How to Tell If Your Gmail Account Has Been Hacked: Signs and What to Do

 

Your Gmail account can contain far more than email.

It may also be connected to your Google Drive, Photos, YouTube, saved passwords, Android devices, payment information, and password-recovery options for other accounts.

That is why suspicious Gmail activity should be taken seriously.

The good news is that Google provides several built-in tools that can help you check whether someone else has accessed your account and secure it if necessary.

1. What Does “Gmail Hacked” Actually Mean?

When people say their Gmail account was hacked, they usually mean that someone accessed their Google Account without permission.

That may happen because of:

• A stolen password
• Password reuse after a data breach
• Phishing
• Malware
• A stolen device
• An exposed recovery method
• An unauthorized app or session

A suspicious email alone does not prove that your account has been hacked.

You need to check account activity and security settings.

2. Check Recent Security Events First

Go to your Google Account and open the security area.

Google recommends reviewing Recent security events when you suspect account compromise.

Look for:

• Sign-ins you do not recognize
• Password changes you did not make
• Recovery-information changes
• Security alerts from unfamiliar devices
• Other activity that was not yours

If you find activity that was not you, follow Google's prompts to secure the account.

3. Review Devices Signed Into Your Google Account

Next, review the devices that currently or recently used your Google Account.

Google provides a Your devices section where you can manage signed-in devices.

Look for:

• Phones you do not recognize
• Computers you never used
• Tablets you do not own
• Old devices that should no longer have access

If you see a device you do not recognize, follow Google's security steps to remove or secure that access.

4. Check Gmail’s Last Account Activity

On a computer, Gmail can show account-access information.

Google says Gmail's Last account activity can show sign-in history, including dates, times, and IP addresses used to access the account.

At the bottom-right of Gmail, select Details to review the activity.

Unexpected access locations or sessions deserve investigation.

5. Watch for Emails You Did Not Send

One strong warning sign is sent email that you did not create.

For example:

• Spam sent to your contacts
• Phishing messages sent from your address
• Strange replies in Sent mail
• Messages sent while you were offline

If this happens, treat the account as potentially compromised and secure it immediately.

6. Check Whether Emails Are Missing

Missing messages can also deserve attention.

If important emails disappear unexpectedly, check whether the issue is caused by:

• Filters
• Forwarding
• POP/IMAP access
• Connected applications
• Someone deleting mail

Not every missing email means hacking, but unexplained message loss combined with other suspicious activity is more concerning.

7. Check Gmail Forwarding Settings

An attacker who gains Gmail access may try to forward your incoming mail to another address.

In Gmail settings, review Forwarding and POP/IMAP.

Make sure messages are not being forwarded to an email address you do not recognize.

Unauthorized forwarding can allow someone to keep receiving copies of your messages even after you later change your password.

8. Check Gmail Filters

Review:

Gmail Settings → Filters and Blocked Addresses

Look for filters you did not create.

A malicious filter could:

• Forward mail
• Delete messages
• Archive messages
• Hide security alerts
• Redirect important messages away from your inbox

Delete filters you know you did not create.

9. Check Recovery Email and Phone Number

An attacker may try to change recovery information so they can regain access later.

Review:

• Recovery email
• Recovery phone
• Authentication methods
• Other account-recovery settings

Make sure they belong to you.

Unknown recovery information is a serious warning sign.

10. Change Your Google Account Password

If you believe someone accessed your account, change your password.

Use a password that is:

• New
• Strong
• Unique
• Not used on any other website

Do not reuse the old password with a small variation.

Google's compromised-account guidance includes changing the password as part of securing the account.

11. Change Reused Passwords Elsewhere

If the same password was used on other websites, change those too.

A stolen Gmail password can be tried against:

• Social media
• Shopping sites
• Banking
• Cloud storage
• Other email accounts

Using unique passwords limits the damage from one compromised service.

A password manager can make it much easier to create and store unique passwords.

12. Turn On 2-Step Verification

Google strongly recommends 2-Step Verification.

It adds another authentication step beyond the password.

Google explains that this can help protect the account even if someone steals the password.

Where available, consider stronger options such as:

• Passkeys
• Security keys
• Authenticator apps

Google notes that passkeys are resistant to common phishing methods because they cannot be copied or accidentally handed over like a password.

13. Review Third-Party App Access

Some apps and services can access parts of your Google Account.

Review connected applications and remove anything you:

• Do not recognize
• No longer use
• Never intentionally connected

A compromised app connection can sometimes remain useful to an attacker even after other changes.

