If your Gmail or Google Account has been compromised, fast action can limit damage and help you regain control.
This guide explains how to recover after identity theft with your Google account, from securing access to checking for fraud and rebuilding your online safety.
What identity theft can look like in a Google account
Identity theft tied to a Google Account may start with unauthorized Gmail logins, password changes, or unfamiliar recovery settings.
Attackers often use access to Google services such as Gmail, Google Drive, Google Photos, Google Pay, Chrome sync, and linked third-party logins to collect personal data or impersonate you.
Common warning signs include:
- Emails sent from your account that you did not write
- New forwarding rules or filters in Gmail
- Recovery phone numbers or backup emails you did not add
- Unrecognized devices in your Google Account activity
- Purchases, subscription changes, or payment method updates you did not authorize
- Security alerts from Google about sign-ins from unfamiliar locations
First steps to take immediately
The first hour matters.
Focus on regaining control of the account, stopping further access, and preserving evidence.
- Change your Google password immediately if you can still sign in.
Use a long, unique password that has never been used elsewhere.
- Go through Google’s account recovery process if you cannot sign in.
Use a trusted device and location when possible.
- Sign out of all devices from the Security section of your Google Account to cut off active sessions.
- Review recovery options and remove unfamiliar phone numbers, emails, or passkeys.
- Check recent activity for suspicious sign-ins, app access, or changes to security settings.
If you are still locked out, keep trying account recovery through official Google channels rather than creating a new account.
A new account will not restore access to your old data or help you stop misuse of your identity tied to the compromised account.
How to recover after identity theft with your Google account?
Once you are back in, treat the account as compromised until you finish a full review.
Identity thieves often leave behind hidden access points that let them return later.
Secure your Google Account settings
Open your Google Account and review the Security tab carefully.
Remove unknown devices, third-party app access, and any app passwords you do not recognize.
Turn on 2-Step Verification, and if available, use a passkey or a hardware security key for stronger protection than SMS codes alone.
Also check:
- Recovery email and phone number
- Recent security events
- Devices signed into Chrome
- Connected apps and services
- App-specific access in older mail clients
Inspect Gmail for hidden misuse
Attackers often create filters to hide alerts or forward mail to another address.
In Gmail settings, review Filters and Blocked Addresses, Forwarding, and POP/IMAP.
Delete any rule you did not create.
Also check your Sent folder, Trash, and Archive for messages you did not send or suspicious deletions.
Review Google Drive, Photos, and other synced data
Identity theft can go beyond email.
Check Google Drive for unknown documents, sharing links, or newly granted access permissions.
Review Google Photos for unfamiliar uploads or sharing activity.
If you use Chrome sync, clear saved passwords and review stored payment details, addresses, bookmarks, and open tabs for signs of tampering.
Protect your financial and personal accounts
Google account theft frequently exposes bank, tax, shopping, and social logins.
Attackers may use password reset emails, stored credentials, or your personal data to take over more accounts.
- Change passwords for banking, credit card, shopping, payroll, and tax accounts
- Use unique passwords for each account with a password manager
- Enable multifactor authentication on every important service
- Contact your bank or card issuer if you see unauthorized transactions
- Place fraud alerts or a credit freeze with the major credit bureaus if personal data was exposed
If your Google Account contains saved passwords, assume they may be compromised and update the highest-risk accounts first: email, banking, mobile carrier, cloud storage, and government services.
Check for identity theft beyond the account
A compromised Google Account may expose enough information for broader identity fraud.
Review whether your name, date of birth, address, phone number, or government ID details were stored in Gmail, Drive, Calendar, Contacts, or documents.
Look for:
- Password reset emails from financial or retail sites
- Statements or tax documents in Gmail attachments
- Scanned IDs stored in Drive or Photos
- Calendar entries with appointments you never made
- Contacts entries added without your knowledge
If you suspect more than account misuse, file an identity theft report with the appropriate consumer protection agency in your country.
In the United States, that usually means reporting to the Federal Trade Commission and possibly your local police, depending on the type of fraud.
Use Google’s tools to monitor suspicious activity
Google provides several tools that can help you spot continued abuse.
Use the Security Checkup to review login devices, third-party access, and saved recovery information.
In Gmail, search for your own name, banking keywords, tax terms, and unfamiliar senders to find compromised messages or account notifications.
Helpful searches include:
- from:me
- has:attachment
- subject:password
- subject:verification
- in:anywhere after:2025/1/1
Also review Google Account notifications and sign-in alerts.
If a thief has enabled mail forwarding or linked an app, these settings can reveal the path they used to persist in the account.
Strengthen recovery information for the future
After the immediate cleanup, rebuild your account so recovery is harder for attackers and easier for you.
Use a secure recovery email that is not tied to the same compromise.
Keep your phone number current, but do not rely on SMS alone for account protection.
Recommended safeguards include:
- Two-step verification with authenticator app or passkey
- Recovery codes stored offline in a secure place
- A dedicated password manager for unique credentials
- Regular Security Checkup reviews
- Updated devices and browsers with the latest security patches
Consider removing older backup methods that are easy to intercept, such as weak recovery emails or text-only verification, if stronger options are available.
How to document the incident
Keeping records makes it easier to dispute fraud and explain what happened to support teams, banks, and law enforcement.
Save screenshots of suspicious logins, changed settings, unknown emails, and unauthorized purchases.
Record dates, times, device names, and any support case numbers.
Document these details:
- First sign of suspicious activity
- When you changed passwords and recovery info
- Which accounts were affected
- Any financial losses or chargebacks
- Communications with Google and other providers
Clear documentation can also help you prove that you acted quickly, which matters when banks, insurers, or support teams review fraud claims.
When to contact Google support and other services
If account recovery stalls, or if you notice repeated unauthorized access, contact Google support through the official help and recovery flows.
For financial misuse, contact your bank, card issuer, and any merchant involved.
For workplace or school accounts connected to your Google login, notify your IT or security team immediately.
You should also alert services that use Google sign-in if the attacker may have accessed them through single sign-on.
Reset those passwords or revoke sessions where possible to prevent a chain reaction across connected accounts.
Ongoing habits that reduce repeat risk
Recovery is not complete until your daily habits support better security.
Avoid reusing passwords, keep authentication methods current, and treat security alerts seriously.
Review account activity monthly, especially if you travel, change devices, or sign in from public networks.
For long-term protection, remember the core rule: secure the Google Account first, then every account connected to it.
That sequence is the most effective way to recover after identity theft with your Google account and reduce the chances of it happening again.