An unexpected change to your Google recovery phone, recovery email, or sign-in methods can help another person keep control of the account. Verify the change through Google Account directly and treat an unauthorized change as urgent.
If you retain account access
- Open Security & sign-in on a trusted device.
- Review the security event associated with the change and mark it as not yours where offered.
- Change your Google password.
- Correct unauthorized recovery details and inspect all sign-in methods.
- Review devices and linked apps for unfamiliar access.
Check more than the two recovery fields. A newly added passkey, security key, phone, or other authentication method can matter even if your recovery email still looks correct.
If Google flags an at-risk method
Google can restrict a method it suspects was added without permission. Review that event in recent security activity. If the method is not yours, remove it through the account controls and continue the security review.
Do not select Re-enable merely to clear a warning. Google’s current guidance requires an already trusted passkey or security key to re-enable an at-risk method. A stranger offering an approval code cannot substitute for that trusted proof.
If the change has locked you out
Use the official account-recovery flow. Google says previous recovery information may still be usable for seven days after a change as a protection for the owner. Use only a method you control and that the flow actually offers.
Preserve familiar signed-in devices and do not clear their data. Provide accurate ownership answers from your usual browser and location when possible. Recovery is not guaranteed, and new information cannot simply be attached from outside the locked account.
Verify the repaired account
Recheck the saved recovery addresses, verification methods, and recent events. Inspect Gmail forwarding and filters too: correcting account recovery does not stop a malicious mail-copying rule.
Contact the administrator for a managed identity. If other accounts reused the compromised password or rely on this mailbox for recovery, secure them through their own official settings. Keep a private timeline of the unauthorized changes and your corrective actions.
Official references
- Secure a hacked or compromised Google Account
- Set up recovery options
- Manage at-risk or new sign-in methods on your Google Account
- Change or reset your password
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.