Gmail Account Recovery and Security

How to Get Help

The purpose of this article is to help guide you through the process of recovering a lost account and (if it was lost due to hacking) re-securing it so that is it less likely to be lost again.

There are other sources of information including the Gmail* help centerhttp://mail.google.com/support/?hl=en and the GMail help forumshttp://www.google.com/support/forum/p/gmail?hl=en both of which support searching for topics of interest.

Please note that you can not recover your account by posting to the Gmail help forum. You must follow the procedures outlined below.

Table Of Contents

1. How To Recover Your Account - a basic guide to what process to follow
2. Account Recovery Walk-Through - a guide with pictures to help understand the recovery flow
3. Additional Recovery Information - more information about the Account Recovery Form
4. FAQ About Account Aecovery - read this before you post a question to the forum
5. When You Reclaim Your Account - how to re-secure an account
6. How To Protect Your Account Contents - how to backup your account

---

How To Recover Your Account

We will assume you went to https://mail.google.com/ and tried to log into your account. It didn’t work and you found your way here. You need to start with the following decision tree to determine what actions you need to take to recover your account.

If your password does not work, use the “Need help?” link on the sign-in page and then the "I don't know my password" option which will direct you to a page with up to three recovery options:

1. Get a verification code sent to your mobile device.
2. Request a password reset e-mail to be sent to your recovery account.
3. Proceed to the Account Recovery Form. Look for a "Verify your identity" link if the other options don't work.

https://www.google.com/accounts/recovery

If you are told the account does not exist, it may have been deleted by the hacker, so use the Account Recovery Form to try and recover it:

https://www.google.com/accounts/recovery

If you do not remember the account name, (which might be why the account does not appear to exist), use the “Can’t access your account?” link and the "I don't know my username" option:

https://www.google.com/accounts/recovery

If you are instructed to supply a mobile number to receive a SMS code, you need to follow the process as described:

http://www.google.com/support/forum/p/gmail/thread?tid=69a33682180a6d01&hl=en
http://mail.google.com/support/bin/answer.py?answer=114129

“Lockout (Sector 4)”, is because of abnormal account usage that may indicate compromise. It should automatically unlock in 24 hours or less.

http://mail.google.com/support/bin/answer.py?answer=43692

“Temporary Error (502)” or 500, indicates an internal error that should correct itself soon.

http://mail.google.com/support/bin/answer.py?answer=140031

Any message about account “maintenance”, indicates that temporary server maintenance is in process which should take less that 24 hours.

http://mail.google.com/support/bin/answer.py?hl=en&answer=63592 (article missing)

Any messages about being underage, indicates the system believes you are too young to own a Gmail account (generally under 13).

http://mail.google.com/support/bin/answer.py?answer=1333913 (article missing)

Any message about your account being “Disabled” or “Suspended, typically indicates some abuse, violation of the Terms of Service, or possibly a compromised account. Follow any instruction given or provided links when you try to sign in.

http://mail.google.com/support/bin/answer.py?hl=en&answer=43692

If you see some other error not listed above, use the following more comprehensive list of possible errors.

http://mail.google.com/support/bin/static.py?hl=en&page=error_msg.cs (article missing)

If you are still unsure what to do, there is a help article that you can also use to walk through the process of account recovery. It handles some specific cases not covered above. You might find it more useful if you are not sure just what you should do for your specific case.

http://mail.google.com/support/bin/answer.py?hl=en&answer=46346

---

Account Recovery Walk-Through

This section will document the step-by-step process of doing a recovery for several of the most common cases. This will give one some idea of what to expect going through the process. But note that as Google makes changes to the process or the individual pages the images below may become out-of-date. It's a guide to the general process, not definitive documentation. Still, it should help guide one through the process.

The overall flow of the walk-through will cover the following cases (click the link to jump to that topic):

• I don't know my password
• Get a verification code on my phone
• Confirm access to my recovery e-mail
• Answer my security question
• Verify your identity - The Account Recovery Form
• I don't know my username
• Forgot your username
• I'm having other problems signing in
• Special situations
• Two-step verification
• Google Apps accounts

All account access starts the same way, by going to the Gmail sign in page at:https://mail.google.com/. If you're trying to recover access to an account, you click the "Can't access your account?" link at the bottom.  Note that the link may also simple be "Help".

