I have been getting alerts on emails that I have never sent. And when I look in to it further it shows a Facebook or Google+ group.

Are there steps that can be taken to recover my account?

  • I think this could be a good duplicate target, actually. – jonsca Aug 18 '17 at 2:16
  • @jonsca With that being the case, do you think I should update the answer and include the additional ways to tell if your account has been compromised? And perhaps the steps to follow for each of the scenarios? I kept it general based on the question, but more information may be helpful. – Ashton Aug 18 '17 at 2:28
  • @Ashton Absolutely, but it's totally up to you. There may be some duplicates already, I didn't really search carefully for them. If there are, we can merge the answers into this one as well. – jonsca Aug 18 '17 at 23:22
  • The person had a old password. I had created a new Gmail but finally could get into o into the second account and back and forth then what he's doing is taking those and forwarding them to his email attaching that to a Google Plus account what I would like to do is find out where they're going to whose Google Plus account and try all of it together so that I can get the proper documentation to proceed with the resolving the matter thank you – tina brousseau Aug 19 '17 at 7:12

The Google Account Help page Recover a hijacked or stolen Google Account states:

Your account may have been compromised if you've experienced any of the following issues:

  • You've received a notification about an unusual login or device that you don't recognize.
  • You received a notification that your username or password was changed.
  • You stopped getting emails.
  • You notice a red bar at the top of your account that says "We've detected suspicious activity in your account."
  • On your Wallet account, you see payment instruments such as bank accounts, credit cards, debit cards, or gift cards that you do not recognize on your account or you see transfers of money either sent or received to your account (you can check this at wallet.google.com).
  • Your friends complain that they received spam from you.
  • Messages that you didn't send appear in Sent Mail.
  • Your "Last account activity" shows sign-in activity at unusual times or from unusual computers and devices.
  • Your Gmail settings have changed, but you didn't change them. Settings include: vacation responder, signature, forwarding, filters, language, and others.
  • You have purchases on your Play account that you didn't make.
  • You have videos on your own YouTube channel that you didn't upload yourself.

If you think your account has been hijacked, you can check your recent account activity.

Depending on the following situations, the help page gives options of what you should do to recover a hijacked account:

If you can still sign in to your account.

Secure your account

If you think your account was compromised, change your password immediately.

Next, complete the Security Checkup to make sure that the attacker can't regain access to your account later. You'll review your account recovery information, recent security-related activity on your account, and the devices, apps, and websites that are connected to your account. Remove any devices or apps that you don't recognize.

Sign in to your account again

After securing your account, you'll need to sign in again on each device and browser that had full access to your Google Account.

Note: Some apps, websites, and devices (like TVs or gaming consoles) have only partial access to the information in your Google Account. They should keep working normally unless you removed them from the apps connected to your account.

Remove a possible virus

If you still see signs that your account is compromised, your computer might have been infected by a virus and the attacker might be using your machine remotely. We recommend that you install anti-virus software or wipe your computer clean and reinstall your operating system.

If you can no longer sign in to your account.

If you can't sign in to your account, fill out our account recovery form. We will check into your request as fast as possible.

If you notice a red bar at the top of your account.

If you have a red bar on the top of your screen that says "We've detected suspicious activity in your account," it is because Google feels that there might be a hijacker trying to access your account and it is important to let you know about this security threat.

We highly recommend you click the link in the bar that allows you to see a list of the devices you recently used to detect anything suspicious.

Once you have reviewed your devices you can dismiss the red bar by choosing the X.

Not the answer you're looking for? Browse other questions tagged or ask your own question.