You type your password into Gmail and it does not work. Or you wake up to a Google alert about a sign-in from a country you have never visited. Or a friend messages you on Messenger asking why you sent them a strange link. That sinking feeling is the same for everyone: your Gmail has been hacked, and your inbox is the master key to almost everything else you own online.
In Bangladesh that key opens more doors than most people realise — your Facebook and Page logins, your bKash or Nagad account notifications, your Payoneer and Freelancer profiles, your Google Drive of NID scans and certificates, your Play Store payment methods. This guide walks you through exactly what to do in the first ten minutes, how to get back in even when the attacker has changed your recovery phone and email, and how to lock the account down so it never happens twice. Everything here reflects how Google account security actually works in 2026 — including two recovery tools most guides have not caught up with yet.
KEY TAKEAWAYS
- Changing your password alone is not enough in 2026. Modern attacks steal your live session cookie, so the intruder stays logged in even after a password reset. You must sign out every device as well.
- There is no limit on recovery attempts. Wrong guesses do not lock you out of Google's recovery form — but where and how you try matters enormously.
- Two new 2026 lifelines exist: Recovery Contacts (a trusted friend verifies you) and sign-in with your mobile number using your old phone's lock-screen PIN.
- If the hacker changed your recovery info, expect a 7-day security delay — Google deliberately freezes changes so a thief cannot lock you out permanently.
- Google's Dark Web Report is gone — shut down on 16 February 2026 — so breach monitoring now has to come from elsewhere.
- Never pay a "recovery expert." Google states plainly that you cannot phone Google for sign-in help and that it works with no such service. Every Tk 2,000 "guaranteed recovery" offer in Bangladesh is a scam.
What this guide covers
- How to tell if your Gmail is actually hacked
- The first 10 minutes: what to do right now
- Path A — you can still sign in
- Path B — you are locked out completely
- When the hacker changed your recovery phone and email
- Two recovery options that are new for 2026
- Why a password change is not enough anymore
- Bangladesh damage control: what else is linked to your Gmail
- Never pay a "Gmail recovery expert"
- Prevention: making your account genuinely hard to hack
- Reporting it in Bangladesh (official channels)
- Frequently asked questions
How to tell if your Gmail is actually hacked
Not every strange login alert means a breach. Google sends warnings when you sign in from a new device or a new network, which happens often if you switch between Wi-Fi and mobile data or use a VPN. Genuine compromise leaves a different kind of fingerprint. Here is how the two compare.
| Signal | Probably harmless | Treat as a real hack |
|---|---|---|
| Sign-in alert | New device you recognise, or your own city after switching networks | Sign-in from another country, or a device model you have never owned |
| Password | You forgot it and reset it yourself | Google says "password changed" at a time you were asleep |
| Sent folder | Nothing unusual | Emails you never wrote; contacts report spam or a loan request from you |
| Inbox goes quiet | Slow day, or mail landed in Promotions | You stop receiving mail entirely — a hidden filter is deleting or forwarding it |
| Recovery details | You updated your own number after a SIM change | Recovery phone or email now shows a number or address that is not yours |
| Missing mail | Archived by accident, still findable in All Mail | Emails deleted from the inbox and not in Trash either |
| 2-Step Verification | You turned it off yourself | It switched off, or a new second-factor method appeared, without you touching it |
Two Bangladesh-specific tells are worth adding. First, if your Facebook or Page suddenly requires re-login and the reset email never arrives, the attacker is very likely sitting inside your Gmail intercepting it — start here, not on Facebook. Second, if a Google Ads or Google Cloud account you never created appears billed to your address, that is a classic monetisation pattern after a Gmail takeover.
The fastest objective check is Google's own log. Open your Google Account, go to Security, and open Recent security activity and Your devices. Anything you cannot account for there is your answer.
The first 10 minutes: what to do right now
Speed matters more than perfection here. An attacker inside your inbox is racing to do three things: change your recovery details so you cannot get back in, harvest password resets for your other accounts, and set up a hidden forwarding rule so they keep reading your mail even after you recover. Every minute you save cuts into that.
