What Should I Do If My Business Email or Google Account Is Hacked?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Get back in, kick the intruder out, and close the door they used. Recover the account, change the password, sign out unknown devices, fix recovery details and email forwarding rules, turn on multi-factor authentication, and check every listing and account connected to it. Then report it and watch for fraud.

What this means

An account takeover is when someone else gets control of one of your accounts, usually by stealing a password through a fake login page or a leak. Signs include:

Password reset emails you didn’t ask for
Security alerts about a new device or location
Sent emails you didn’t write
New forwarding rules or filters in your email
Changes to your GBP, website, or social pages you didn’t make
Customers asking about odd messages from you

Email is the most dangerous account to lose, because it can reset most others. Google’s help for a hacked account says to review recent activity and devices, change your password, check recovery details and third-party app access, remove unfamiliar devices, turn on 2-Step Verification, and check Gmail forwarding rules and filters.

Made-up example: The owner of Westside Auto Glass gets a “new sign-in” alert at 2 a.m. By morning, his email has a rule forwarding every invoice to an outside address, and his GBP phone number has been changed. He follows his plan: recovers the account, deletes the rule, removes the unknown device, turns on a security key, changes the GBP phone back, and warns customers not to pay any invoice with new bank details.

Why it matters

Intruders move fast. They change recovery details first to lock you out.
Email takeovers lead to payment fraud. Fake invoices and bank change requests often come from a real, hacked inbox (see 11.9.5 Payment Fraud).
Listings can be changed or lost. A changed phone number sends your calls to someone else.
It may be a data breach if the account held customer information (see 11.6.6 Breach Notification).

Who this applies to

Every business with online accounts. The most important are email, the Google account tied to your GBP, the domain registrar, the website, banking, and social pages.

How to do it

Act from a clean device. If you think your computer is infected, use a different one.
Try to sign in. If you can’t, use the platform’s account recovery page. For Google, answer the recovery questions as fully as you can.
Change the password to a new one from your password manager (see 11.7.2 Password Manager).
Sign out unknown devices and sessions.
Fix recovery details. Put back your business recovery email and phone (see 11.7.4 Account Recovery Methods).
Turn on multi-factor authentication, ideally a security key or passkey (see 11.7.3 Multi-Factor Authentication).
Check email forwarding rules, filters, and connected apps. Remove anything you didn’t set up.
Check connected accounts. Look at your GBP user list and info, your website admin users, your domain settings, and social pages. Remove unknown users and fix changed info. If you lost owner access to your GBP, see 14.8.3 Transferring Profile Ownership.
Change passwords on accounts that shared the old password.
Warn customers and vendors if messages went out in your name. The Federal Trade Commission (FTC) suggests customer warnings by email contain no links.
Report it. The FTC suggests reporting business email scams to local law enforcement, the Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3) at IC3.gov, and the FTC at FTC.gov/Complaint.
Decide if it’s a breach with your attorney (see 11.9.4 Data Breach Response).
Log every step with times.

What proof to keep

An incident log with times, actions, and who did them
Screenshots of the intruder’s changes before you fix them
Security alert emails
Report confirmation numbers
Copies of customer warnings sent

Common mistakes

Changing the password but not the recovery details. The intruder resets it again.
Missing the forwarding rule, which keeps sending them your mail.
Recovering email but forgetting the GBP, website, and domain.
Deleting evidence before screenshotting it.
Sending warning emails with links, which look just like phishing.
Approving a sign-in prompt you didn’t start.

When to get help from a pro

Information technology (IT) specialist: if you can’t get back in or think a device is infected. Privacy attorney: if customer data was exposed. Your bank: right away if money moved. Questions to ask:

How did they get in, and is that path closed?
Was any customer data viewed or taken?
Is any other account still at risk?

Bill’s note

[Bill: add a short note. For example, a client whose Google Business Profile was hijacked and how you helped recover it, or the warning signs you tell clients to watch for.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile management.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: writing the SiteSmarty account takeover checklist and checking forwarding rules and devices]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: Google Account security page with devices and recent activity]
[Result so far:]

Questions people ask

How do I get back into a hacked Google account? Try to sign in. If you can’t, use Google’s account recovery page. Once in, change the password, check recovery details, remove unknown devices, and turn on 2-Step Verification.

What if someone took over my Google Business Profile? Secure the Google account first, then check the profile’s user list and info. If you’ve lost owner access, follow Google’s process for regaining ownership (see 14.8.3 Transferring Profile Ownership).

Who do I report it to? The FTC suggests local law enforcement, IC3.gov, and FTC.gov/Complaint for business email scams. Tell your bank if money is involved.

How do I know if my email was hacked? Watch for new device alerts, password resets you didn’t request, sent messages you didn’t write, and new forwarding rules.

Audit check

Question: Does the business have a written account takeover checklist, and are key accounts protected so a takeover is unlikely and fast to fix?
Pass looks like: A one page checklist, multi-factor authentication on key accounts, business-controlled recovery details, no unknown forwarding rules, and two admins on the GBP.
Fail looks like: No plan, one admin, recovery details pointing to old staff, and unknown forwarding rules.
Evidence to collect: The checklist, multi-factor settings, recovery settings, forwarding rule screenshot, and GBP user list.

Where this fits

Do this first: 11.7.3 Multi-Factor Authentication, 11.7.4 Account Recovery Methods, 11.7.5 Access Inventory

Do this next: 11.9.3 Ransomware

Sources

Google Account Help, "Secure a hacked or compromised Google Account" (checked October 17, 2026)
Google Business Profile Help, "Manage your Business Profile owners and managers" (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
Cybersecurity and Infrastructure Security Agency, "More than a Password" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.