How to Check If Your Gmail Account Was Hacked [2026]

Last month, a friend in Pune called me in a panic. He had received an email from his own Gmail address. The subject line said his account would be suspended unless he clicked a link and "verified" himself within 24 hours. He nearly clicked it. The email looked real. The logo, the wording, everything.

Here is the twist. His account was not hacked at all. The email was a phishing scam, sent from a lookalike address. But here is the scarier twist: most people never bother to check. They either panic and click the scary link, or they ignore real warning signs for weeks while someone quietly reads their mail.

This guide will show you how to check if your Gmail account was hacked, for real, using Google's own tools. No third-party scanners, no sketchy "account checker" websites (those are often scams themselves). Just a calm, step-by-step audit that takes about five minutes. Let us start with the warning signs.

Quick safety note: Google will never ask for your password over email or phone, and nobody at Google can recover your account for a fee. Anyone who contacts you offering account recovery for money is running a scam. Keep that in mind through every step below.

The 5 Red Flags That Scream "Someone Is Inside"

Before you touch a single setting, look for these signs. One of them alone might have an innocent explanation. Two or more together means you should treat this as urgent.

1. Emails in your Sent folder that you never sent. Open Gmail on your laptop, go to Sent, and scroll. Hackers use compromised accounts to send spam or phishing mails to your contacts. If you see messages you did not write, especially ones with links or attachments, that is the single strongest sign of a hack.

2. Security alert emails you did not trigger. Google sends an alert when someone signs in from a new device or location. Real ones come from no-reply@accounts.google.com and say something like "New sign-in on Windows" with a "Was this you?" link. But scammers fake these constantly. Here is the rule that never fails: never click the link in the email. Instead, open your Google Account directly (type the address yourself) and check the activity there. If you want to get better at spotting fakes, learn how to check if a link is safe before clicking anything in your inbox.

3. Your recovery email or phone number changed without you. This is the move hackers make so you cannot get back in. In your Google Account, under Security, there is a section called "Ways we can verify it's you." If the recovery email or phone number listed there is not yours, someone has been inside your account settings. Act fast on this one.

4. Emails vanishing, or copies going somewhere strange. Hackers often create a filter that forwards your incoming mail to their own address, or auto-deletes security alerts from Google. If your inbox feels oddly quiet, or you are missing OTPs and bank alerts you normally receive, check your filters. I will show you exactly where in the audit below.

5. Your password suddenly does not work. This is the bluntest sign. If your password worked yesterday and fails today, and you are sure you typed it right, someone may have changed it. Do not keep guessing. Move straight to the recovery playbook section below. Google temporarily locks accounts after too many wrong attempts, and you do not want to lock yourself out on top of everything else.

Honest caveat: a single weird sign-in alert after you used a VPN or travelled to another city is usually just Google being cautious. The red flags that matter are the ones involving sent mail, changed recovery info, or forwarding rules you did not create.

The 5-Minute Gmail Security Audit (Do This Right Now)

Grab your phone or laptop and open myaccount.google.com. Sign in. Everything below lives under the Security tab. Go through it in order. It really does take five minutes.

Step 1: Check recent security activity. Near the top of the Security page, find Recent security activity or Review security events. This shows sign-ins, password changes, and added recovery options with dates. Anything you do not recognise? Click it and select "No, it wasn't me." Google will walk you through securing the account.

Step 2: Review your devices. Scroll to Your devices and tap Manage all devices. You will see every phone, laptop, and tablet signed into your Google account, with approximate locations. See a device in another city that you have never owned? Select it and sign it out. Do not feel bad about signing out a device you are unsure about. You can always sign back in. A hacker cannot.

Step 3: Kill third-party access you do not recognise. Find Third-party access under "Your connections." This lists every app and website you ever gave Google account access to: games, quiz apps, old tools you tried once in 2021. Hackers love these because people forget they exist. Remove anything you do not recognise or no longer use. Be ruthless here. If you actually need an app later, you can grant access again in ten seconds.