This starts the recovery process with the initial choices where you select the type of problem you are having.

The choice you make starts you down one of several branches towards account recovery.

Another way to do the same basic task is to use this help article where you can select the particular account access problem you are having.  But note that several of the choices end up at the same location as the above "Can't access your account?" link.https://support.google.com/mail/bin/answer.py?hl=en&answer=46346

• I don't know my password
  
  If you have forgotten your password this is the path you will use. One example of how this could happen is if a browser is configured to automatically fill in the login details and for some reason the information is lost. This path may not work for a compromised account as hackers will often change the recovery details to try and prevent the original owner from regaining access to the account.  Enter your account name and click Continue
  
  
  
  
  Depending on what recovery options were configured for the account, several options may appear. Select the one you wish to use and click Continue.
  
  
  
  
  If Google identifies a security issue, it may not offer some of the pre-configure recovery options which may require one to use the account recovery form (verify your identity) described below.
  
  Be aware that many of the paths below will require solving a Captcha verification before proceeding. It doesn't mean anything is wrong, so just enter the letters and click Continue.
  
  
  
  
  
  
  
  
  • Get a verification code on my phone
    
    The option most preferred by Google is for them to send you a verification code to a pre-configured mobile device. When this option is selected a choice of receiving the code by SMS message or voice is given. Make the selection and click Continue.
    
    
    
    
    Do not leave the recovery process until you receive the code. The code will be received on the configured mobile device and should be entered on the next screen that will be presented.
    
    
    
    
    Once the code is entered, the next screen will allow the creation of a new password for the account.
    
    
    
    
  
  
  • Confirm access to my recovery email
    
    This option is perhaps the simplest as it just sends an e-mail to a pre-configured recovery e-mail address allowing one to reset the account password. Select the option and click Continue.
    
    
    
    
    There will be a notification that a password reset was sent to your pre-configured recovery e-mail address.
    
    
    
    When received, the e-mail will look similar to this.
    
    
    
    
    Click the enclosed link and follow the instructions to create a new password.
    
    
  
  
  • Answer my security question
    
    Another choice may be to answer a pre-configured secret (security) question. This is a legacy recovery method as new accounts no longer provide this option.  It also appears that even for accounts that have a security question, it may no longer be offered.  So it is not an error if you configured a secret question and are not offered that as a recovery option.
    
    
    
    
    If answered correctly the next screen will allow the creation of a new password for the account.
    
    
    
    
  
  
  • Verify your identity - The Account Recovery Form
    
    It's possible that none of the above options will work. Perhaps the settings were changed by a hacker who compromised the account. Perhaps they were never configured, or the information has gone out-of-date (the recovery address no longer exists or you have changed your mobile number). In this case, the final option is the Account Recovery Form which is accessed by the link at the bottom: "Verify your identity".
    
    Details of this process appear below.
    
    
    
    This will lead to a series of screens that ask a number of details about the account which if answered correctly will prove ownership and allow the password to be reset. The first two screen look similar to the following.
    
    
    
    
    
    
    
    Once the form as been submitted there will be a confirmation screen.
    
    
    
    
    There are three possible results.
    
    
    1. Success - a link will be provided to reset the password
       

       Congratulations...

    2. Failure - insufficient information has been provided to prove ownership. The only option is to keep trying.
       

       At Google, we take your privacy and security seriously. We're committed to returning accounts only when we're sure we're giving them back to the accounts' owners. Unfortunately, based on the information you provided, we were unable to verify that you own this account. To ensure that we are not compromising the security of the data, we can't return the account at this time.

    3. Additional help offer - sometimes you may be presented an offer for prioritized (posibly paid) support. Google often tests different recovery options so a new option may appear for a time and then vanish. Any offer is optional, so you may ignore it and continue to use the other provided options. The nature of any offers will vary so it's not possible to provide a specific example or document how it would work.
  
  


• I don't know my username
  
  This is the selection to use if you have forgotten the username for the account. This can also sometimes happen if a browser or mobile device is configured to automatically sign in every time, or for an account that is rarely used. But this will only work if a recovery e-mail address was previously configured for the account.
  
  


• Forgot your username
  
  You need to know the recovery address you used for this account, and that address should be entered at this point. There will also be a Captcha to solve before submitting the request.
  