14. Check for Suspicious Browser Extensions

If the compromise may have happened on your computer, review your browser extensions.

Remove extensions that:

• You do not recognize
• You did not install
• Request excessive permissions
• Appeared around the time suspicious activity began

A malicious browser extension can sometimes capture or manipulate account activity.

15. Scan Your Computer for Malware

If you suspect your password may have been stolen from the device itself, scan the computer with a trusted security tool.

Google's compromised-account guidance recommends removing harmful software as part of securing an account.

On Windows, you can start with Windows Security or another trusted antivirus product.

16. Check Whether Your Password Was Compromised

Google's Password Checkup can identify saved passwords that are:

• Compromised
• Reused
• Weak

If a password is identified as compromised, change it on the actual website where it is used.

Do not simply delete it from the password manager without changing the account password itself.

17. Check Your Primary Email Carefully

Your Gmail account may be used to recover other services.

That means someone with Gmail access might attempt to reset passwords for:

• Facebook
• Banking
• Shopping accounts
• Cloud storage
• Work accounts
• Other services

Search your inbox and trash for unexpected password-reset emails.

Also review security alerts from important services.

18. Secure Financial Accounts if Necessary

If someone gained access to emails containing banking, payment, or financial information, review the relevant accounts separately.

Google's compromised-account guidance advises contacting your bank or appropriate authorities when financial information may be affected.

Use official contact information—not phone numbers sent in suspicious messages.

19. What If You Cannot Sign In?

If the attacker changed your password or recovery information and you cannot access the account, use Google's official account-recovery process.

Google specifically directs users who believe someone else is using their account without permission to the hacked-account recovery process.

Use a familiar device, browser, and location when possible, because those signals may help Google recognize you.

20. What If You Still Have Access?

If you can still sign in, act before the attacker removes your access.

Do this in order:

1. Change the password
2. Review Recent security events
3. Review signed-in devices
4. Remove unfamiliar devices
5. Check recovery information
6. Review forwarding and filters
7. Remove unknown connected apps
8. Turn on 2-Step Verification
9. Scan your device if malware is suspected

21. Does an Unknown Login Always Mean You Were Hacked?

No.

Sometimes an unfamiliar location can be caused by:

• Mobile networks
• VPNs
• ISP routing
• Travel
• A device displaying an approximate location

Look at the full context.

Ask:

• Do I recognize the device?
• Was I using a VPN?
• Does the time match my activity?
• Did any settings change?
• Were emails sent without me?

One unusual location alone is less concerning than several unexplained security changes.

22. Warning Signs Your Gmail May Be Compromised

Take action if you notice one or more of these:

• Unknown devices signed in
• Security events you do not recognize
• Emails sent without you
• Recovery phone or email changed
• Password changed unexpectedly
• Unknown forwarding address
• Filters you did not create
• Important emails disappearing
• New third-party app access
• Unexpected password-reset messages
• Google security alerts you cannot explain

Several of these appearing together is a strong reason to secure the account immediately.

23. A Quick Gmail Security Checklist

If you suspect your Gmail account has been hacked:

• Review Recent security events
• Review signed-in devices
• Check Gmail Last account activity
• Change your password
• Change reused passwords
• Turn on 2-Step Verification
• Review recovery phone and email
• Check forwarding settings
• Check Gmail filters
• Remove unfamiliar connected apps
• Review important account activity
• Scan your device if malware is suspected
• Use Google Account Recovery if you cannot sign in

24. How to Reduce the Chance of Future Gmail Hacking

Going forward:

• Use a unique Google Account password
• Turn on 2-Step Verification
• Consider passkeys
• Do not enter passwords after following suspicious email links
• Review Google security alerts
• Keep your devices updated
• Avoid unknown browser extensions
• Check connected apps periodically
• Keep recovery information current

Google specifically recommends 2-Step Verification and stronger authentication options to make accounts more resistant to stolen passwords and phishing.

Final Verdict

If you think your Gmail account has been hacked, do not judge the situation based on one strange email or one unfamiliar location.

Check the evidence.

Start with Google's Recent security events and Your devices.

Then review Gmail's account activity, forwarding settings, filters, recovery information, and connected apps.

If you find unauthorized activity, change your password, remove unfamiliar access, and enable 2-Step Verification.

If you cannot sign in, use Google's official account-recovery process.

Most importantly, secure your email account quickly because it may be the recovery key for many other online accounts.

Guide note: This article reflects Google Account and Gmail security guidance available in August 2026. Google can change menu names, recovery steps, and security options over time, so use Google's current official Help Center when the interface differs.