Gmail Account Recovery and Security

This article will help guide one through the process of recovering a lost Google Gmail account and, if needed, securing the account so that is it less likely to be compromised again.

Table Of Contents
  1. Account Recovery Walk-Through
    • Lost Password Recovery
    • Lost Account Name
    • Accounts With 2-Step Verification Enabled
    • Workspace accounts
  2. Additional Recovery Hints and Tips
  3. Other Account Recovery Cases
  4. FAQ About Account Recovery
  5. Securing Your Account
  6. Protecting Your Account Contents
Last updated:  Oct. 2021

Account Recovery Walk-Through

Over the last few years, Google's account recovery process has become more dynamic. This means that instead of Google asking a fixed set of questions, both the questions asked and the form the questions take can vary. In addition, Google regularly adds, removes, or modifies the available options. This means the recovery options can vary over time, between accounts or even between recovery attempts. If you have used account recovery in the past, it will probably appear very different now.

Additional sources of information include the Accounts Help Center and the Accounts Help Forum, both of which support searching for topics of interest.

Let's Be Realistic

Account recovery is designed and works best for the loss of one thing, like the current password. It relies on responsible users keeping accounts secure and recovery options up-to-date so they are easily able to do a verification if required, or prove ownership of a lost account. The more things that are missing (recovery phone, recovery e-mail, past password) the harder it is to prove ownership. If enough items are missing, don’t work, or have been changed, it becomes impossible to prove ownership and the account is lost.
If you don't have a working recovery e-mail or phone configured, then you probably can't prove ownership and recover the account.

If the account was compromised and the recovery options changed, then you probably can't prove ownership and recover the account. Fortunately, if it's been less than a week, Google may still use the previously configured recover phone number for verification.

If it's been more than a few months since you last signed into the account, then you won't have a recently used device/location/IP-address, which will greatly reduce your ability to prove ownership.
Obviously, the above does not imply that account recovery is usually impossible. The intent is to set realistic expectations about how easy account recovery may be based on what information one has available to prove ownership of an account.  Clearly, not all lost accounts are recoverable.

Lost Password Recovery

The recover process can be started in either of two ways:
Once you have supplied your e-mail address, you will move into the account recovery process.  In the past this was sometimes called the "account recovery form" (ARF) although there is no longer an actual form to fill out.


You will then be presented with a number of step to try and prove ownership of the account.  The options available are dictated by what recovery options were previously configured on the account.  For example, if no recovery e-mail address was configured, that option will not be shown.  If options were configured but not kept up-to-date, they will be shown but may be useless for recovery.  In the case of a compromised account, the options may be shown, but if they were modified by the hacker they will be useless for recovery.

If the lost account has 2-step verification enabled (https://gmail.googleblog.com/2011/02/advanced-sign-in-security-for-your.html) the process will be a little different as discussed below.  This will also be true if the account was compromised and the hacker enabled 2-step verification to make it harder to recover the account.

Known Device - It can't be emphasized enough how important it is to attempt account recover from a known device. A know device would be a computer or mobile device recently used to sign into the account.  For recently, think weeks or perhaps a few months. Longer than that and it will have been "forgotten" (no longer recognized).


Previous Password - The recovery process will often ask for the current or a recent password used on the account. This makes more sense for account recovery cases not due to a lost password. Knowing a password helps, but it probably not sufficient to prove ownership all by itself.


Mobile Device - Account recovery places a high priority on using a mobile device if one is attached to the account. It is considered reasonably secure as it's something physical owned by the user. Mobile verification can take several forms like a tap prompt on the device, or receiving a code on the device that you need to type in.

Of course, if the device is lost/stolen/broken/upgraded it can't be used for verification. It's therefore important to make sure the list of devices used on the account is kept current. In Google account settings, see the Security tab, Your Devices.



Phone Recovery - If a phone number was previously configured on the account, it it very useful to help prove account ownership. It can be used in a variety of ways, for example...
  • Entering the full phone number.
  • Receiving text message with a verification code.
  • Receiving a voice call with a verification code.
Clearly, one has to keep the configure phone up-to-date over time so that if you need it, it actually works.

