If someone gets into your Google account, what else could they reach?

Your Gmail inbox, Drive files, photos and account recovery messages may all be connected to that one sign-in. Start by reviewing Google’s Security Checkup, using a unique password and turning on an extra sign-in method. Then check recovery details and devices you do not recognise.

No setting can guarantee that an account will never be compromised. These steps reduce common risks and give you a better chance of spotting trouble early.

Start with Security Checkup

On your phone, open your Google Account settings by tapping your profile picture in a Google app and choosing Manage your Google Account. Open the Security section and look for Security Checkup, or visit Google Security Checkup in a browser.

Make sure you are signed in to the account you intend to protect. If you have personal and business Gmail addresses, review each account separately. The suggestions can vary according to the account and its current settings.

Work through any warnings you understand, starting with unfamiliar activity or outdated recovery information. Do not approve a sign-in prompt simply because it appears while you are using your phone. If you did not start the sign-in, deny it and investigate.

Use a password you do not reuse

Choose a long, unique password for your Google account. A password manager can create and store one, so you do not have to reuse the same short password everywhere. If you prefer a memorable passphrase, use several unrelated words and avoid personal details that are easy to guess.

To change the password, open Manage your Google Account, select Security, then look for Password under sign-in options. Google may ask you to verify your identity first. Menu names may change with updates.

If you reused the old password on other sites, change it there too, starting with financial services and other email accounts. Our strong password guide explains how to choose and store one safely.

Never share your password or a one-time code with someone who contacts you claiming to be Google support. Enter account credentials only after opening a verified Google sign-in page yourself.

Add a second sign-in method

In the Security section, review 2-Step Verification and follow the setup prompts. Google may offer different methods depending on your account and device, including prompts, an authenticator, a security key or passkeys. Read what is available and choose a method you can use reliably.

A Google prompt asks you to confirm a sign-in on a trusted device. Only approve it when you started the sign-in and the details make sense. A scammer who has your password may repeatedly trigger prompts hoping you will tap yes just to make them stop.

Keep recovery options as well. If you lose your phone, a backup method or stored backup code may help you sign in. Save backup codes in a secure place separate from the phone, and do not post them in a chat or a shared document.

Our two-factor authentication guide explains why the extra step helps and why recovery planning matters.

Check recovery phone numbers and email addresses

In Google Account settings, review your recovery phone and recovery email. Remove or replace details you no longer control, following Google’s verification prompts. Use an email address you can open independently, not one that depends on the same locked account.

If you change your mobile number, update recovery information before the old SIM stops working where possible. If the number suddenly stops receiving service unexpectedly, contact your network through a verified channel. It may be a routine network problem, but your phone number can also be important for account recovery.

Recovery details are not a substitute for your password or other security methods. Google chooses which checks to offer during a particular sign-in or recovery attempt.

Review signed-in devices and recent activity

In the Google Account Security section, look for Your devices and choose the option to manage them. Review the sessions listed. A device name or location can be approximate, and the same device may appear in more than one session, so check the details before assuming a familiar entry is an attacker.

If a session does not belong to you, follow Google’s option to sign out of it and review the account for other changes. Change your password if you believe someone has access, and inspect recent security activity for sign-ins or changes you did not make.

Our guide to checking whether your email has been hacked covers warning signs and practical follow-up steps.

Remove access you no longer need

Review third-party apps and services connected to your Google account. Remove access for an app you no longer use or do not recognise, but read what removing access means before continuing. You may need to sign in again or reconnect a service you still use.

Be cautious when an app asks for broad access to Drive or Gmail. The request should make sense for the service you are trying to use. Do not grant access because a stranger says it is required to claim a prize or fix a problem.

Keep your phone’s operating system and apps updated through trusted channels. Set a screen lock and avoid leaving an unlocked device with someone you do not trust. An attacker who can open an unlocked phone may be able to read emails or respond to verification prompts.

If you think someone already got in

On a trusted device, try to sign in and follow Google’s hacked account guidance. Change the password, review security activity, signed-in devices and recovery details. Check Gmail settings for unfamiliar forwarding addresses, filters or delegated access where available.

If you cannot sign in, use Google Account recovery and follow the prompts. If financial information or payment accounts were exposed, contact the relevant provider through its verified support channel.

Tell contacts if suspicious messages were sent from your account. Do not pay someone who promises guaranteed recovery. Once you regain access, review the account again and set up recovery options while your trusted devices and phone number are still available.