  
  
  If the information is correctly entered above, the next screen will confirm that an e-mail was sent to the recovery address with a list of all Google usernames associated with that e-mail.
  
  
  
  
  When received, the e-mail will look something like this, and may contain a list of multiple e-mail addresses. Once you know the username, you may have to return to the start of the recovery flow to recover the password if that was also forgotten.
  
  
  




• I'm having other problems signing in
  
  This is a catch-all for any problem not covered by the above choices (although it includes the above also). Enter the e-mail address and click Continue.
  
  
  
  
  You will be directed to the following help page which presents a list of options each of which expands into more options and directs you to a specific solution. A few of the options (I forgot my password, or I forgot my username) will direct you back to the above page for recovery.
  
  http://support.google.com/accounts/bin/static.py?hl=en&ts=2402620&page=ts.cs
  
  
  
  
  
  
• Special situations
  
  There are a couple special cases that deviate from the above recovery flow.  So if these cases apply, be aware that it will change what is seen during process.


• Two-step verification
  
  Accounts that have two-step verification enabled will require a verification code at some point during the recovery process. If an access code can not be obtained for any reason, one of the alternate options must be selected, which will probably require the use of the Account Recovery Form to regain access.
  
  The final option ("I didn't enable 2-step verification") can happen if an account is compromised and the hacker enables two-step verification in an attempt to lock-out the rightful owner. Selecting that option will lead to the Account Recovery Form to recover from this case.
  
  
  
  
  If the first option above is selected and Continue is clicked, a code will be received on the designated mobile device which is entered on the next screen.
  
  
  


• Google Apps accounts
  
  Google Apps accounts (those not ending in @gmail.com) can not be recovered using the standard Gmail recovery procedures. One must contact the Google Apps administrator who can reset the password to regain access.
  
  
  

---

Additional Recovery Information

Doing a password reset is the easiest way to regain access to an account. But it can fail if you forgot your secret question, if the recover e-mail address is no longer valid, or it the account was compromised and that information changed.

The Account Recovery Form is the alternative method. It is important that you complete as much of the form as possible, and that the information be as accurate as you can make it. If the form is rejected you can try submitting it again. You can re-submit it as many times as you want, but always wait for a reply to each submission before submitting again. If you don’t receive a reply, check your spam/junk folder (especially if it’s a non-Gmail account). 

It’s very important that as you repeatedly submit the Account Recovery Form that you fill in more of the blanks with more accurate information. There is some threshold of correct information you need to prove ownership, so a rejection means you need to supply more. Submitting the same form with no additional information multiple times does not help.

While this system works for many people, there are some cases where it can be very frustrating. But don’t give up. There’s nothing you can do (like deleting the account) until you re-gain access to it and since Google does not offer live one on one support for the free Gmail product directly these are your options.

Also realize that the more complicated account recover process (that very few people need to use) is one of the trade-offs for not being forced to provide a lot of personal information when you create the account (that everyone has to do). Many people prefer this for privacy reasons.

Hints for successful account recovery

• It’s not about the number of times you submit the Account Recovery Form, it’s about providing more and better answers with each attempt. If your submission is rejected, you must work harder to provide more answers, and make the answers more accurate in subsequent submissions.
• Wait for a response before each new submission (be sure to check Spam). Responses could be delayed as much as 24 hours but you should wait a full 48 hours before submitting another form.
• If you are not receiving a response, check your Spam or Junk folder on the account you specified for replies. Also double (triple) check that you correctly spelled the e-mail account name.
• Duplicate submissions, or submissions without waiting for a reply can trigger a submission lock forcing you to wait a few days to try again.
• Make your best guess on every field of the form. You never know what will help.

There may be one other option for simple password recovery if your account wasn’t compromised and you simply forgot your password. If you have your browser setup to remember your account information you may be able to view your saved password. In Firefox, you can use: Tools->Options, Security, Saved Password, Show Passwords. If you use another browser, then (install and) open Firefox, use File->Import to import your settings and then check to see if the saved password is accessible. Again, this only works for people who forgot their password due to relying on the browser’s auto-fill function, but if it applies it might be an easier than the above procedures.

---

FAQ About Account Recovery

Q. Why can’t I tell someone private information about my account that they could look up to verify my claim?
A. Account privacy rules are very strict within Google, and allowing employees to look at the contents of an account would be a serious breach of privacy.