It should also be noted that if the configured recovery number is changed, Google will retain (remember) the previous number for about a week. This can help a user prove ownership of an account even after it's been compromised and the recovery options changed.  See the “Important” note near the top of:  https://support.google.com/accounts/answer/3463280


E-mail Recovery - Like a phone number, having a recovery e-mail address configured on the account is important. It's pretty straightforward where a verification code is e-mailed to the address which you then enter.

In some limited cases the system may send an e-mail verification to the actual lost account. In these case, Google appears to believe you still have access to the account (are still signed into it) on some computer or device.


Security Question - If your account is old enough, and you added one, you may get asked your pre-configured security question. While knowing the answer you set is helpful, it's not enough to prove ownership all by itself.  If you have 2-step verification enabled on the account, the process does not appear to ever use the security question.

Support for a security question was dropped some years ago.  They can no longer be added to accounts, or edited, only deleted.


Contact E-mail - In some cases the process will ask for a contact e-mail address which it will send a verification code to. Receiving this code does not mean you will be allowed to reset the password.  This step is to verify that you have a valid, working e-mail account that you can access. Google may use this contact address to inform you of the results of your account recovery attempt.


Successful Recovery - If you are able to answer enough question to prove ownership, then Google will have you create a new password for the account. This may happen directly at the conclusion of the above process, or you may receive a link in an e-mail. Either way, once you create a new password you will be able to sign into the account.

Create a new, strong password that you don't use for other websites

Failed Recovery - If you are not able to answer enough question to prove ownership of the account, Google will not return it. You might be told directly at the end of the above process.  Or you might receive an e-mail at your recovery or contact e-mail address.  You are free to try again, and it might even suggest you do, but if you can't answer more of the questions the next time, do not expect a different result.


Lost Account Name

If you clicked the "Find my account" link on the first page you will be directed to a series of steps that will generate a list of accounts matching the information you provide. The steps are:
  1. Provide a previously configured e-mail or phone number.
  2. Provide the first and last name on the account.
  3. Enter a verification code sent to the e-mail/phone from step #1.
If you are successful, you will the receive a list of accounts that match, and you can proceed to sign in. If you also don't know the account password, you will use the above process to attempt to recover it.

 

Accounts With 2-Step Verification Enabled

Two-step verification adds an extra level of protection to accounts by requiring a second action or code in addition to the password to sign into an account.  As such, recovery for an account with 2-step verification enabled is a bit more strict.  This can work against the owner if the account has been compromised and 2-step enabled by the hacker.

When 2-step verification is enabled you will see a third screen after providing your account name and password were you need to provide the 2-step verification code via the default method you have configured on the account.  If you are unable to provide the 2-step response, the page has a "Try another way" link. At this point you may see one or more of a variety of options:
  • A list of other 2-step verification options like the use of backup codes.
  • A list of other standard account recovery options.
  • The standard account recovery process as described above.
  • An option to provide a contact address to be contacted after a multi-day delay.


If insufficient proof of ownership was provided the "Google couldn't verify.." message will be displayed similar to the standard recover process above.  If sufficient information was provided for Google to investigate further a message to that effect will be displayed.

When Google concludes it's investigation, which can take 3-5 business days (a week real-time), you will be notified at the contact address you provided. For information on the delay see:  https://support.google.com/accounts/answer/9412469

If your request is denied the only option is to repeat the process providing more answers to the questions, or more accurate answers than provided previously.  Simply repeating the process with the same answers will not help.  You must provide more proof of ownership or Google will not return the account.

Workspace accounts

Workspace (formerly G Suite or Google Apps) accounts are those not ending in @gmail.com. You may be given the option of using the standard account recovery procedure. Otherwise, one must contact the Workspace administrator for the domain who can reset the password allowing you to regain access.






Additional Recovery Hints and Tips

This section contains information and hints that can greatly improve your chances for a successful account recovery.  This section is long and doesn't have any pictures, but it's probably a good idea to read it very carefully.

