How to Recover a Hacked Google Account (2026 Step-by-Step Guide)

Losing a Google account is worse than losing a phone. The account is the front door to your email, your photos, your contacts, your Drive files, your Android backups and the password resets for nearly every other service you own. If you need to recover a hacked Google account, the process is winnable, but it rewards a specific kind of preparation and punishes panic.

What follows is the realistic version: how Google’s automated recovery actually judges your claim, what to do at each stage, the lockdown checklist for the moment you get back in, and what your options are if recovery genuinely fails. At TechLein we have found that most failed recoveries fail for avoidable reasons, usually attempting the process from an unfamiliar device on an unfamiliar network while guessing at answers.

Key takeaways

• Attempt recovery from a device, browser and network you have used with the account before.
• Answer every question, and give precise answers rather than confident guesses. Skipping questions weakens your case.
• Getting back in is only half the job. Sessions, app passwords, filters and forwarding rules must all be cleared.
• If recovery fails, protect the accounts that used that email for resets, since those are the next target.

How to tell the account is actually compromised

Not every strange event means a hijack. The signs that genuinely matter are password change confirmations you did not request, sign-in alerts from unfamiliar locations, sent mail you did not write, contacts reporting odd messages from you, recovery email or phone entries you do not recognise, and being signed out of Gmail on your own devices without warning.

Sudden mail disappearing is another one. Attackers frequently create a filter that archives or deletes everything from your bank, so that you never see the alerts triggered by their activity. If your inbox has gone unusually quiet, look at the filter list rather than assuming a slow day.

Before you start the recovery form

Preparation improves your odds more than anything you type. Do these first.

• Find a device you have previously used to sign into the account, ideally your usual phone or laptop.
• Use your home or office Wi-Fi or your usual mobile connection. Turn off any VPN, since an unfamiliar exit location works against you.
• Use the browser you normally use, not incognito mode, so that existing cookies help identify you.
• Dig out any backup codes you saved when enabling two-step verification. A single unused code ends the whole ordeal instantly.
• Check whether you are still signed in anywhere: another browser profile, a work laptop, a tablet, or the Gmail app on an old phone. An existing signed-in session is the fastest route back.

If your phone number is the problem because the SIM itself was taken over, deal with that first; the sequence is in our guide to SIM swap fraud and how to protect yourself. Recovery codes sent to a number you no longer control will only help the attacker.

The recovery flow, step by step

1. Go to the Google Account recovery page and enter the email address. Do not create a new account as a workaround; that abandons the claim.
2. When asked for the last password you remember, give the most recent one you are confident about. If unsure, give the one you used longest.
3. Work through every verification option offered: a prompt on a signed-in device, a code to the recovery email, a code to the recovery phone, or a backup code. Try each rather than stopping at the first failure.
4. If none are available, choose the option to try another way, which routes you to the identity questions form.
5. Answer everything, including the approximate month and year you created the account and the last time you successfully signed in. Approximate is fine; blank is not.
6. Provide a contact email you can reach for the result. Use one you own and check often.
7. Submit and wait. Automated review can be immediate, but a manual review can take several days. Do not submit the form repeatedly, since a burst of attempts from varied locations looks exactly like an attacker.
8. If the first attempt is rejected, try again from a more familiar device or network, and add any detail you missed the first time, such as Google services you used and roughly when you started using them.

What helps and what hurts your claim

The moment you get back in: lockdown checklist

Regaining access does not evict the attacker. They may hold an active session, an app password, or a forwarding rule that survives a password change. Work through all of this in one sitting.

1. Change the password to something long and unique that you have never used elsewhere. Store it in a password manager rather than a note on your phone.
2. Sign out every other session. In the security section of your Google Account, review “your devices” and remove everything you do not recognise.
3. Revoke app passwords. These are legacy credentials that bypass two-step verification, and they are a favourite persistence trick. Delete all of them and recreate only what you truly need.
4. Check Gmail forwarding. In Gmail settings, look at the forwarding and POP/IMAP tab and remove any address you did not add. Also check that POP and IMAP have not been enabled without your knowledge.
5. Check filters. Delete any rule that forwards, archives, marks as read or deletes messages, especially rules keyed to words like bank, OTP, invoice or your bank’s name.
6. Check “send mail as” aliases and delegated access in Gmail settings. An attacker who added themselves as a delegate keeps reading your mail after every password change.
7. Verify recovery email and recovery phone. Replace anything unfamiliar with details you control, and remove spare entries you no longer use.
8. Review third-party apps with account access and revoke anything you do not actively use or recognise. Old game logins and abandoned tools are unnecessary exposure.
9. Enable strong two-step verification. Prefer a passkey or an authenticator app over SMS. Our two-factor authentication setup guide covers the setup and the trade-offs.
10. Generate and store fresh backup codes somewhere physical. This is the difference between a five-minute recovery and a five-day one next time.
11. Run Google’s own Security Checkup last, and read the recent security activity list for anything you cannot explain.

Then clean up the blast radius

Assume the attacker read your mail. Search your inbox for the services that email you, and change the password on anything sensitive: banking, payment apps, shopping sites with saved cards, and social accounts. Enable alerts on your bank accounts. Check whether the same password was reused anywhere else, using the methods in our guide to checking whether your data leaked in a breach.

Also check your Android devices. If the account was used to set up a phone, review installed apps, device administrators and accessibility permissions, which malware uses to persist. The relevant checks are in our guide to securing your Android phone.

If recovery fails

Google’s recovery is deliberately conservative, because a process loose enough to always help you is loose enough to help an impostor. If several careful attempts fail, shift to damage control.

First, change the email address on every account that used the lost address for password resets, starting with banking, payments and anything holding documents. Second, warn your contacts, since messages from your old address may be used to scam them. Third, if money or identity documents are involved, report it on the National Cyber Crime Reporting Portal or through the national cybercrime helpline on 1930. Fourth, if you had previously exported your data with Google Takeout, restore what you can from that archive; if not, treat it as the reason to start backing up now, as covered in our guide to backing up your phone data.

Keep trying the recovery form occasionally from a familiar device. Some claims succeed later, particularly once the attacker stops actively using the account and Google’s signals settle.

Frequently asked questions

How long does Google account recovery take?

Sometimes minutes when you can pass a device prompt or use a backup code. When the identity questions form is involved, review can take several days. Submit once and wait for the outcome rather than resubmitting.

Can I call Google to recover my personal account?

No. Consumer account recovery is handled through the online form only. Anyone offering phone-based Google recovery for a fee is running a scam, and paying them costs you both the money and any details you share.

The attacker changed my recovery phone and email. Is it hopeless?

No. That is precisely what the identity questions form exists for. Your odds depend on using a device previously associated with the account and giving accurate historical answers.

Should I create a new account while waiting?

You can create one for urgent communication, but keep pursuing the original. Do not use the new address as the recovery address for the compromised one.

How do I stop this happening again?

A unique password, a passkey or authenticator app instead of SMS codes, saved backup codes, and a recovery email and phone that you actually control. Broader habits are covered in our online safety guide for India.

The bottom line

Google account recovery is a judgement about how much your attempt looks like you. Everything you can do to strengthen that judgement, familiar device, familiar network, normal browser, accurate answers, matters more than persistence. One careful attempt beats ten frantic ones.

If you get back in, treat the next thirty minutes as the real work: sessions, app passwords, filters, forwarding, delegation, recovery details, connected apps, then strong two-step verification and fresh backup codes. And if you are reading this while your account is fine, spend ten minutes now saving backup codes and confirming your recovery phone still works. That small step is what turns a future disaster into an inconvenience.