How to Secure Your Google Account: 2-Step Verification, Passkeys and Recovery
9 min read Your Google account holds your email, photos, backups and often your phone itself. These steps make it much harder for someone else to take over. October 06, 2026 08:01 By Disha Varia, Guj Times
For many people, a Google account is the key to everything: email, Android backups, Google Photos and even the password reset links for other websites. Losing control of it causes a chain of problems, so it is worth spending fifteen minutes on protection.
Step 1: Run the Security Checkup
Go to myaccount.google.com and open Security. Google lists issues such as weak passwords, unfamiliar devices and risky third-party access. Fix the items marked with warnings.
Step 2: Turn on 2-Step Verification
This adds a second check when you sign in, so a stolen password alone is not enough. Open 2-Step Verification and follow the prompts. A prompt on your phone or a security key is stronger than an SMS code, but any second step is better than none.
Step 3: Consider passkeys
A passkey lets you sign in using your fingerprint, face or screen lock instead of typing a password. It is harder to steal through a fake website because it is tied to the real one. You can create one from the same Security page.
Step 4: Update recovery options
Add a current phone number and a recovery email. Check them every few months, because an outdated number can lock you out when you need it most.
Step 5: Review signed-in devices and third-party access
Remove old phones, laptops and cyber-cafe computers. Also remove apps that you no longer use from the list of third-party access.
Step 6: Use a different password for every account
If one website leaks your password and you use it everywhere, attackers will try it on your email. A password manager such as Bitwarden creates and stores unique passwords so that you need to remember only one.
Warning signs of a takeover attempt
- Sign-in alerts from places you have never been.
- A code arriving that you did not request.
- Someone asking you to read out an OTP.
Never share verification codes, even with someone who claims to be from Google. Google does not ask for them over the phone.
Make it a habit
Repeat the checkup twice a year. You can also read how to check whether your email appeared in a data breach.
Quick answers
Is an SMS code good enough for 2-Step Verification? It is much better than nothing, but a phone prompt, security key or passkey is stronger because a SIM can be cloned or swapped.
What if I lose my phone after turning on 2-Step Verification? Use your saved backup codes or another recovery method. Set up a second method in advance so that you are not locked out.
Why your Google account matters more than most accounts
Your Google account usually holds your Gmail, Photos, Drive, contacts, Play Store purchases and Android backups. Many other sites let you reset passwords through the email in this account. If someone takes it over, they can reach many other services quickly.
Which second step to choose
A prompt on your phone or a passkey is generally stronger than an SMS code, because SMS codes can be targeted by SIM-swap fraud or tricked out of people by scammers. Keep SMS as a backup only if you have no other option, and keep your phone number protected.
Do a yearly recovery test
Once a year, check that the recovery email and phone number in your account are still yours and still working. Many people lose access to their accounts because they changed numbers and forgot to update them. If you share a family computer, sign out after use and do not save passwords in the browser on a shared profile.
Passkeys explained simply
A passkey lets you sign in with the same method that unlocks your phone, such as a fingerprint, face or screen lock, instead of typing a password. It is tied to the website and your device, which makes it very hard to steal through a fake page. If you are not ready for passkeys, 2-Step Verification with a phone prompt is a good step. Do not switch off your existing second step until you have tested that the new one works.
What attackers actually do after getting in
Many people think a hacker only reads the mail. In practice, they often add an automatic forwarding rule or a filter in Gmail that quietly copies your messages to another address, change the recovery phone or email, and then send scam messages to your contacts. That is why a "checkup" should include the Forwarding and Filters tabs in Gmail settings and the recovery details in your account.
A twenty-minute checkup you can do tonight
- Open Security Checkup in your Google account and fix every item marked in red or yellow.
- Look at "Your devices" and sign out of any you do not recognise.
- Open "Third-party access" and remove apps you no longer use.
- Check that your recovery phone number and email are current.
- Create a strong, new password if you have reused it anywhere.
- In Gmail settings, check forwarding and filters for anything you did not set up.
If you think you have been hacked
If you can still sign in, change the password, sign out of other devices, review recovery options and check forwarding and filters. If you cannot sign in, use Google's account recovery page and answer as many questions as you can from a device and place you normally use. Then warn your contacts that messages from you may be scams, and change passwords of other accounts that use the same email. If money or identity documents are involved, inform your bank and report on cybercrime.gov.in.
For parents, students and shop owners
Parents who manage a child's account through Family Link should secure their own account first. Students who use a college email should check whether the college manages recovery. Shop owners who use one Google account for Maps, Gmail and payments should add a second recovery method, since losing this account would affect the whole business.
High-risk users
If you are a journalist, an activist or someone who is targeted often, Google offers a stricter option called the Advanced Protection Program. It adds extra steps and requires security keys, so read the current requirements on the official page before you enrol.
User Comments (0)
Apps to explore
