Google Account Locked: What's Actually Happening and How to Get Back In

Your Google account is locked. Maybe you got an "unusual activity" warning, a password reset you didn't request, or you simply got locked out after too many failed attempts. Here's a clear diagnosis of what triggered it and the fastest path back in.

Step 1: Identify Why You're Locked Out

Google locks accounts for four distinct reasons, each with a different fix:

• Too many failed password attempts → temporary lockout (usually 24–48 hours) or requires account recovery
• Suspicious sign-in activity detected → Google paused access pending your verification
• Account compromised → someone else changed your password or recovery info
• Policy violation → account disabled for Terms of Service reasons (different process entirely)

The error message tells you which one you're dealing with. "Couldn't sign you in" = failed attempts or unrecognized device. "Account has been disabled" = policy violation. "This account was recently compromised" = security hold.

Step 2: Standard Recovery (Works for Most Cases)

1. Go to accounts.google.com/signin/recovery.
2. Enter your Gmail address and click Forgot Password.
3. Google will offer recovery options in order of what it trusts most — a verification code to your recovery phone, a recovery email, or security questions.
4. If you get a code prompt: check your recovery phone or email. Codes expire in 10 minutes.

Important: Use a device and location you've used with this Google account before. Google's recovery algorithm weighs device familiarity — a known device dramatically increases recovery success rate.

Step 3: Recovery Options Aren't Working

No Access to Recovery Phone or Email

1. At the recovery screen, click "Try another way" repeatedly — Google cycles through multiple verification methods including: answering a security question, confirming a recent password you remember, or verifying via a trusted device that's already signed into the account.
2. If you have an Android phone or Chromebook still signed into the account, Google can send an approval prompt to that device — click "Yes, it's me" to verify.
3. If none of those work, click "Try another way" until you reach the option to submit a recovery form. Fill it out as completely as possible — the more account history you can provide (creation date, previous passwords, contacts you've emailed), the higher the success rate.

Account Was Compromised — Someone Changed Your Info

If you're getting "the email address or password is incorrect" but you're certain you're entering it right, someone may have changed your password.

1. Go to accounts.google.com/signin/recovery and use your recovery email or phone — these can still work even if your password was changed by someone else, as long as the attacker didn't also change your recovery info.
2. If recovery info was also changed: use Google's support form at support.google.com/accounts/troubleshooter/2402620 — this is the compromised account path with higher human review priority.
3. Act within 7 days of suspected compromise — after that, Google's recovery success rate drops significantly as account activity patterns age.

Step 4: Re-Secure Your Account After Recovery

Once you're back in, do these immediately — in this order:

1. Change your password — go to myaccount.google.com → Security → Password. Use a unique password not used on any other site.
2. Review active sessions — go to myaccount.google.com → Security → Your Devices. Click "Don't recognize a device?" for anything unfamiliar and sign it out.
3. Check third-party app access — go to myaccount.google.com → Security → Third-party apps with account access. Revoke anything you don't recognize.
4. Enable 2-Step Verification — go to myaccount.google.com → Security → 2-Step Verification. Use an authenticator app (Google Authenticator or Authy), not SMS — SMS codes can be intercepted via SIM-swapping.
5. Update recovery info — go to myaccount.google.com → Security → Ways we can verify it's you. Add a recovery phone and email you currently have access to.

If Your Account Was Disabled for Policy Violations

A disabled account is different from a locked account. "This account has been disabled" means Google suspended it for Terms of Service reasons.

• Submit an appeal at support.google.com/accounts/troubleshooter/2402620 — select "I believe my account was disabled by mistake."
• Appeals are reviewed by humans and typically take 3–5 business days.
• If the appeal is denied, your Google account data is retained for 20 days before deletion. Use this window to request a data export via takeout.google.com if you need to recover emails, Drive files, or photos.

Prevent Future Lockouts

• Use a password manager — most lockouts happen because people forget passwords or reuse one that was breached elsewhere.
• Keep recovery info current — phone numbers and email addresses change. Update your recovery info annually at myaccount.google.com.
• Add a passkey — Google's passkey option (myaccount.google.com → Security → Passkeys) lets you sign in with Face ID or fingerprint, bypassing password lockout risk entirely on supported devices.

Bottom Line

The recovery flow at accounts.google.com/signin/recovery handles 80% of lockouts if you use a familiar device and have access to your recovery phone or email. If recovery info was changed by an attacker, the compromised account form gets higher-priority human review than standard support. Either way, act fast — account recovery gets harder the longer you wait.

Stuck at a specific step in the recovery flow? Leave a comment with where it stopped and what error you're seeing.