How do you recover a compromised Google Workspace account?

A compromised Google Workspace account is one an attacker can sign in to or act through, usually after a phishing page captured the password or a session. Recovering it means cutting off every way back in, not just changing the password. This guide gives Google's admin steps in order, with the exact Admin console paths at the time of writing (November 2026), and links to our deeper guides for each investigation tool.

What should you do right now? (first 15 minutes)

If you believe a Workspace account is compromised, suspend it first, then remove every way the attacker can get back in. Use this checklist from Google's compromised account guidance:

1. Suspend the user. Admin console > Directory > Users > point to the user > More options > Suspend user. Google says suspending "resets the user's sign-in cookies and OAuth tokens."
2. Reset the password from a clean device: user page > Reset password.
3. Revoke app passwords and connected apps on the user's Security page.
4. Remove unknown passkeys, security keys and recovery details on the same page.
5. Check Gmail filters, forwarding and delegates for anything the user didn't create.
6. Warn finance if the account sends or approves payments, and call anyone who got a payment request from it.

If the user only clicked a link and didn't enter anything, the shorter steps in what to do after clicking a phishing link may be enough. If you're not yet sure the account is compromised, start with signs an email account is compromised.

How do you tell a Workspace account has been compromised?

A Workspace account is likely compromised when you see sign-ins from unknown places, Gmail filters or forwarding the user didn't create, sent mail they didn't write, or a Google alert about a suspicious login or leaked password. Google records many of these as named events in the login audit log (Admin SDK login events):

You can search these events in Reporting > Audit and investigation > User log events. The alert center turns several of them into email alerts.

How do you suspend the account and sign the user out?

Suspending the user is the fastest way to stop an attacker, because Google says it resets the user's sign-in cookies and OAuth tokens in one step. At the time of writing (November 2026), Google's steps are:

1. In the Admin console, go to Menu > Directory > Users.
2. Point to the user, click More options and choose Suspend user. Or open the user's page and click Suspend user.
3. Click Suspend to confirm.

What suspension does and doesn't do:

• New email and calendar invitations are blocked, but "email, documents, calendars, and other data aren't deleted."
• Collaborators keep access to documents the user shared.
• "Suspended accounts are still charged."
• You can't turn off 2-Step Verification for a suspended user, so do any 2SV clean-up after you reactivate.

If you can't suspend (for example, the user is an executive mid-deal and you need their mail flowing), at least reset the sign-in cookies: user page > Security > Sign-in cookies > Reset (Google). Google notes this signs the user out of browsers and mobile devices, but "does not sign them out of apps, such as Gmail and Google Drive for desktop." If you use third-party single sign-on (SSO), end the SSO session at the identity provider first.

How do you reset the password and revoke access?

Reset the password, then remove every credential that doesn't depend on it: app passwords, connected OAuth apps, and any passkey, security key or recovery detail the attacker added. All of it is on the user's Security page: Directory > Users > the user > Security (Google Workspace Admin Help).

Two details from Google's password reset page: you need reset password privileges, and choosing Automatically generate a password forces the user to set a new one at next sign-in. Give the temporary password by phone or in person, never to the compromised mailbox.

Google's compromised-account steps also say to "revoke the user's OAuth 2.0 tokens" and warn that some OAuth apps stop working after a password reset until the user signs in again. That's expected. Note that removing a connected app is temporary: Google says the user can sign in to it again to restore access, so if the app itself is malicious, block it in your app access controls as well.

How do you check Gmail for filters, forwarding and delegates?

Check Gmail filters, the forwarding address, mail delegates and POP or IMAP clients, because each one keeps feeding the attacker mail after the password is reset. Google's checklist tells admins to verify "whether malicious settings were created, such as forwarding" through the Gmail API.

To audit at scale, the Gmail API's users.settings.getAutoForwarding, users.settings.filters.list and users.settings.delegates.list methods read these settings for any user. Google says the delegates methods are "only available to service account clients that have been delegated domain-wide authority" (Gmail API reference).

A sample malicious filter, for illustration only:

Matches: from:(@supplier-example.com) OR subject:(invoice OR payment OR "bank details")
Do this: Skip Inbox, Mark as read, Apply label "Notes"

Record each filter before deleting it; the matching words tell you who the attacker was targeting. Our guide to malicious inbox rules and auto-forwarding has more patterns. To stop forwarding outside your domains for everyone, see how to disable automatic forwarding in Google Workspace.

How do you investigate what the attacker did?

Investigate by working out the time window from sign-in events, then reviewing every message, file share and admin change in that window. Google's compromised account guide lists the logs to check:

1. User log events (Reporting > Audit and investigation > User log events): successful and failed sign-ins for up to 6 months, with suspicious ones marked. Note the first suspicious sign-in and its IP address. The User log events page also lists password, recovery and 2SV changes as critical actions to review.
2. Email Log Search: what the account sent and received in the window. Look for payment requests, replies inserted into invoice threads and mass mailings. Our Email Log Search guide shows how.
3. OAuth, Groups, Drive and Calendar log events: apps granted access, group membership changes and files shared outside the domain.
4. Admin audit log, if the user is an admin: every configuration change the attacker could have made, such as new routing rules or allowlist entries.
5. Mobile devices: in Devices > Mobile & endpoints > Devices, wipe the account from any device the user doesn't recognize (this needs the device to be under basic or advanced management).

On editions that include the security investigation tool, search Gmail log events for the attacker's messages and delete them from every recipient's inbox in one action. Keep one copy with full headers; the Email Header Analyzer shows where the original phishing email came from.

How do you give the account back safely?

Give the account back only after every credential and setting above is clean, then reactivate it with a temporary password and enforce 2-Step Verification. Google's restore steps are:

1. Unsuspend the user: user page > Reactivate.
2. Give a temporary password and require a new, unique one at first sign-in.
3. Enforce 2-Step Verification, and Google recommends security keys over codes. Our 2SV enforcement guide covers the rollout.
4. Have the user complete Google's Gmail security checklist: recovery options, recent activity, filters and forwarding.
5. Change passwords on the recovery email and on any other service where the user reused the old password.
6. Turn on alerts for suspicious sign-ins and admin setting changes.

If Google, not an admin, suspended the account, the user page shows why. Google says you can restore the same account only five times per calendar year, and Gmail should be enabled within 15 minutes of reactivation (Google).

How do you stop it happening again?

Most Workspace account takeovers start with a phishing email, so prevention is phishing-resistant sign-in plus fewer phishing emails reaching users. Two-factor codes can be relayed by adversary-in-the-middle phishing; security keys and passkeys can't, which is why Google recommends them. See passkeys and phishing-resistant MFA for how they work.

Fake Google security alerts are a common lure; our guide to fake Google account security alert phishing shows what they look like.

Next steps

1. Write these steps into your incident plan with a named owner for each, so nobody improvises during an incident.
2. Run a forwarding and filter audit across all users with the Gmail API this week.
3. Enforce 2-Step Verification for admins and finance first.
4. Reduce the phishing that leads to takeovers. iBlockSpam filters phishing, spoofing and malware at the MX before mail reaches Gmail; our Google Workspace page explains how it sits in front of Google's own filtering.

Browse our other email operations guides.