Detecting suspicious activity on your account
Find out if your account has been hacked
If you notice any of these signs, someone else may be using your Google Account.
Important: If you think someone else is using your Google Account, change your password immediately for:
- Your Google Account (if you didn’t already change it after you noticed suspicious activity)
- Apps and sites where you use the same password you used for your Google Account
- Apps and sites that contact you through your Google Account email address
- Apps and sites where you sign in with your Google Account email address
- Apps and sites for which you’ve saved passwords in your Google Account
Suspicious account activity
Correct the setting immediately if you see unfamiliar changes to these settings:
- Your recovery phone number.
- Your recovery email address.
- An alternate or contact email address.
- The name on your Google Account.
- Your security question. Note: Adding a security question is no longer available.
- 2-Step Verification (for example, if this setting was turned on or off without your knowledge).
- 2-Step Verification methods (like a phone or security key that you don’t recognize).
- Apps with access to your account.
- Less secure app access (for example, if this setting was turned on without your knowledge).
- Location Sharing (for example, if your location is being shared with someone without your approval).
Your financial activity might be suspicious if:
- On Google Pay you don’t recognize purchases: Report unauthorized charges to request a refund.
- On Google Pay, you don’t recognize one or more bank accounts, credit cards, debit cards, or gift cards: Remove a payment method you don’t recognize.
- On Google Play, you don’t recognize purchases: Report unauthorized charges.
- On Google Chrome, payment info you don’t recognize is set up: Delete unfamiliar payment info.
- On Google Ads, you notice unauthorized charges or ads: Ask the Google Ads team to review your account for unusual activity.
- On Google AdSense, you notice that payments aren’t going to the correct bank account: Check your AdSense payment method.
Note: We'll use your recovery phone number and email address to tell you about suspicious activity.
We’ll inform you of unusual activity through:
- A notification about an unusual sign-in or a new device using your account.
- A notification that there was a change to your username, password, or other security settings, and you didn’t make the change.
- A notification about some other activity you don’t recognize.
- A red bar at the top of your screen that says, "We've detected suspicious activity in your account."
- Your "Device activity and security events" page.
Suspicious activity in Google products you use
Correct the setting immediately if you see unfamiliar changes to:
- Mail delegation (people with access to your Gmail)
- Automatic mail forwarding
- Scheduled emails
- Your name in Gmail
- Automatic reply (vacation responder)
- Address on outgoing mail
- Blocked email addresses
- Remote access to your Gmail (IMAP/POP)
- Filters that manage your incoming mail
- Labels that organize your incoming mail
Your Gmail activity might be suspicious if:
- You stopped getting emails.
- Your friends say they got spam or unusual emails from you.
- Your username has been changed.
- Your emails were deleted from your inbox and aren’t found in Trash. You can report emails have gone missing and possibly recover them.
- You see Sent Emails that you didn’t write.
Your Blogger activity might be suspicious if:
- Posts you didn’t publish appear on your blog.
- You get comments on posts you didn’t publish.
- Your mail-to-Blogger address has changed, but you didn’t change it.
- Your blog has disappeared or been blocked.