Do these three things before anything else
- Try to sign in on a device you have used before. Your own phone or laptop, on your usual home or office network. Google weighs familiar devices and locations heavily, and this single choice changes your odds more than any other step.
- Do not create a new Gmail address yet. People panic and abandon the account on day one. Recovery is often still possible days later, and the old address is what every other service is tied to.
- Warn the people who might be targeted next. A quick message to family, close friends and your work group stops the "urgent, send me Tk 5,000 on bKash" follow-up scam that usually comes within hours.
Now everything splits into two paths depending on one question: can you still sign in?
Path A — you can still sign in
Good news: you are in the strong position, and you have maybe a few hours before the attacker locks you out. Work through these five steps in order, without skipping.
1. Change your password — then immediately sign out everywhere
Go to Google Account → Security → Password and set something long and unique that you have never used anywhere else. Then go to Security → Your devices → Manage all devices and sign out of every session you do not recognise. This second half is the part almost everyone skips, and it is the part that actually evicts the intruder. See our guide on creating strong passwords you can remember if you need a method that does not collapse into "Dhaka1234".
2. Turn on 2-Step Verification
Under Security → 2-Step Verification, enable it and choose an authenticator app or a passkey rather than SMS if you can. SMS codes are the weakest option because they can be intercepted through SIM swap fraud, which is a live problem with Bangladeshi operators. Save your backup codes somewhere offline. Our two-factor authentication setup guide walks through each method.
3. Repair your recovery details
Check Security → Recovery phone and Recovery email. If either was changed, correct it now. Make sure the recovery number is a SIM you physically hold and the recovery email is an account you can actually open.
4. Hunt for the backdoors inside Gmail
This is where attackers hide so they can keep reading your mail after you think you have cleaned up. In Gmail Settings → See all settings, check every one of these:
- Filters and Blocked Addresses — delete any filter you did not create, especially ones that delete, archive or forward mail
- Forwarding and POP/IMAP — remove any forwarding address that is not yours and turn off IMAP/POP if you do not use a mail app
- Accounts and Import → Grant access to your account — remove any delegate
- Send mail as — remove unfamiliar alias addresses
- Vacation responder and signature — attackers use these to push scam links to everyone who emails you
- Labels — a label paired with a filter is a common way to quietly divert bank or OTP mail
5. Revoke third-party app access
Go to Security → Your connections to third-party apps and services and remove anything you do not actively use. A malicious app with mail access keeps its own permission even after you change your password, which is exactly why some people get re-hacked a week later. While you are there, run Password Checkup to find reused or leaked passwords saved in your Google account — this is also the tool Google now points to after retiring its Dark Web Report.
Path B — you are locked out completely
Head to Google's account recovery page at g.co/recover. Before you start, one reassurance that removes a lot of unnecessary panic: wrong guesses do not eject you from the process, and there is no cap on how many times you can try. That is Google's own stated policy. So a failed attempt is not the end — it is information.
Recovery tips that genuinely raise your success rate
Google's recovery form is a risk score, not a quiz. It is weighing signals about whether this attempt looks like you. Stack those signals in your favour:
- Use a device and browser you have signed in from before, in a location you normally use. A cyber café PC in a different district is the worst possible choice.
- Use your usual home or office Wi-Fi. Turn off any VPN — a foreign exit IP makes your attempt look like the attacker's.
- Answer every question, even approximately. "I don't know" is scored worse than a reasonable estimate. Give your best guess for the month and year you created the account.
- When asked for your last remembered password, give the most recent one you can recall, even if you are unsure — an older correct password still counts as evidence.
- If you have an alternate email you can access, enter it so Google has a channel to send you a code.
When the hacker changed your recovery phone and email
This is the scenario that fills Google's own support forums, and it is the one almost no guide answers properly. You click "forgot password," and the phone number Google offers to text is not yours. The recovery email is not yours. Every door appears to be shut.