Step 4: Hunt for forwarding rules and filters. This is the step most guides skip, and it is the one hackers count on. Open Gmail on a computer, click the gear icon, then See all settings. Go to the Forwarding and POP/IMAP tab. If forwarding is enabled to an address you do not recognise, disable it immediately. Then click the Filters and Blocked Addresses tab. Look for any filter you did not create, especially ones that forward, delete, or skip the inbox for certain mail. Delete them. A filter silently forwarding your bank OTPs is worth more to a hacker than your password.

Step 5: Check recovery info and app passwords. Back in your Google Account Security page, open "Ways we can verify it's you" and confirm your recovery email and phone number are actually yours. Then look for App passwords (under "How you sign in to Google"). These are special passwords for older apps. If you see any you did not create, revoke them. Finally, glance at 2-Step Verification status. If it is off, we are fixing that in the next section.

That is the whole audit. Five steps, five minutes. If everything looks clean, breathe easy. If you found something wrong, keep reading, because now we fix it.

Locked Out? Your Recovery Playbook

If you cannot sign in at all, do not panic and do not pay anyone. Google's account recovery is free and it works, but you have to approach it the right way.

Start at the official recovery page. Go to accounts.google.com/signin/recovery and enter your email address. Google will ask questions to verify your identity: previous passwords you remember, the month you created the account, a verification code sent to your recovery email or phone. Answer as accurately as you can.

Use a familiar device and network. This genuinely matters. Google trusts sign-in attempts from devices and locations you have used before. Do the recovery from your own phone, on your home Wi-Fi or mobile data, not from a cyber cafe or a friend's laptop. Your chances improve noticeably.

Be patient if it takes time. Sometimes Google cannot verify you immediately and asks you to wait, often around 48 hours, before trying again. This is frustrating but normal. Do not create three new attempts in between. Wait, then try once more from the same device.

Once you are back in, do these four things immediately. First, change your password to something long and unique that you have never used anywhere else. Second, go to Your devices and sign out everything, which kills any active hacker sessions. Third, remove any third-party access and filters you did not create, using the audit steps above. Fourth, turn on 2-Step Verification. This single setting blocks the vast majority of account takeovers, because a stolen password alone is no longer enough.

Then secure everything connected to that Gmail. Your Gmail is the master key to your digital life. Password resets for your bank, your UPI apps, and your social accounts all flow through it. Change the passwords on your most important accounts, starting with banking and UPI. If you use WhatsApp, take a minute to secure your WhatsApp account from hackers too, since WhatsApp OTPs arrive through channels tied to your identity. And since most hacks start with malware on the victim's own phone, it is worth learning how to keep your phone safe from hackers so the same thing does not happen twice.

Lock It Down So This Never Happens Again

Recovering an account is stressful. Here is how to make sure you never do it twice.

Turn on 2-Step Verification and leave it on. I know the extra step at login is mildly annoying. It is also the single most effective thing on this list. Google's own data has consistently shown that it blocks the overwhelming majority of automated attacks. If your phone supports it, consider upgrading to a passkey, which is both safer and faster than typing codes.

Keep your recovery info current. Changed your phone number last year? Updated your backup email? Then update them in your Google Account too. Recovery only works if Google can actually reach you. Check this once a year. Put a reminder in your calendar if you have to.

Use a password manager and stop reusing passwords. The most common way Gmail accounts fall is not some Hollywood hacking scene. It is password reuse. You used the same password on a shopping site that got breached, and attackers simply tried it on Gmail. Google's built-in Password Manager works fine, and free options like Bitwarden are excellent. Let the manager generate and remember a unique 16-character password for every site. You will never type a password again.

Stay suspicious of urgent emails. The phishing email my friend received worked because it created panic: "24 hours or your account is suspended." Real security communication from Google never pressures you like that. When in doubt, do not click. Open the service directly and check. Every single time.

<h2>Questions People Actually Ask</h2>