My Gmail / Google account was hacked, how do I secure it?
Last reviewed: 2026-08-01 · Checked with Hunch’s on-device engine, the same one inside the extension. How Hunch checks →
Part of our guide: What to do if you got scammed →
A Google account is recoverable, but move fast because it often unlocks your email, photos, and other logins. The breach usually starts with a fake "critical security alert" pointing to a lookalike host like google-account-verify.example instead of google.com. Use Google's official secure-a-hacked-account guide, run the Security Checkup, and sign out of every unknown session.
Got a message like this? Paste it here →
Because a Google account is the master key to email, photos, and password resets, it's a high-value target for anyone from petty scammers to identity thieves. The fake security alert succeeds by mimicking Google's real notifications and adding urgency, so users click and re-enter their password on a convincing lookalike page.
Illustrative example of the pattern, not a real message someone received.
How to verify it yourself
- Read the sender domain, genuine Google alerts come from google.com, not google-account-verify.example.
- Go directly to google.com/account/recovery or the Security Checkup by typing the address yourself.
- Review recent security activity for sign-ins from unfamiliar devices or countries.
- Check whether your recovery email, phone, or forwarding and filter rules were changed.
Common questions
The hacker changed my recovery info, can I still recover it?
Often yes. Google's recovery flow asks questions only you can answer, old passwords, familiar devices, account age, and can restore access even when recovery details were altered.
Are my other accounts at risk too?
Potentially, because many services reset via your Gmail. After recovery, change passwords on anything linked to that address, starting with banking and shopping.
Did they read all my email?
Assume they may have. Check Gmail's filters and forwarding settings for rules that secretly copy your mail to the attacker, and delete any you didn't create.
How do I make Gmail harder to hack?
Enable 2-Step Verification (ideally with an authenticator app or passkey) and run the Security Checkup periodically to spot new risky access.
If you already responded
- Open Google's official "Secure a hacked or compromised account" guide at support.google.com by typing it in yourself.
- Reset your password and use "Sign out of all other sessions" to sign out every unknown device.
- Restore your real recovery email and phone, and delete any forwarding or filter rules you didn't set.
- Turn on 2-Step Verification and complete the Security Checkup.
- No legitimate recovery service cold-calls you or charges a fee, Google won't phone you demanding payment to "unlock" your account.
If you were already hit, expect a follow-up
One more thing to expect: after a scam, your details often land on lists that get reused, so you may be contacted again, sometimes by people posing as investigators, your bank's "fraud team," or "recovery agents" who promise to get your money back for an upfront fee. That follow-up is a second scam. No legitimate service charges a fee to recover funds.
Source: Google, Secure a hacked account
Hunch is not affiliated with Google. Google is named only to describe a scam that impersonates it; the real Google does not send these messages.