account's rough creation date still count in your favour

Once any of those checks lands, Google hands you the password screen. Go long — 16 characters or more — unique to this account, and straight into a password manager.

You're back in, but don't relax yet: the attacker's own sessions may still be live. The final step deals with them.

Reclaiming the password doesn't clear the squatters — do that explicitly:

1. Open Security (or Security & sign-in info) in your Google Account
2. Your devices → Manage all devices
3. Every unfamiliar entry gets Sign out

This is the move that actually ends their access — the reset on its own won't always manage it.