It is not. Google anticipated exactly this attack, and there is a built-in protection working in your favour.
The 7-day rule: when account recovery information is changed, it can take up to seven days for that change to take full effect. Google's guidance is explicit — if recovery details were altered, wait a few days and try recovering again. This delay exists precisely so a thief cannot instantly nail the door shut behind them.
So the correct strategy when your recovery details have been hijacked is patient and repetitive, not one desperate attempt:
- Attempt recovery immediately anyway, from your most familiar device and network.
- If it fails, try again the next day, and again the day after. Nothing is lost by retrying.
- Keep trying past the seven-day mark, because that is when a hacker's change to your recovery phone may not yet be locked in.
- In parallel, secure everything the attacker could reach from your inbox — that work is covered further down.
Separately, Google says that if it detects a suspicious sign-in method being added to your account, it disables that method and notifies you, and you then have 30 days to confirm whether you added it. If you do nothing, the suspicious method is removed. In other words, some attacker-added recovery options expire on their own.
Two recovery options that are new for 2026
Google rolled out two recovery methods in late 2025 that are still missing from nearly every "hacked Gmail" article online, including several that currently rank at the top of search. Both are worth setting up today, while you still have access.
Recovery Contacts — a trusted person vouches for you
You can nominate people you trust as Recovery Contacts, and they can help verify your identity if you are ever locked out by a forgotten password, a lost passkey device, or a compromise. Set it up at g.co/recovery-contacts, or under Security → How you sign in to Google → Recovery contacts. The mechanics worth knowing:
- You can add up to 10 recovery contacts, and each must accept the invitation.
- When you need help, you share a code with them; they confirm it, and that verifies you. The code is short-lived — around 15 minutes — so pick someone who answers their phone quickly.
- A recovery contact cannot access your account, your mail, or any personal information. They only confirm you are you.
- There is a waiting period before a newly added contact can be used, and once used, the same contact cannot be used again for seven days. This is why you must set it up before trouble, not during.
- Accounts enrolled in Google's Advanced Protection Program, Workspace accounts, and child accounts cannot use recovery contacts, though they can act as one for others.
Sign in with your mobile number
Google is also rolling out sign-in with a mobile number as a recovery route, aimed at people who have lost a device. It finds the accounts linked to that number and lets you verify using your previous phone's lock-screen PIN or pattern. This is genuinely useful in Bangladesh, where a lost or stolen handset and a lost account often happen at the same moment — the old phone's screen lock becomes your proof of identity. It is being released gradually worldwide, so check whether it appears in your recovery flow.
Why a password change is not enough anymore
This is the single most important shift between the advice written in 2020 and the reality of 2026, and it explains why some people "recover" their account only to lose it again days later.
In its fraud and scams advisory published in June 2026, Google described attacks it calls adversary-in-the-middle (AiTM) phishing: a fake login page sits between you and the real Google, relays what you type to the genuine service in real time, and captures the session cookie Google issues after you authenticate. Because the attacker holds a valid session, they walk straight past multi-factor authentication. Your 2FA worked exactly as designed and still did not help.
What this means practically: if you only change your password, an attacker holding a stolen session cookie may still be logged in. Changing the password and signing out of all devices together is what invalidates those sessions. Do both, in that order, every time.
Google's June 2026 advisory named two other techniques hitting Gmail users directly. Calendar invite phishing plants fake renewal or payment notices straight into your Google Calendar, skipping your spam filter entirely — you can blunt this in Calendar settings by setting event creation from invitations to only add events when you respond to the invitation in email. ClickFix lures show a convincing "your browser needs updating" page and talk you into running the installer yourself. The rule is simple: never run a command or install an update because a web page told you to.
Google is also deploying Device Bound Session Credentials, a defence designed to make a stolen cookie useless on a different machine. It is a real improvement, but it is not universal yet, so the manual habit still matters. If you want to spot these lures before they land, read our guide on how to spot phishing emails and fake links.
