Recover a hijacked or stolen Google Account

Your account may have been compromised if you've experienced any of the following issues:

• You've received a notification about an unusual login or device that you don't recognize.
• You received a notification that your username or password was changed.
• You stopped getting emails.
• You notice a red bar at the top of your account that says "We've detected suspicious activity in your account."
• On your Wallet account, you see payment instruments such as bank accounts, credit cards, debit cards, or gift cards that you do not recognize on your account or you see transfers of money either sent or received to your account (you can check this at wallet.google.com).
• Your friends complain that they received spam from you.
• Messages that you didn't send appear in Sent Mail.
• Your "Last account activity" shows sign-in activity at unusual times or from unusual computers and devices.
• Your Gmail settings have changed, but you didn't change them. Settings include: vacation responder, signature, forwarding, filters, language, and others.
• You have purchases on your Play account that you didn't make.
• You have videos on your own YouTube channel that you didn't upload yourself.

If you think your account has been hijacked, you can check your recent account activity.

Secure your account

If you think your account was compromised, change your password immediately.

Next, complete the Security Checkup to make sure that the attacker can't regain access to your account later. You'll review your account recovery information, recent security-related activity on your account, and the devices, apps, and websites that are connected to your account. Remove any devices or apps that you don't recognize.

Sign in to your account again

After securing your account, you'll need to sign in again on each device and browser that had full access to your Google Account.

Note: Some apps, websites, and devices (like TVs or gaming consoles) have only partial access to the information in your Google Account. They should keep working normally unless you removed them from the apps connected to your account.

Remove a possible virus

If you still see signs that your account is compromised, your computer might have been infected by a virus and the attacker might be using your machine remotely.

We recommend that you install anti-virus software or wipe your computer clean and reinstall your operating system.

If you can't sign in to your account, follow the steps to recover your account. 

If you have a red bar on the top of your screen that says "We've detected suspicious activity in your account," it is because Google feels that there might be a hijacker trying to access your account and it is important to let you know about this security threat.

We highly recommend you click the link in the bar that allows you to see a list of the devices you recently used to detect anything suspicious.

Once you have reviewed your devices you can dismiss the red bar by choosing the X.