How to recover a hacked or locked Gmail account
Your Gmail is the master key to your online life — losing it can mean losing access to everything linked to it. This guide explains how to recover a hacked or locked Google account, what to do if details were changed, and how to secure it for good.
Your Google account is more important than almost any other you own. It holds your email, photos, contacts, and Drive files — and crucially, it can reset the password on Facebook, banking apps and nearly everything else linked to that email address. That is exactly why hackers target it.
If you lose your Gmail, fast and careful action gives the best chance of recovery. Google's account-recovery system is automated and security-focused, so the details you provide matter a lot.
This guide covers recovering a hacked or locked Google account step by step, and then locking it down so it stays yours.
Signs your Google account is compromised
Watch for these warning signs: you cannot log in even though you are sure of the password; you receive Google security alerts about a new sign-in from an unfamiliar place or device; your recovery email or phone was changed; sent emails or password resets you did not make appear; or contacts receive spam from your address.
Google often emails or texts you when something important changes. If you get a 'Your password was changed' or 'New sign-in' alert you did not cause, treat it as urgent.
Start the official recovery: accounts.google.com/signin/recovery
Always recover through Google's own tool — go to accounts.google.com/signin/recovery (or click 'Forgot password?' / 'Try another way' on the sign-in screen). Avoid any third-party site claiming to recover Google accounts; those are scams.
Google will ask a series of questions to confirm it is you. Answer as accurately as you can — even partial, honest answers help the system trust you.
- Use a device, browser and location you have used to sign in before — Google trusts familiar devices.
- Enter the last password you actually remember, even if it is old.
- If you have 2FA set up, use your authenticator code, backup codes, or a trusted device prompt.
- Answer from a Wi-Fi or network you normally use if possible.
If the hacker changed your recovery details
If your recovery email or phone has been changed, Google may have sent you a notification email shortly before the change with an option to undo it. Search your inbox (and any linked backup email) for messages from Google and act on any 'secure your account' or 'undo this change' link quickly.
If you cannot undo it, keep using the recovery form and answer the verification questions. Google's system weighs many signals — known device, location, account creation date, frequent contacts — so the more genuine detail you provide, the better your odds, even without the original recovery email or phone.
If recovery does not work, try again carefully
A failed attempt is not the end. Google specifically advises trying the recovery process again, ideally from a device and location you commonly use to access the account.
Tips that improve success: complete every step rather than giving up early; add a new recovery email/phone if prompted; and try when you are calm and have time, since rushed wrong answers can hurt your case. There is no shortcut, paid service, or phone number that bypasses this — Google's automated review is the only legitimate route.
After recovery: do a full security checkup
Once you are back in, immediately go to your Google Account, Security, and clean house:
- Change to a new, strong, unique password.
- Open 'Your devices' and sign out of every session and device you do not recognise.
- Turn on 2-Step Verification, preferably with an authenticator app or a passkey.
- Run the 'Security Checkup' tool, which flags recent activity, connected apps and risky settings.
- Remove unknown 'third-party apps with account access' and revoke 'app passwords' you did not create.
- Check Gmail settings for sneaky changes: forwarding rules, filters that delete or hide mail, and an altered reply-to address — hackers add these to intercept your future password resets.
Protect the accounts your email controls
Because your email can reset other passwords, a hacker may have used it to break into your Facebook, social media, shopping or financial accounts before you regained control. After securing Gmail, change passwords on those important accounts too and enable 2FA on them.
Going forward, treat your Google account as your most precious login: unique strong password, 2-Step Verification on, an up-to-date recovery email and phone, and saved backup codes. Add a passkey if your device supports it — it is phishing-resistant and very convenient.
Key takeaways
- ✓Your Google account is the master key — protecting and recovering it is top priority.
- ✓Recover only via accounts.google.com/signin/recovery; ignore any third-party 'recovery service'.
- ✓Use a familiar device, browser and location, and answer verification questions as accurately as possible.
- ✓Look for Google's emails offering to 'undo' a changed recovery email or phone, and act fast.
- ✓If a recovery attempt fails, try again from a device you normally use — there is no paid shortcut.
- ✓After recovery, change the password, sign out all devices, enable 2-Step Verification, and check Gmail for hidden forwarding rules and filters.
How to Recover a Hacked or Locked Gmail / Google Account — FAQ
Is there a phone number to call Google to recover my account?+
No. Google does not offer phone support to recover personal Gmail accounts, and anyone claiming to be 'Google support' by phone is a scammer. The only legitimate route is the online recovery form at accounts.google.com/signin/recovery.
What if I don't remember my old password or recovery details?+
Still use the recovery form and answer what you can. Google's system uses many signals beyond the password — familiar device, location, account age and contacts — so honest partial answers from a device you normally use can still succeed. Try more than once if needed.
Why should I check my Gmail filters and forwarding after recovery?+
Hackers often set up a hidden forwarding rule or a filter that auto-deletes Google security emails, so they can keep intercepting your password-reset messages even after you change the password. Removing these is essential to fully take back control.
The hacker deleted my account. Can I get it back?+
Possibly, if you act quickly. A recently deleted Google account can sometimes be restored through the recovery process within a short window. Go to the account recovery page as soon as possible and follow the prompts to attempt restoration.
How do I make sure this never happens again?+
Use a unique strong password, turn on 2-Step Verification (authenticator app or passkey), keep a current recovery email and phone, save your backup codes, and never enter your Google password on any site other than a genuine google.com sign-in page.
Sources & data note
These guides explain widely-accepted SEO, AEO and GEO practice as documented by Google Search Central, schema.org and current industry research. Search and AI systems evolve continually — treat specific thresholds (e.g. Core Web Vitals targets) as current guidance and verify against the latest official documentation. Examples are tailored to Nepal's market.