Google account security check-up

Your Google account holds your email, photos, contacts and the reset link for almost every other account. Secure it first.

Everything below is at myaccount.google.com. On an Android phone you can also go to Settings › Google › Manage your Google Account. In the Gmail app, tap your picture, then Manage your Google Account.

1. Run the Security Checkup

Open the Security tab and choose Security Checkup (or go to myaccount.google.com/security-checkup). It lists problems in one place with a coloured mark beside each: devices signed in, recent security events, sign-in and recovery details, third-party access and saved passwords. Work down the list. The steps below explain each part.

2. Turn on 2-Step Verification

Security › How you sign in to Google › 2-Step Verification. After your password, Google then asks for a second proof. In order of strength:

1. Passkey or security key: your phone's fingerprint or face, or a hardware key. Cannot be phished.
2. Google prompt: a "Is it you?" notice on your phone. Tap No if you did not just sign in.
3. Authenticator app codes.
4. SMS or voice codes: better than nothing, but weak against SIM swap and against being talked out of the code.

Also download the backup codes from the same screen and keep the printout somewhere safe. They get you in if the phone is lost.

3. Create a passkey

Security › Passkeys and security keys. A passkey lets you sign in with the screen lock of your own device. There is no password or code for a fraudster to ask you for. See two-step verification and passkeys.

4. Check the recovery phone and email

Security › Recovery phone and Recovery email. They must be a number and an address you control today. An old number that now belongs to a stranger is a way into your account. Update them whenever you change number.

5. Review your devices

Security › Your devices › Manage all devices. Every phone, computer and television signed in to your account is listed with its last activity and rough location. Open any you do not recognise or no longer own and choose Sign out. If you see one you cannot explain, change your password as well.

6. Remove third-party access you do not need

Security › Your connections to third-party apps and services. These are apps and websites you once allowed to "Sign in with Google" or to read your data. Delete the ones you no longer use, and look closely at any with access to Gmail, Drive or Contacts.

7. Check saved passwords

passwords.google.com › Checkup tests the passwords saved in your Google Password Manager and lists those that are compromised in known leaks, reused or weak. Change the compromised ones first, starting with banks and email. See after a data leak.

8. Look at recent security activity

Security › Recent security activity shows new sign-ins and changes to sensitive settings in the last 28 days. An alert about a sign-in you did not make means: choose "No, secure account" and change the password.

9. Privacy controls

On the Data & privacy tab:

• Web & App Activity, Timeline (location history) and YouTube History: each can be paused, and each has an auto-delete choice of 3, 18 or 36 months.
• My Ad Centre: turn personalised ads off or adjust the topics.
• Download your data makes a copy of everything; Make a plan for your digital legacy (Inactive Account Manager) decides what happens if you stop using the account.

10. Gmail-specific checks

In Gmail on a computer: Settings (gear) › See all settings. Under Forwarding and POP/IMAP, make sure mail is not being forwarded to an address you do not know. Under Filters and blocked addresses, delete filters you did not create. Fraudsters who get into a mailbox add these so that bank alerts are hidden from you.

Signs that someone else is in your account

Password-changed or new-sign-in alerts you did not cause; sent mail you did not write; contacts receiving odd messages; a recovery phone or email you do not recognise. Act at once: change the password, run the Security Checkup, sign out other devices, and check forwarding and filters.