If your business's Google account was hacked, open Google's official account recovery page from a device and network you normally use, reset the password, then check the recovery phone number and email and sign out any device you don't recognize. After that, look at what the intruder changed: Gmail forwarding rules and filters, the owners of your Google Business Profile, your Google Ads account, and Google Drive sharing.
When you use Google only for personal email, a break-in is a scare. For a business it is more than that, because one account often controls the Gmail where orders arrive, the Business Profile that shows on Maps, the ads account, and the Drive folder with quotes and invoices. So the real question isn't just "how do I reset my password?" It's what did the intruder touch while inside, and in what order do I undo it?
Why a business account is a different target
A hacked personal account is used to scam friends. A hacked business account is used to scam customers, and customers trust your email address. A fake invoice sent from your real Gmail doesn't raise any suspicion.
There is a second risk. If a payment method is saved in Google Ads, an intruder can launch campaigns that spend your money, and you may only notice when the bill arrives.
First hour: take the account back
- Use the official recovery page. Go to accounts.google.com/signin/recovery from a phone or computer you have used with the account before, on a network you normally use, like your home or office Wi-Fi. That helps Google recognize you. Use it if someone changed your password or recovery details, deleted the account, or you can't sign in for another reason.
- Change the password to one you have never used on any other service. A password manager makes that painless.
- Review your recovery phone number and email. If the intruder swapped them, they can walk right back in. Remove anything that isn't yours.
- Sign out unknown devices. In your Google Account, open the Security section, then review recent security events and the list of devices under Your devices. Remove any you don't recognize.
Source: Google, Secure a hacked or compromised Google Account.
After you're back in: where intruders leave traces
Getting access back doesn't undo what was set up while someone else had it. Check service by service:
| Service | What to check | Why it matters |
|---|---|---|
| Gmail | Automatic forwarding, filters, and labels you didn't create | A forwarding rule keeps copying your email to the intruder even after you change the password, and filters can hide messages from you |
| Business Profile | The list of owners and managers | A new owner can change your phone number, website, and hours on Maps |
| Google Ads | Campaigns, users with access, and payment methods | Campaigns created by the intruder spend on your card |
| Google Drive | Files shared with people you don't know | Quotes, contracts, and invoices may have been opened to outsiders |
| Connected apps | Third-party apps with access to your account and sites where you use "Sign in with Google" | The same key can open your online store, your photo library, and other tools |
In Gmail, click Settings, then See all settings, then the Forwarding and POP/IMAP tab. If you see an address you didn't add, turn forwarding off and delete it. Also look through the Filters and Blocked Addresses tab. Google explains the forwarding screen in Automatically forward Gmail messages to another account.
In Google Ads, if you see charges or campaigns you didn't create, pause them, remove users you don't recognize, and contact Google Ads support to ask for a review of unusual activity. Tell your card issuer about any charge you didn't authorize.
Google Business Profile: check who owns it
A Business Profile has access levels. Owners have full control: they can add or remove users and even delete the profile. Managers can edit most things but can't add or remove users. A profile can have several owners but only one primary owner, so start there.
- Open the profile, select More, then Business Profile settings, then People and access. Remove any user you don't recognize. Only owners can remove other people.
- Check the phone number, website, address, and hours. An intruder who swaps the phone number sends your customers' calls somewhere else.
- If you lost the account that owned the profile for good, Google has a process to request ownership: you enter your business name and address, choose your business, and select Request Access. The current owner is notified, and if nobody responds after a few days you may be able to claim the profile by verifying your business again. It takes longer than recovering the account, so try recovery first.
Source: Google, Request ownership of a Business Profile.
Warn customers and your team
If the intruder had access to your business email, tell the people who usually receive invoices or payment requests from you. A short notice is enough: say the account was accessed, you have regained control, and your payment details haven't changed. If your bank account and payment links are the same as before, say that plainly, because it's exactly what a scammer will try to swap.
If money was taken or a customer paid a fake invoice, call your bank right away. Then report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov and to the FTC at ReportFraud.ftc.gov. Google's own checklist also recommends contacting your bank and local authorities when payment or personal information was saved in the account.
How to stop depending on a single password
- Turn on 2-Step Verification, preferably with a passkey or an authenticator app rather than text messages.
- Have two owners on your Business Profile, on different Google accounts. If one is compromised, the other keeps hold of the profile.
- Keep business and personal accounts separate. It won't stop a break-in, but it limits how far one goes.
- Print your backup codes and store them away from your phone. If the phone is stolen, they are what gets you back in.
Google accounts and messaging apps are often attacked together, so secure WhatsApp Business the same day if you use it. If your email account was the way in, here is what to do when your email gets hacked. And once the account is safe, make sure your Google Business Profile is complete and verified.
Frequently asked questions
What should I do first if my Google account was hacked?
Go to Google's account recovery page from a device you have used before, reset the password, and remove any recovery phone or email that isn't yours. Then review recent security events and sign out devices you don't recognize.
I got my password back. Am I safe now?
Not yet. The intruder may have left a Gmail forwarding rule, a new owner on your Business Profile, or a payment method or campaign in Google Ads. Check each service before you relax.
I lost the account that owns my Business Profile. Is the profile gone?
Not necessarily. Try recovering the account first. If that fails, Google lets you request ownership of the profile as the business's representative, which takes longer.
Sources: Google Account Help: Secure a hacked or compromised Google Account · Google Account recovery page · Gmail Help: Automatically forward Gmail messages to another account · Google Business Profile Help: Request ownership of a Business Profile · Google Business Profile Help: Manage your Business Profile owners & managers · Google Account Help: Turn on 2-Step Verification
