How to Secure Your Gmail and Google Account in 2026

Secure your Gmail first, because it controls the reset link for almost every other account you own, including PayPal and your crypto exchange. The five steps below take about 20 minutes and come from Google's own help pages. Checked 9 November 2026.

Why your email is the real target

Hackers rarely attack PayPal directly. They take over your email, click "forgot password" on your other accounts and read the reset links. That is why the Binance attackers started with people, not code: see what we know about the Binance hack. If you earn online, as we explain in our Loggy3 payout story, your Gmail is where the money emails land.

Step 1: Run Google's Security Checkup

Open Security Checkup while signed in. Google's account security guide says it gives personal recommendations, and a green shield means no action is needed. A yellow or red mark means fix it now.

Step 2: Add a passkey

A passkey lets you sign in with your fingerprint, face or phone screen lock. Google says passkeys cannot be shared, copied or written down, which makes them stronger against phishing than passwords. Follow Google's page on setting up passkeys.

Step 3: Turn on 2-Step Verification, and pick the stronger kind

Google advises avoiding text message codes where you can, because of common phishing tricks. Its order of strength is security keys first, then Google prompts on your phone, then SMS. In Kenya there is another reason to avoid SMS: criminals have used SIM swaps to take over numbers, and Safaricom lists SIM swap fraud among the scams to watch. If your SIM suddenly loses signal for no reason, treat it as urgent.

Step 4: Check recovery options and linked apps

Your recovery phone and recovery email are how you get back in, and how Google alerts you to suspicious activity. Make sure both are current and that you still control them. Then open Google's list of apps with access to your account and remove anything you do not recognise or no longer use. Be strict with browser extensions too: install only what you need.

Step 5: Do not give your password to anyone

Google says it never asks for your password in an email, message or phone call. Do not click links in unexpected messages, and in Gmail on a computer, hover over a link to see the real address before you click. Fake recruiters, fake payout emails and fake M-PESA messages all use this trick. Our scam check page can help you test a message. If something already looks wrong, follow Google's steps to secure a hacked account.

Also use a different password for every account, with a password manager if you can. Google's Password Checkup shows saved passwords that are weak, reused or exposed.

Do you need Advanced Protection?

Google's Advanced Protection Program is for people at higher risk, such as journalists and activists. It uses security keys and adds stricter rules, so you can lock yourself out if you lose the keys. Most readers are better off with a passkey and 2-Step Verification. If you manage large sums of money from one account, consider it.

Before you start (honest limits)

No setting makes an account unhackable. Google's pages change, so menu names may differ on your phone. Do not buy "account security" services from strangers, and never share a verification code, even with someone who says they are from Google.

The short version

Run the Security Checkup, add a passkey, turn on 2-Step Verification with prompts or a key instead of SMS, update your recovery details and remove apps you do not use. Do it today, before you move any money.

Frequently asked questions

How do I secure my Gmail account? Run Google's Security Checkup, add a passkey, turn on 2-Step Verification, update your recovery phone and email, and remove apps you no longer use. The five steps take about 20 minutes and come from Google's own help pages.

Is a passkey safer than a password? Google says passkeys cannot be shared, copied or written down, which makes them stronger against phishing than passwords. A passkey lets you sign in with your fingerprint, face or phone screen lock.

Should I use SMS codes for 2-Step Verification? Google advises avoiding text message codes where you can, and ranks security keys first, then Google prompts on your phone, then SMS. In Kenya there is another reason: criminals have used SIM swaps to take over numbers, so treat a SIM that suddenly loses signal as urgent.

Does Google ever ask for my password? Google says it never asks for your password in an email, message or phone call. Never share a verification code, even with someone who says they are from Google.

Do I need Google Advanced Protection? It is meant for people at higher risk, such as journalists and activists, and it uses security keys, so you can lock yourself out if you lose them. Most readers are better off with a passkey and 2-Step Verification. If you manage large sums of money from one account, consider it.