Gmail Hacked and Recovery Details Changed? Account Recovery Steps
Reviewed September 28, 2026. If someone changed your Gmail password, recovery email, or phone number, start at Google Account Recovery. Use a familiar browser, device, and location when it is safe to do so. Recovery depends on Google’s identity checks; no outside provider can guarantee access or bypass them.
If you can still sign in
- Open your Google Account security settings directly. Review recent security activity and report changes you did not make.
- Change the password to a unique one, review signed-in devices, and sign out unfamiliar sessions.
- Check recovery contact details, passkeys, security keys, app passwords, and third-party access. Remove entries you do not recognize.
- In Gmail settings, inspect forwarding, filters, delegation, and POP/IMAP access. An attacker may leave a way to keep receiving mail after a password change.
- Secure other accounts that reused the password or depend on this mailbox for recovery. If financial information was exposed, contact the affected provider through a trusted channel.
Google’s compromised-account checklist explains these checks and the device-security steps that should accompany them.
If you are locked out and the attacker changed recovery details
- Use the official recovery process, not a support page offering to recover accounts for a fee.
- Answer as many questions as you can. If asked for an earlier password, use the most recent one you remember.
- Follow the available verification options. Use a familiar device and location if the device is not suspected of compromise; follow your security team’s advice if malware is involved.
- Supply an email address you can access if Google requests one. Check its spam folder for Google’s response.
- If Google places the request on a security hold, follow the instructions shown. There is no universal waiting period or guaranteed successful outcome.
Read Google’s recovery tips and account recovery help. Google says it does not work with services claiming to provide account or password support. Do not disclose passwords or verification codes to anyone offering to bypass recovery.
Why an account can be compromised even with 2FA
Two-factor authentication reduces risk, but a stolen signed-in session, a deceptive sign-in flow, compromised recovery access, or malware can still expose an account. The exact cause requires evidence from account activity and the device. A compromise does not by itself show that Google’s encryption or every form of 2FA has failed.
After recovery, review Google’s security recommendations and consider phishing-resistant passkeys or security keys. Keep recovery methods protected and remove unfamiliar sessions. Strong authentication does not replace endpoint security.
What changes for Google Workspace business accounts?
Contact your organization’s administrator immediately. A Workspace administrator can review available audit information and use authorized account-management controls, depending on their role and subscription. Preserve suspicious messages and incident details; do not send passwords or recovery codes in a support request.
Technijian can assist businesses with email incident response and security reviews. Contact the team about a business account incident. Consumer Gmail recovery still follows Google’s verification process.
Can a changed recovery phone number be undone?
Review the options Google offers in the recovery flow and the security notifications it sent. Available options depend on the account and timing. Do not assume that a previous recovery method will always remain usable.
Original recording
The recording reflects the original publication. Use the reviewed written guidance above for current instructions.