Bangladesh damage control: what else is linked to your Gmail
Recovering the inbox is only half the job. Your Gmail is the password-reset address for a long list of accounts, and the attacker had time to use it. Work through this list the same day.
| What is at risk | What to do immediately |
|---|---|
| Facebook and your Page | Change the Facebook password, check Business Suite for admins you did not add, and review linked email addresses. Full steps in our Facebook account recovery guide. |
| bKash, Nagad, bank apps | Check statements for transactions you did not make. Never share an OTP with anyone claiming to be from support — see our guide on OTP scams in Bangladesh. Report suspicious activity to your provider's official helpline at once. |
| Freelancing income | Payoneer, Wise, Upwork, Fiverr and Freelancer all reset via email. Change those passwords, enable 2FA on each, and confirm the withdrawal bank account has not been altered — this is where real money is lost fastest. |
| Google Drive and Photos | NID scans, passport copies, certificates and bank statements are common Drive contents here. Review shared files, revoke unfamiliar sharing links, and check Photos for albums shared without your knowledge. |
| Google Play and Google Ads | Remove payment methods you do not recognise and report unauthorised charges. An unexplained Google Ads account on your email is a red flag to act on immediately. |
| Your phone itself | If credentials were stolen by malware, cleaning the account is pointless until the device is clean. Check our guides on signs your phone is hacked and removing viruses from Android. |
If your recovery SIM is gone
A stolen phone often means a stolen recovery number too. Get a replacement SIM from your operator — Grameenphone, Robi, Banglalink or Teletalk — using your NID at an official customer care centre, and do it quickly. As long as the number is registered to your NID it can be reissued, and restoring it restores your recovery channel. Anyone who obtains a duplicate SIM in your name can also intercept your codes, which is the whole basis of SIM swap fraud.
Never pay a "Gmail recovery expert"
Search "gmail hacked recovery Bangladesh" and you will find Facebook pages, YouTube comments and Messenger accounts offering guaranteed recovery for Tk 1,500 to Tk 5,000. Some show screenshots of "recovered" accounts. All of them are scams, and Google says so directly.
Google's own position, stated plainly
For security reasons, you cannot call Google for help signing in to your account, and Google does not work with any service that claims to provide account or password support. Do not give out your passwords or verification codes to anyone.
There is no private back door. Nobody has one. What these operators actually do is take your money, or take the partial credentials you hand over and finish the takeover themselves.
The only legitimate route is Google's own recovery form at g.co/recover, retried patiently over several days. If someone tells you otherwise, that is your signal to walk away.
Prevention: making your account genuinely hard to hack
Once you are back in, spend twenty minutes making sure this is a one-time story. These are ordered by how much protection they buy you per minute spent.
- Add a passkey. A passkey is bound to your device and to Google's real domain, so it cannot be handed to a lookalike login page. This is the one change that shuts down the AiTM phishing described above. Set it under Security → How you sign in to Google.
- Add Recovery Contacts now. Because of the waiting period, this only helps if you set it up before you need it. Choose one or two people who genuinely answer their phone.
- Move 2FA off SMS. Use an authenticator app or a security key. Keep printed backup codes in a drawer at home.
- Use a password manager. One breached site should never expose your Gmail. Our password manager guide covers free options that work fine in Bangladesh.
- Run Security Checkup every few months. It surfaces unfamiliar devices, risky third-party access and weak recovery settings in one screen.
- Stop installing modded APKs and cracked software. Info-stealing malware bundled with "premium unlocked" apps is one of the most common ways credentials and session cookies leave a device in this region.
- Audit app permissions periodically. See our guide to auditing what your apps know about you.
One 2026 change to know about: Google's Dark Web Report was discontinued — scanning stopped on 15 January 2026 and the feature was removed on 16 February 2026, with its data deleted. Google said the tool did not give people clear next steps, and now points users to Security Checkup, Password Checkup and Results about you instead. If you relied on those breach alerts, you need another source now — our guide on checking whether your password has leaked covers the alternatives.
