How to Secure Gmail and Your Google Account

Every "forgot password" link you have ever clicked sent its reset to one inbox. Whoever controls that inbox controls your bank login, your UPI app's recovery, your Instagram and your Amazon. To secure Gmail account access properly is to secure everything downstream of it, and Google has put the whole job on one page.

Open myaccount.google.com/security-checkup on a laptop or in the phone's browser. Work through the sections below in order. Allow ten minutes the first time and two minutes for monthly repeats.

Secure Gmail account access with the security checkup

Your devices

The first panel lists every phone, tablet and computer signed in, with the last activity date. Sign out of anything you do not recognise and anything you no longer own: the phone you sold, the office laptop from two jobs ago, the hotel business-centre PC. Each of those sessions can read your mail today. Then look at "Recent security activity" for password changes, new recovery numbers or new sign-ins you did not make.

2-step verification and passkeys

Google → myaccount.google.com → Security → 2-Step Verification → Turn on. Google prompts on your phone are the default second step; add an authenticator app as well, and save the ten backup codes somewhere offline, such as a notebook at home. Avoid relying on SMS alone; a SIM swap redirects SMS codes to the attacker's phone.

Under Security → How you sign in to Google, create a passkey. It lets you sign in with your phone's fingerprint, face or PIN, and it cannot be used on a fake Google page because the passkey only answers the real one. For most people, a passkey plus an authenticator app is the best available protection, and it costs nothing. Our guide to password managers and 2FA compares the options.

Recovery phone and email

Security → Recovery phone and Recovery email. These are how you get back in, and how an attacker gets in if they are stale or weak. The recovery phone should be a number you control with a SIM PIN set. The recovery email should be a second account that is itself protected with 2-step verification; otherwise an attacker who takes the weak account resets the strong one.

The two Gmail settings attackers change first

When an attacker gets in, changing the password locks them out again. So they set up something that survives a password change. There are two places to look, and most people have never opened either.

Forwarding. Gmail on a computer → Settings (gear icon) → See all settings → Forwarding and POP/IMAP. If forwarding is enabled to an address you do not recognise, disable it. Check whether POP or IMAP access is on; if you do not use a desktop mail client, turn both off so a mail program on a stranger's machine cannot sync your inbox.

Filters. Settings → See all settings → Filters and Blocked Addresses. Attackers create filters that forward certain messages (bank alerts, OTPs, password resets) to themselves and then delete or archive them so you never see them. Delete any filter you did not make. In business email compromise cases, this is the mechanism that lets fraudsters read an accounts team's invoices for months; this explainer covers how it is used against companies.

Also at the bottom right of Gmail on a computer is "Last account activity" with a Details link, listing recent access by IP address and type. It is the fastest way to confirm whether someone else is reading your mail right now.

Third-party access and the apps you forgot

Security → Your connections to third-party apps and services. Every "Sign in with Google" you ever tapped, every app that asked to read your calendar or contacts, is listed here with the level of access. Remove anything you no longer use and anything with full mailbox access you cannot explain. A game you installed in 2021 does not need to read your Gmail in 2026.

While you are in the account, open passwords.google.com and run Password Checkup. It flags saved passwords that appear in known breaches, that are reused across sites, or that are weak. Change the breached and reused ones for financial sites first. Our data-leak guide explains what a breach notification means and what to do after one.

If the account has been taken over

1. Try to sign in and recover. On the sign-in page, choose "Forgot password" and follow the prompts. Google's recovery works best from a device and network you normally use, so try from your own phone on home Wi-Fi rather than from a new laptop.
2. Once in, evict them. Change the password, sign out of all other devices from the security checkup, check recovery options and revert any change, and then open Gmail forwarding and filters and delete what you did not create.
3. Check what they reached. Search the inbox for password-reset emails from banks, UPI apps and shopping sites in the period you were locked out. Reset those passwords from the real apps and check for transactions.
4. Report if money moved. Call 1930 and file on cybercrime.gov.in the same day, and write to the bank. Unauthorised access to your account is an offence under IT Act sections 43 and 66, so file even if nothing was taken, in case the account was used against someone else.

Free Google accounts have no phone support, which is why the recovery options must be right before anything goes wrong. If self-service recovery has failed and the account holds things you cannot lose, our hacked account recovery service works through the escalation routes and the police complaint with you.

Monthly, in two minutes

Open the security checkup, glance at devices and recent activity, confirm 2-step is on. Once a quarter, open forwarding and filters. That rhythm catches most problems before they cost anything. For the rest of the phone, including UPI limits and WhatsApp settings, work through our personal cyber safety checklist, or let our device and privacy audit do it with you.