If Google says your password changed and you did not change it, treat the notice as a possible compromise. Verify the situation through Google Account directly, then act promptly using a trusted device.
If you can still sign in
- Open your Google Account and review recent security events.
- Mark an unfamiliar event as not yours through the controls provided.
- Change the Google password to a strong, unique one.
- Review recovery details, sign-in methods, and devices.
- Sign out unfamiliar sessions and remove unauthorized access.
Do not assume that a password change signs out absolutely everything. Google’s password guide lists exceptions, including some verification devices, authorized third-party apps, and connected home devices. Review those relationships separately.
If the new password has locked you out
Use Google’s official account-recovery process. Its compromised-account guidance explicitly covers unauthorized changes to the password or recovery phone. Use a familiar device, browser, and location and answer the ownership questions accurately.
Keep any existing signed-in device available. Do not wipe it, delete the account, or discard its browser data while it may still provide a way to verify ownership.
Check what the intruder could have changed
After regaining access, inspect recovery email and phone, 2-Step Verification methods, passkeys, and linked apps. In Gmail, also review forwarding, filters, delegates, and sending settings. A working password does not remove a malicious forwarding rule.
Check other important accounts that reused the exposed password or relied on this mailbox for password resets. Visit each provider directly rather than following links supplied by a supposed recovery helper.
Do not let a fake alert create the compromise
An unexpected email, text, or call can imitate a password-change warning. Open the account yourself to investigate. Do not reply with a code, approve a prompt you did not initiate, or give a caller remote access.
For a managed account, notify the administrator through a known channel. They may need to reset sessions and investigate organization access. Keep a private record of the relevant times and changed settings without delaying urgent containment to collect perfect evidence.
Official references
- Someone changed your password
- Secure a hacked or compromised Google Account
- Change or reset your password
- See devices with account access
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.