Quick answer: On a device you still control, open myaccount.google.com/security, change your password, sign out other sessions, review recovery email/phone, and turn on 2-Step Verification. If you are locked out, use Google’s official account recovery—not “hacked account unlock” websites.
Getting a “New sign-in on Windows” email at 3 a.m. is enough to ruin anyone’s week. This guide is the order of operations I use when someone suspects their Google / Gmail account was taken over. Move quickly, but stay on official Google pages only.
ZYNKLYS is not affiliated with Google. We will never ask for your password or verification codes.
Signs your Google account may be compromised
- Password suddenly wrong on every device
- Sent folder shows messages you did not write
- Recovery phone or email changed without your approval
- Filters forwarding all mail to a stranger
- Security alerts for countries or devices you do not use
If you can still sign in (do this in order)
- Change your password at myaccount.google.com → Security → Password. Use a long unique password from a password manager.
- Sign out other sessions: Security → Your devices → sign out anything unfamiliar.
- Check 2-Step Verification: remove unknown phones; add your phone; save fresh backup codes. Full setup: Gmail two-step verification.
- Review recovery options: confirm recovery phone and email are yours.
- Open Gmail → Settings → See all settings → Filters and Blocked Addresses and delete forwarding filters you did not create.
- Check “Forwarding and POP/IMAP” for a forwarding address you do not recognize—disable it.
- Review Connected apps under Security and remove suspicious third-party access.
If you cannot sign in
- Start at Google’s recovery URL from our password reset guide—type the address yourself; do not tap email links.
- Use a device and network you have used before (home Wi‑Fi helps).
- Answer only what you remember accurately; guessing too fast can slow recovery.
- Ignore Telegram/WhatsApp “Google support” accounts. Google does not unlock accounts that way.
After you regain control
- Scan the computer/phone you used while compromised for malware.
- Update passwords on banks and shopping sites if they shared the old Gmail password.
- Tell contacts to ignore weird emails that appeared to come from you.
- Read how fake login pages work so this is less likely next time.
Frequently asked questions
Will changing my password kick the hacker out?
Usually yes for password-based sessions. Still review devices, filters, and recovery info—attackers sometimes leave a backdoor.
Should I delete the account?
Not as a first step. Secure it first so you keep photos, Drive files, and purchase history.
Someone asked me to share a screen to “help unlock Gmail.” Safe?
No. Hang up. Use only Google’s official recovery flow.
Related guides
Author: Rabi Mehar · Updated: August 2026