I’m Josh Smith, and I have worked in IT for more than a decade. During that time, I have helped businesses identify and respond to compromised accounts before the damage gets worse. If you suspect your Google account may have been hacked, here are 12 warning signs to look for:
- Your password suddenly stops working or the account is locked.
- An unfamiliar device, browser, or location appears in your account.
- Google shows security events you do not recognize.
- You receive an unexpected sign-in or password-change alert.
- Two-step verification, recovery details, passkeys, or other security settings were changed.
- Your recovery email or phone number was replaced.
- Emails are missing, deleted, or sent without your permission.
- Gmail forwarding, filters, or delegated access were added.
- Contacts receive phishing or spam from your email address.
- Unknown apps, extensions, or third-party services have account access.
- Drive, Calendar, YouTube, or payment activity looks unfamiliar.
- Google or a password manager says your credentials were exposed in a breach.
During the rest of this article we will explore each of these signs in greater detail.
What Are the First Signs of Being Hacked?
The first signs are usually simple. Your password suddenly stops working, Gmail shows a sent email you did not write, Google sends a security alert, or your account activity shows a sign-in from a device or location you do not recognize.
One sign by itself does not always mean your account is compromised. Sometimes Google flags normal travel or a new phone. But if you see several suspicious signs at the same time, treat it seriously because a hacked account can quickly turn into a bigger breach.
12 Signs That Your Google Account Is Hacked
1. Your Password Stops Working or Your Account Is Locked
One of the clearest signs is that your password no longer works. If you know you are entering the right password and your account suddenly says it was changed, that could mean hackers have already gained access and changed your credentials.
Do not keep guessing. Try account recovery on a device and at a location you normally use, and if this is tied to your business, let IT know right away. The faster you move, the better chance you have of limiting damage.
2. You See an Unknown Device Signed Into Your Account
An unknown device is a big warning sign. It might show up as a phone you do not own, a browser you do not use, or a location that makes no sense.
Go to your Google account security settings and review the device list. If something looks wrong, sign it out. Then change your password.
This matters because someone with account access may be reading Gmail, opening Drive files, or collecting data quietly in the background.
3. Google Shows Security Events You Do Not Recognize
Recent security events can show things like password changes, sign-ins from new devices, recovery updates, and blocked attempts. These are worth reviewing, not just clicking past.
I have seen people ignore these because they assume Google is being overly cautious, and sometimes it is, but security events are often the first place you can see the timeline of an account compromise. If you do not recognize the activity, take it seriously.
4. You Receive a Strange Alert About a Sign-In or Password Change
A strange alert from Google can mean someone tried to sign in, changed a setting, or attempted to view sensitive information.
But be careful here. Phishing emails can look like Google security alerts, too, and hackers use that trick because people panic and click fast. Instead of clicking a link in a suspicious email, go directly to your Google account from your browser and check the alert there.
Slow down. Verify first.
5. You Notice Changes to Security Settings
Changes to security settings are one of the strongest signs that your Google account has been hacked. Look for things like:
- Two-step verification turned off
- A new recovery email
- A new phone number
- Backup codes you did not create
- Passkeys or security keys you do not recognize
- Changed profile or contact information
Hackers often make these changes so they can keep access after you realize something is wrong. If your settings were changed without your approval, assume the account has been compromised.
6. Your Recovery Email or Phone Number Was Changed
Your recovery email and phone number are there to help prove ownership. If those were changed, that is not a small issue.
This is one of the things I would check immediately after a suspected account hacking situation, because if the recovery information is controlled by someone else, getting back into the account can become harder. Update it, then review every other security setting.
7. Emails Are Missing, Deleted, or Sent Without Your Permission
Gmail activity is often where people notice the problem. Maybe sent messages appear that you did not write. Maybe important messages are gone. Maybe Google security alerts were moved to Trash.
A hacked Gmail account can be used to send phishing messages to coworkers, vendors, and customers because people trust a message when it comes from someone they know. That is why this sign matters so much for businesses.
Check Sent, Trash, Spam, and Archive folders, and search for password reset messages. If something looks suspicious, secure the account before sending more emails.
8. Gmail Forwarding, Filters, or Delegated Access Look Suspicious
This is an easy one to miss. A hacker may not need to stay signed in indefinitely if they can forward your email to another address.