Q. Why isn’t there a comments section on the Account Recovery Form where I could add additional information to prove my claim?
A. Like above, it would be a violation of account privacy for an employee to look in the account to verify any additional information supplied.

Q. Why can’t I simply talk to somebody about this?
A. Unfortunately, Google does not offer live support for the free Gmail product (see:http://mail.google.com/support/bin/request.py?contact_type=contact_policy). You must use the recovery methods provided.

Q. Why can’t Google lock the account to protect it from any more damage or outgoing spam.
A. They will lock an account that the detection system identifies as being compromised and sending out spam. But again, privacy concerns would prevent them from simply locking an account because someone claims it’s theirs and is compromised. In addition, since there is no live support, there is no one to even make such a request to.

Q. I had a really long password of random strings that would be impossible to guess. How was my account compromised?
A. Google (as most e-mail providers) have blocks to prevent trying lots of passwords to guess the correct one (brute-force attacks). Most accounts are compromised by harvesting passwords other ways. While a secure password is important, it’s only one in a long list of things needed to keep any online account secure.

Q. But I’m very careful with my password. I don’t give it to anyone except an official request from Gmail.
A. Unfortunately if you provided your password in response to any e-mail (even claiming to be from Google/Gmail) then your password was harvested by phishing. It’s very common, and can trick even the most careful people.

Q. I'm not getting any reply after submitting the Account Recovery Form.
A. First, make sure you are using a valid, working contact e-mail address that you check regularly for any replies. Also, check the junk/spam label in case any reply was miss-filtered. Then try again. You might also try a different contact e-mail address.

Q. My contacts were deleted by the hacker, how do I recover them?
A. Deleted contacts can now be restored to any point in the last thirty-days:http://mail.google.com/support/bin/answer.py?hl=en&answer=1069522

Q. My e-mail history was deleted by the hacker, how do I recover it?
A. Have you looked in All Mail and Trash for the missing information? Have you used Search to try and find it? Unfortunately, messages deleted from Trash or Spam can not be recovered. If you would like to request Google attempt to recovery messages deleted by a hacker, see:http://mail.google.com/support/bin/answer.py?hl=en&answer=8256

Q. My account was deleted by the hacker, can I recover it?
A. The Account Recovery Form can sometimes restore a recently deleted account. That is your only option in this case.

Q. I don’t care about the account, can I just get the e-mail history or the contacts from it.
A. Unfortunately, you have to be able to access the account in order to transfer any information out of it. This means you need to try and recover the account.

Q. I don’t care about the contents, I just need the e-mail address back because I have other things linked to that address.
A. Account names are never re-used, so you can’t re-create the account. So to get the name back you will have to try and recover the account.

Q. Can I find out who did this? Can anyone prosecute them?
A. About the only information you have available is the list of the last 10 IPs to access your account (see the Details link below the Inbox). But given how easy it is to fake IPs, and how inaccurate they are, it’s unlikely that more than a general location can be determined. In general, law enforcement is not interested in a simple compromised account, and Google is not a law enforcement agency. Bottom line is: one’s energy is better spent on recovery and re-securing the account.

Q. Isn’t what the person did illegal? Can I sue them or get them arrested?
A. Any legal questions should be asked of local law enforcement or an attorney. Google is neither of those and can not advise you on any actions.

Q. Can I find out what they did in my account while they had access.
A. There are no account activity logs available, so you can’t find out for sure. If there is spam in your Sent Mail, they you know they used the account for that. But there’s no way to know if or what messages they may have looked at, so take appropriate precautions.

Q. How was my account compromised?
A. There are many ways passwords can be harvested and account compromised, but the most common ones include:

• Using the same password on multiple web-sites. A less secure site is hacked and they get the user database (e-mail and password) and then just try them all. If the person did not use a unique password, the hacker gains access to the e-mail account.
• Phishing e-mails that ask for account information or direct you to a phishing web-site. Don’t dismiss this because the messages are a lot more convincing that you would imagine, often using text copied from actual Google e-mails or on-line forms.
• Use of a computer that is infected with a key-logger or other malware (most common for public computers like at a school or library) which records your login information.

---

When You Reclaim Your Account,
How To Secure Your Account

Begin by scrolling to the bottom of your Gmail page and see if there are any other sessions signed into your account (“This account is open in 1 other location”). Then click the word “Details” where it says “Last account activity” (lower/right) and then “Sign out all other sessions”.

