Skip to content
LatchkeyDaily
Subscribe

Lockdown guide · about 10 minutes

Lock down your Gmail account

By The Latchkey Daily Team, EditorsPublished Updated Verified January 15, 2027

What's at risk: Your email is the master key. Anyone inside it can reset the password on your bank, your Amazon and everything else.

Verified against Gmail web and app, January 2027.

You'll need: a password manager, your phone.

One account a day

The Deadbolt series runs in the daily brief. Get the next guide tomorrow morning.

Free. Weekday mornings. Includes free access to In Case and Serum, the Latchkey tools. Unsubscribe in one click.

Step by step

  1. Open your Google Account security page. Go to myaccount.google.com and choose Security in the left menu. Everything below lives on this page.
  2. Change the password. Under "How you sign in to Google," choose Password. Make the new one a long phrase (four or more unrelated words) and save it in your password manager. Do not reuse it anywhere.
  3. Turn on 2-Step Verification. Still under "How you sign in," choose 2-Step Verification and turn it on. Add a passkey (face or fingerprint on your phone) or the Google Authenticator app. Text-message codes are the fallback, not the first choice, because they can be intercepted by a SIM swap.
  4. Save the backup codes. On the 2-Step Verification page, generate backup codes and store them in your password manager's secure notes. They get you in if you lose your phone.
  5. Fix recovery options. Under "How you sign in," check the recovery phone and recovery email. Remove any you do not recognize and add ones you control. A scammer who set a recovery email can reset your password at will.
  6. Review your devices. Under "Your devices," look at every signed-in device. Sign out of anything you do not recognize or no longer use.
  7. Check forwarding and filters. Open Gmail, click the gear, See all settings, then Forwarding and POP/IMAP. Make sure nothing forwards your mail elsewhere. Then Filters and Blocked Addresses; delete any filter you did not create, especially ones that delete or archive messages from your bank.
  8. Review third-party access. Back on the Security page, under "Your connections to third-party apps and services," remove anything you do not use.

Email is where every other account sends its password reset. That is why scammers who get into Gmail do not read your mail; they reset your bank login, your Amazon, your Facebook, and set a forwarding rule so you never see the confirmations. The ten minutes above close every one of those doors.

Do this for a parent

  1. Do it with them, on their device, and write the new password in their notebook as well as the password manager.
  2. Add yourself as the recovery email so you can get them back in.
  3. Choose the passkey option; a face or fingerprint is easier for them than a code.
  4. Show them the one rule, out loud, twice. "Never read a code to anyone who calls."

The whole set, in one afternoon: the Family Setup Kit.

If you get locked out

  1. Go to g.co/recover and follow the prompts from a device and location you usually use; Google weighs that heavily.
  2. Use a backup code if you saved them.
  3. If a scammer changed the recovery options, keep working the recovery flow; it can take several attempts over several days.

Questions people ask

Is 2-Step Verification by text message good enough?
It is far better than nothing, and far worse than a passkey or authenticator app. SIM-swap attacks redirect your texts to a scammer's phone. Use text codes as the last resort, not the first.
What if I'm already locked out?
Go to g.co/recover on a device you normally use. The more familiar the device, network and location, the better the odds.

Related

  • Guide

    Lock down your Outlook or Microsoft account

    Your Microsoft account is your email, your OneDrive files and often your Windows login. It resets everything else.

  • Guide

    Lock down your iPhone

    Your phone is your bank, your email, your photos and your two-factor codes. A stolen passcode is a stolen life.

  • Guide

    Lock down your Android phone

    Your phone holds your bank, your email and your two-factor codes. A weak screen lock or a sideloaded app hands all of it over.

  • The scam this stops

    The bank fraud department scam

    The bank fraud department scam is a call or text that appears to come from your bank's fraud team, warning of a suspicious charge and then walking you through "securing" your money by reading them a code, moving funds to a "safe account," or sending yourself a Zelle payment that actually goes to the scammer.

  • The scam this stops

    The recovery scam

    The recovery scam targets people who were already scammed, with a call or message from a "lawyer," "recovery agency" or "government investigator" offering to get the lost money back for an upfront fee, which is itself the scam.