Check Gmail settings for:
- Forwarding addresses you do not recognize
- Filters that skip the inbox, delete messages, or forward certain email
- Delegated access was added without permission
- Blocked addresses that should not be blocked
A Gmail breach is not always loud. Sometimes it is quiet, and the goal is to watch messages, catch invoices, intercept password resets, or collect business data without being noticed.
9. Your Contacts Receive Phishing or Spam From Your Email
If clients, friends, or coworkers say they got a weird message from your Gmail account, believe them. Do not brush it off as spam right away.
Hackers use a trusted email account because it helps them get past the first layer of doubt. They may send fake invoices, file-sharing links, urgent payment requests, or malware attachments. If this happens, warn your contacts not to click anything suspicious and let them know you are securing the account.
It is awkward.
Do it anyway.
10. Apps, Extensions, or Third-Party Access Appear Without Approval
Sometimes the password is not the only problem. Apps, browser extensions, and third-party permissions can keep access to your account or data even after you change the password.
Review third-party access in your Google account. Remove anything you do not use or do not recognize. I would also check browser extensions, especially on the computer where you normally use Gmail, because malicious extensions can create privacy and security problems without being obvious.
11. Drive, Calendar, YouTube, or Other Google Activity Looks Unfamiliar
People often focus on Gmail, but your Google account touches a lot more than email.
Look for unfamiliar Drive files, shared documents you did not share, Calendar meetings you did not create, YouTube uploads, changed profile details, or payment activity you do not recognize. If your account is compromised, the activity may show up anywhere in the Google ecosystem.
This is especially important for businesses that use Google Drive for contracts, HR files, financial records, client documents, or internal processes. One account can expose more than people realize.
12. Google or Another Service Flags the Account Compromised
A password manager, Google alert, or another service may tell you that your credentials were found in a data breach. That does not always mean someone is inside your account right now, but it does mean your risk is higher, especially if you reused that password somewhere else.
There is a difference between a data breach and an active account compromise. A breach may expose credentials. An account compromise means someone may already have access.
Either way, change reused passwords, turn on two-step verification, and check your account activity.
How Do I Check If My Google Account Is Safe?
Start with the Security section inside your Google account. Review recent security events, look at the devices signed in, check the recovery email and phone number, and make sure two-step verification is turned on.
I would also check Gmail settings, because that is where hackers often hide. Look for forwarding rules, filters, blocked addresses, delegated access, and third-party apps that can read or manage your data.
If this is a company account, do not wait. Contact your IT provider or Google Workspace admin so they can help secure the account and look for related threats.
What to Do If Your Account Is Compromised
If you believe your account is compromised, act in this order:
- Change your password from a trusted device
- Run Google Security Checkup
- Review recent security events
- Sign out any unknown device
- Update your recovery email and phone number
- Turn on two-step verification or use a passkey
- Remove suspicious third-party app access
- Check Gmail forwarding, filters, and delegated access
- Scan your computer for malware
- Warn contacts if a phishing email was sent from your account
For a business account, I would add one more step. Have IT check whether the same credentials were used elsewhere, as hackers often reuse the same password across other systems.
How BCA Helps Protect Your Google Account and Business Data
A hacked account isn’t simply a personal inconvenience. For a business, it can become a privacy issue, a client trust issue, a data issue, and sometimes a financial issue if the attacker uses email to redirect payments or impersonate an employee.
BCA helps businesses reduce such risks through managed IT services, account security reviews, employee phishing training, multi-factor authentication, monitoring, endpoint protection, and practical cybersecurity guidance that fits how the company actually works day-to-day.
Based on our experience, the companies that do best are not the ones that assume nothing bad will happen. They are the ones who know what to look for, have the right protections in place, and respond quickly when something looks wrong.
Conclusion: Do Not Ignore the Signs
The biggest mistake is waiting.
If you see an unknown device, security events you do not recognize, a strange alert, changes to security settings, missing Gmail messages, suspicious forwarding, or anything else that points to a hacked account, check it right away. The sooner you respond, the easier it is to stop the damage.
And if your business needs help figuring out whether your Google account is safe, responding to an account compromised situation, or putting stronger protection in place, BCA can help you get ahead of the threats before they become a bigger problem.
