For most Android users, your Google account is the master key: it holds your Gmail, your phone backups and photos, your YouTube channel, and often the passwords for everything else. If someone gets into it, they can reset the passwords for your other accounts too. Ten minutes now can save you a lot of pain.
1. Run Google Security Checkup
Open your Google Account (Settings → Google on Android, or myaccount.google.com), go to Security, and follow the recommended actions. Google says Security Checkup gives you personalised recommendations to secure your account.
2. Turn on 2-Step Verification
2-Step Verification means a stolen password alone is not enough to get in. In your Google Account, go to Security → 2-Step Verification and follow the steps.
Google ranks the options: security keys are the most secure, then Google prompts (a tap on your phone), then SMS codes. A prompt is a good choice for most people, and it is not affected by SIM swap fraud the way SMS codes can be.
3. Set recovery options
- Add a recovery phone number and a recovery email you control.
- Save your backup codes somewhere safe offline, in case you lose your phone.
4. Check where you are signed in
Under Security → Your devices, review the list. If you see a device you do not recognise, choose “Don’t recognise a device?” and follow the steps.
5. Fix weak or leaked passwords
Google’s Password Checkup (in Google Password Manager) can tell you if saved passwords are weak, reused or exposed in a data breach. Change any it flags, starting with email and banking.
6. Review apps with access
In your Google Account, look under Security for the list of third-party apps and services connected to your account, and remove anything you do not recognise or no longer use.
If you think it is already hacked
Google’s guidance: review recent security events, check your devices, and correct any suspicious changes to your recovery phone, recovery email, name, connected apps and 2-Step Verification settings. If you cannot sign in, use Google’s account recovery and answer as accurately as you can. Google says recovery can take 3 to 5 business days. More in what to do when your account is hacked.
This guide was checked in October 2026. Menus and services change, so if something looks different on your phone, check with your provider.
Common questions
What is Google Security Checkup?
A page in your Google Account that gives personalised security recommendations. Open your Google Account, go to Security, and follow the recommended actions.
Which 2-Step Verification method is best?
Google ranks security keys as the most secure, then Google prompts on your phone, ahead of SMS codes.
I lost access to my Google account. How long does recovery take?
Google says recovery can take time, in some cases 3 to 5 business days while it confirms it is you.
Why does my Google account matter so much?
It is often the key to your other accounts, because password reset emails go to Gmail and your Android phone is tied to it.
