How to Check if Your Google Account Was Stolen
If you think someone may have accessed your Google account, act quickly and verify the most important security signals first.
This guide explains how to check if your Google account was stolen and what to review in Gmail, Google Account security, and connected devices.
A compromised Google account can expose email, files in Google Drive, saved passwords, Photos, and access to services like YouTube, Google Pay, and Android backups.
The good news is that Google provides several clear indicators that can help you confirm suspicious access before more damage is done.
Fast signs your Google account may have been compromised
Start with the strongest indicators of unauthorized access.
One sign alone does not prove theft, but multiple signs together are a serious warning.
- Unfamiliar sign-in alerts from Google saying a new device or location accessed your account.
- Emails you did not send in Gmail, especially messages with links, attachments, or payment requests.
- Password, recovery email, or phone changes you do not remember making.
- Missing messages, contacts, or Drive files that appear deleted or moved.
- Login prompts or verification codes you did not request.
- Suspicious third-party app access connected to your Google account.
If any of these appear, assume the account may be compromised and move to the checks below immediately.
Check your Google Account security activity
The first place to verify potential theft is your Google Account Security page.
It shows recent sign-ins, devices, and recovery settings.
Review recent security activity
Open your Google Account, then go to Security and look for Recent security activity.
Review each event for the following:
- Sign-in dates and times you recognize
- Locations that match your normal travel or home network
- Devices you actually use, such as your phone, laptop, or tablet
- Any login method you did not approve
If you see an unknown phone, browser, or country, treat it as a compromise signal.
Google may show the browser type, operating system, or approximate location, which can help you identify whether the session was legitimate.
Check your devices
In the same Security area, review Your devices.
This list shows where your Google account is currently signed in or recently active.
Remove anything unfamiliar, especially old phones, public computers, or devices you no longer own.
For each device, confirm whether it matches:
- Your current smartphone or tablet
- Your personal laptop or work device
- Browsers you use regularly
- Any old devices that should no longer have access
Inspect Gmail for signs of account abuse
Gmail often reveals a stolen account before other services do.
Attackers may quietly change settings to hide messages, forward email elsewhere, or use your inbox for scams.
Look for forwarding and filter changes
Open Gmail settings and check Forwarding and Filters and blocked addresses.
A thief may add a forwarding address so copies of your emails go to another inbox.
They may also create filters that automatically archive security alerts, bank messages, or recovery emails.
Pay close attention to filters that:
- Skip the inbox
- Mark messages as read
- Delete incoming emails
- Forward mail to an unknown address
Review sent mail and trash
Check your Sent folder for messages you did not write.
Also inspect Trash and All Mail for deleted messages, because attackers may remove evidence after using the account.
Check your Gmail signature and reply settings
Unknown changes to your signature, vacation responder, or default reply behavior can indicate unauthorized access.
If your emails suddenly include strange text, links, or a different name, investigate immediately.
Verify whether recovery information was changed
One common way attackers keep control of a stolen account is by replacing recovery options.
Check your recovery phone number, recovery email, and security questions if applicable.
In Google Account Security, review Recovery phone and Recovery email.
If either one is unfamiliar, restore it right away.
A changed recovery method can block you from getting account alerts or password reset codes.
Also review Passkeys, 2-Step Verification, and any backup codes.
If a new passkey or security method was added without your knowledge, remove it.
Review third-party access and app permissions
Many account takeovers involve malicious apps that have access to Google services through OAuth permissions.
These apps may read email, manage files, or access profile data without needing your password again.
Go to Security and review Third-party access.
Remove apps or services you do not recognize, especially tools that request broad permissions such as reading Gmail, managing Drive files, or accessing your contacts.
- Unknown browser extensions connected to your Google login
- Mail clients you never configured
- Suspicious cloud backup or PDF tools
- Old apps you no longer use
Check for unusual activity in Google Drive, Photos, and other services
A stolen Google account may be used beyond Gmail.
Review other Google services for signs of manipulation or data exposure.
Google Drive
Open Drive and look for unfamiliar file sharing changes, deleted files, or newly created documents you do not recognize.
Check the Shared with me and Recent views for activity you did not perform.
Google Photos
Review newly uploaded images, shared albums, and deleted items.
If your photos appear missing or someone shared an album from your account, it may point to unauthorized access.
YouTube and Google Pay
Check whether your YouTube channel changed subscriptions, comments, or uploaded videos.
If you use Google Pay, review transactions and linked payment methods for unauthorized purchases or changes.
Use Google security alerts to confirm suspicious access
Google often sends alert emails or push notifications for security events such as password changes, recovery updates, and new sign-ins.
If you received a message about a login you did not perform, verify it through your Google Account rather than clicking links inside the alert.
To reduce the risk of phishing, go directly to your account by typing the Google URL yourself or using the official Google app.
Confirm whether the alert matches:
- The time you were online
- Your current location
- Your own device
- Your recent activity
What to do immediately if you confirm theft
If your checks show clear unauthorized access, secure the account in this order:
- Change your Google password to a long, unique password from a trusted device.
- Sign out of all devices from the Security page.
- Remove unfamiliar recovery phone numbers and emails.
- Delete unknown third-party app access.
- Review Gmail forwarding and filters and remove anything suspicious.
- Turn on 2-Step Verification if it is not already enabled.
- Scan your devices for malware, especially if you typed the password on a compromised computer.
If the attacker changed your password or recovery details and you cannot sign in, use Google’s account recovery process as soon as possible.
The faster you act, the more likely you are to regain control before the account is used for fraud or further phishing.
How to reduce the risk of future Google account theft
Once the account is secure, strengthen it so the same attack is harder to repeat.
Good account hygiene matters because Google credentials are valuable targets for credential stuffing, phishing, and malware.
- Use a unique password that is not reused anywhere else.
- Enable 2-Step Verification with a security key, authenticator app, or passkey.
- Keep recovery email and phone numbers current.
- Review security activity monthly.
- Limit third-party app permissions to trusted services only.
- Avoid entering credentials on links from unexpected emails or texts.
Checking whether your Google account was stolen is mostly a matter of comparing account activity against what you actually did.
When a login, device, recovery setting, or Gmail rule does not match your behavior, treat it as a real security incident and respond immediately.