How to Recover a Hacked Gmail Account

To recover a hacked Gmail account you have one official route: Google's account recovery form. There is no phone number to call and no person to email for a free Gmail account, whatever a search result or a helpful stranger tells you. The form works more often than people expect, provided you use it from the right device and answer carefully. This guide covers that, and then the part most people skip: removing the hacker's ways back in.

Can you still sign in? Then skip to Secure the account and do it now, before the password is changed on you.

Step 1: Use Google's account recovery page

Go to g.co/recover and enter your Gmail address.
Enter the last password you remember. An old one is better than a guess.
Google offers a verification method: a prompt on a phone that is still signed in, a code by text, a code to your recovery email, or a backup code. Complete whichever you can.
If you can't use the one shown, click Try another way. Go through every option before giving up.
Set a new password that you have never used anywhere.

How to improve your chances

Google decides whether you are the owner by comparing your attempt with how the account was normally used. You can tilt that in your favour:

Use a device you have signed in on before, ideally your usual phone or laptop.
Use your usual browser, such as Chrome or Safari, whichever you normally use.
Be on your home or work Wi-Fi, not a VPN or a new network.
Answer every question, and give your best guess instead of skipping.
Type passwords exactly, including capitals.

If the hacker changed your phone number or recovery email

Don't stop here; this is common and not the end. Google may still accept your old recovery phone or email for about a week after they were changed, so act quickly. A phone or computer that is still signed in to the account is also a strong proof: look for a Google prompt on it. Check your recovery email inbox too, because Google sends a "your recovery information was changed" alert that contains a link to undo the change.

If recovery is refused

Wait before retrying. Many attempts in a row count against you. If Google says it needs time to review, that delay is a security hold, usually a few days, and repeating the form does not shorten it.
Try again from a different device you used in the past, such as an old phone or tablet.
Never pay a "Gmail recovery service" or anyone on social media who says they can get the account back. They can't. This is a second scam aimed at people who were just hacked.
If the address came from work or school, the organisation's administrator can reset it. Paid Google One and Workspace subscribers have access to support staff, though they still follow the same ownership checks.

Step 2: Secure the account once you are back in

A new password alone is not enough. Attackers set up quiet back doors so they keep receiving your mail after you "recover". Go to myaccount.google.com/security and check each of these:

Your devices: sign out of every device you don't recognise.
Recovery phone and email: remove anything that isn't yours and add your own.
2-Step Verification: turn it on. Delete any authenticator app, phone number or passkey you did not add, and create new backup codes.
Third-party access: remove apps and sites you don't use.
App passwords: revoke them all.

Then, inside Gmail, open Settings > See all settings and look at:

Forwarding and POP/IMAP: delete any forwarding address you did not set.
Filters and Blocked Addresses: delete filters that forward, delete or archive mail. Hackers add these to hide security alerts and bank emails from you.
Accounts and Import: check "Send mail as" and "Grant access to your account" for strangers.
General: check your signature and the vacation responder for added text or links.

Finally run Google's Security Checkup, which walks through the same list and flags anything left.

Step 3: Limit the damage outside Gmail

Whoever held your inbox could reset the password of any account that uses that address.

Change the passwords for banking, payment apps, shopping and social media first. Search your mailbox for "password reset" to see which ones were touched.
Look in Sent and Trash for messages you did not write, and warn your contacts not to open links "from you".
Check your bank and card statements. In the US, report losses at IdentityTheft.gov and ic3.gov.
Scan your computer for malware. A password stolen by an infected browser extension will be stolen again.

How the account was probably hacked

It is nearly always one of three things: a password reused from a site that was breached, a convincing fake Google login page, or malware that copied your browser's saved logins. You can check whether your email was in a data breach, and learn the signs of a phishing email so the second one doesn't work again.

How to make sure it doesn't happen again

Use a passkey or an authenticator app, not text-message codes.
Give Gmail a password that is used nowhere else, stored in a password manager.
Keep your recovery phone and email current, and print your backup codes.
Don't hand your main address to every website. For one-off sign-ups, a temporary email keeps your real one out of the databases that get leaked.

Common questions

Can I recover a hacked Gmail account without a phone number or recovery email?

Sometimes. Using a familiar device, browser and network, plus an old password, can be enough for Google to accept you.

How long does Gmail account recovery take?

From a few minutes to several days. When Google needs extra checks, it emails you once the review is finished.

Can I contact Google to recover my account?

Not for a free account. The recovery form is the only route, and any phone number claiming to be Gmail support is not Google.

How do I know if my Gmail was really hacked?

Look for sign-ins from unknown devices, sent mail you didn't write and changed settings. The full list is in signs your email has been hacked.

Get a free temporary email Has my email been hacked?