Reporting it in Bangladesh
If money was stolen, if you are being blackmailed with data from your inbox, or if your identity is being used to defraud your contacts, this is a criminal matter and not just a technical one. Bangladesh's cyber law framework changed recently — the Cyber Security Ordinance 2025 came into effect on 21 May 2025, replacing the Cyber Security Act 2023 — but the practical reporting channels remain the same.
- Online complaint portal: Bangladesh Police's cyber crime reporting portal at cybercrime.gov.bd, which issues a reference number you should keep.
- Emergency: 999 for anything involving an immediate threat to your safety.
- Police Cyber Support for Women (PCSW): a dedicated confidential service for women and girls facing online harassment, blackmail or sextortion.
- CID Cyber Crime Unit: for serious hacking and organised financial fraud, at the CID complex in Malibagh, Dhaka.
- CTTC Cyber Crime Unit under Dhaka Metropolitan Police, for cases inside the capital.
Bring evidence: screenshots of the sign-in alerts, the security activity log, transaction records, and your NID. Contact numbers and unit names are reorganised from time to time, so confirm current details on the official site before you travel. Our step-by-step guide to reporting cybercrime in Bangladesh covers the full process. If money moved through mobile financial services, call the provider's official helpline within hours — the earlier a transaction is flagged, the better the chance of a freeze.
Frequently asked questions
Can I call Google to recover my hacked Gmail?
No. Google states that for security reasons you cannot call it for sign-in help, and that it does not work with any service claiming to offer account or password support. Recovery happens only through g.co/recover.
How many times can I try account recovery?
As many times as you need. Wrong guesses do not remove you from the recovery process and there is no limit on attempts. Trying again on a different day, from a familiar device, is often what finally works.
The hacker changed my recovery phone number. Is the account lost?
Not necessarily. Changes to recovery information can take up to seven days to take effect, so keep retrying across that window. Google may also automatically disable a sign-in method it considers suspicious and remove it if nobody confirms it within 30 days.
Amar Gmail hack hoise, ekhon ki korbo?
Age dekhun apni sign in korte parchen kina. Parle sathe sathe password change korun ebong sob device theke sign out korun — sudhu password change korle hacker er session active thakte pare. Tarpor Gmail settings e filter, forwarding ar third-party app access check korun. Sign in korte na parle g.co/recover e jaan, ebong nijer purono phone o barir Wi-Fi theke chesta korun — eta sob cheye beshi kaj kore. Kono "recovery expert" ke taka diben na.
I had 2FA turned on. How did they still get in?
Most likely through an adversary-in-the-middle phishing page that captured your session cookie after you authenticated, which lets an attacker bypass multi-factor authentication entirely. It can also happen through info-stealing malware on your device. A passkey is the strongest defence against the first; a clean device is the answer to the second.
Should I just create a new Gmail account?
Only as a last resort, and not in the first week. Your old address is the recovery point for your bank, Facebook, freelancing platforms and government services, and recovery frequently succeeds on a later attempt. If you do eventually create a new account, set up 2FA, a passkey and recovery contacts on day one.
Can I recover emails the hacker deleted?
Check Trash and Spam first, since deleted mail stays in Trash for 30 days. Beyond that, Google has a process for reporting missing mail, though recovery is not guaranteed once the retention window has passed.
What is the single best thing I can do today?
Add a passkey and set up a Recovery Contact. The passkey prevents the most common modern takeover, and the Recovery Contact gives you a human route back in — but only if you add it before you are locked out, because a newly added contact cannot be used straight away.
The bottom line
A hacked Gmail feels final in the first hour, and it usually is not. Get to a familiar device, change the password and sign out everywhere, clear the filters and forwarding rules the attacker left behind, then work outward to everything your inbox unlocks. If you are locked out, retry recovery across several days rather than giving up after one attempt.
Then spend the twenty minutes that stop it repeating: a passkey, an authenticator app instead of SMS, and a Recovery Contact added while you still can. Attacks in 2026 have moved past guessing passwords — so your defences have to move past passwords too.