Now change your password to anything reasonable but without worrying too much about how secure it is because you are going to change it again. Next check all the following items and verify that they are set correctly.

Note: in the following “Settings” is accessed using the Gear icon in the upper/right of the Gmail window. If you using the Basic html version of Gmail, then “Settings” will be one of the choices along the top.

Note:  in the following pictures "Accounts and Import" may be just "Accounts".  The Import function has been unavailable for some time.

Also note that you may have to scroll down on each specific page to find the referenced setting.

Potential Spam
Settings that could result in spam being attached to outgoing e-mail.

• Settings -> General -> Signature
  Make sure nothing as been added, and be sure to scroll down in case additions aren't visible.
  
  
• Settings -> General -> Vacation Responder
  Make sure it's disabled and empty.
  
  

E-mail Theft
Settings that could result in the theft of e-mail (perhaps without any indication that it is happening).

• Settings -> Forwarding and POP/IMAP -> POP Download
  It is best to disable it unless there is a clear need for it.
  
  
• Settings -> Forwarding and POP/IMAP -> IMAP Access
  It is best to disable it unless there is a clear need for it.
  
  
• Settings -> Forwarding and POP/IMAP -> Forwarding
  Forwarding should be disabled or verified that the forwarding addresses are correct.
  
  
• Settings -> Filters
  No filters defined, or at least no filters that forward or delete e-mail.
  
  
• Settings -> Accounts and Import -> Send mail as
  Make sure it is using your correct e-mail address, and delete any unrecognized entries.  Also click the "edit info" link on the right and verify each entry you have (including the default one) do not have a reply-to address set to an account you do not own.
  
  

Account Security
Settings that improve the security of the account as well as make it easier to recovery a lost account.

• Settings -> Accounts and Import -> Change account settings -> Change password
  Pick a new secure password.
  
  
• Settings -> Accounts and Import -> Change account settings -> Change password recovery options
  Verify mobile phone number, recovery e-mail address, and secret question/answer (if available).
  
  


• Settings -> Accounts and Import -> Change account settings -> Other Google Account settings [new page] Personal Info -> Email & phone -> Edit
  Verify your name and other settings.
  
  
  


• Settings -> Accounts and Import -> Change account settings -> Other Google Account settings [new page] Security -> Account permissions -> View all
  Revoke Access to any sites listed that aren't recognized or absolutely needed.
  
  

• Settings -> Accounts and Import -> Change account settings -> Other Google Account settings [new page] Security -> Password -> 2-step verification -> Setup
  For additional account security, enable 2-step verification, and be sure to save a set of backup codes as instructed during setup.
  
  

Now that your account is secure, check again for other sessions logged in. If there is still another session on the account, repeat the above until you successfully get everything secured while no one else is logged in. Now that the account is fully secured and you've verified no one else is logged in, you may want to change the password one last time.

Additional Information

• Gmail Security Checklist: http://mail.google.com/support/bin/static.py?hl=en&page=checklist.cs&tab=29488
• Keeping account secure: https://mail.google.com/support/bin/answer.py?hl=en&answer=46526
• Protecting your account: https://mail.google.com/support/bin/answer.py?hl=en&answer=29407
• More account security info: http://www.google.com/help/security/
• If your account is compromised: http://mail.google.com/support/bin/answer.py?hl=en&answer=50270
• If you are missing messages after recovering your account:http://mail.google.com/support/bin/answer.py?hl=en&answer=8256
• Someone using your address: http://mail.google.com/support/bin/answer.py?hl=en&answer=50200
• Google Employee comments: http://www.google.com/support/forum/p/gmail/thread?tid=560d53dee40be5e6&hl=en&start=70

---

How To Protect Your Account Contents

As some people learn, even when a compromised account is recovered sometimes the hacker has deleted the e-mail history and/or the contacts. Unless you have backed up that information to your local computer, it may well be lost forever.

There are several ways to backup a Gmail account and a number of tools to help you. Perhaps the most appropriate for Gmail the free utility http://code.google.com/p/got-your-back/ which supports backup and restore of both Gmail and Google Apps account with full support for labels and the ability to be run as an automated scheduled task. It stores the files on your local computer so they can be include in your normal computer backup.