The account recovery process is composed of a set of factors that Google uses to determine the legitimate owner of an account.  Some you have limited control over, and some you do not.  But understanding them is important to getting through the process successfully.

Factors you can control before the account is lost - presumably you're reading this article because you've already lost access to an account, so it's a little late for these items.  Still, keeping these in mind for the recovered account and any other accounts you have may prevent you from needing to visit this article again in the future.
Account password - write it down and keep it someplace safe.  Everyone thinks they'll remember their password, but many are wrong.  If you keep records of your password a lost account is easily fixed by just looking it up.

 Recovery options - configure the options available (e-mail and phone) for all your accounts.  And most importantly, keep them up-to-date.  https://support.google.com/accounts/answer/183723

 Backup codes -  If you have 2-step verification enabled on the account, make sure you generate a set of ten backup codes and save them someplace safe. And take note: "safe" is not on the mobile device you use for 2-step verification because if the device is lost/stolen/broken/reset you lose the 2SV device and the backup codes.
Factors you can control during account recovery - details about the questions asked and how to answer them.
Past password - this should be the most recent password you can accurately remember for the account.  Google does not store a readable version of passwords, so any password you provide must be 100% correct or when encrypted it won't match any entries in the account's password history.

 Security question - security questions are no longer supported meaning you can not add or modify them (only delete).  But if you do happen to have one on the account you may have the chance to answer it.  Assume the answer must be accurate (not just close).

Known access type - Google has made it clear that doing account recovery in the same way the account was normally accessed will help a lot with recovery.  Google hasn't clearly documented what all they use, but empirical evidence suggests it's some or all of the following:
  • Browser (perhaps related to saved cookies).
  • The physical computer or mobile device.  If you use an e-mail app/client, then use a browser on that same physical device to attempt recovery.
  • Physical location.  If you always accessed the account from a specific location (home, work, etc) then do recovery from that same physical location.
  • IP address.  Similar to the physical location, although clearly IP addresses can and do change regularly.
If the account was used regularly on multiple devices, try the account recovery process from each of them.

Describe your issue (or a similar field) - Occasionally you will get the option to provide more information to help prove ownership of the account. It is a free-format field of limited length where you can list items that Google can verify. But there are some definite rules about what will and won't help prove ownership based on what Google can and can't use.
  • What to include
    • If you still have access to the account, and what type of access it is (mobile, browser, etc).
    • Why you lost access to the account:
      • Compromised account
      • Lost password
      • 2-step verification lockout due to lost authenticator or phone, and no backup codes
      • "Unrecognized device" challenge
      • "Something unusual" challenge
      • Other security challenge (secret question, phone verification) that doesn’t work
    • More past passwords you remember.
    • Account creation date if that was never asked for during the recovery process.
    • Last time you successfully logged into the account.
    • Devices (computers or mobile) used with the account
    • Locations used to access the account, like country and city.
  • What not to include
    • Anything that requires account access to verify. For privacy Google employees do not have access to user account contents.
    • Anything related to linkage or usage of your e-mail on other accounts/sites you own (like Facebook, PayPal, etc).
    • Anything that might prove your personal identification, like government ID. Proving who you are does not prove you own a specific account.
Remember, only information that Google is able to verify based on account access history and server logs will help.


Factors you can NOT control - Google has a lot of information on the e-mail servers about accounts that can be used to help validate an ownership claim on a account.  Google doesn't document any of this but it's possible to guess what some of them probably are.
  • Locations where the account has been accessed in the past.
  • Devices, computers, browsers, clients, and apps used to access the account.
  • They types of account access used including:  web, IMAP, POP3, mobile, etc.
  • The history of account recovery claims made on the account, when and where they were made, what computer/device/location/browser they were made from.  This includes if someone else is also trying to recover the same account.
  • Current access types and usage of the account (if it was compromised and being used by a hacker).
  • And no doubt many more.
The point is that Google knows a lot more about the account than you may realize, and they use that information when an account recovery request is made.

Logistical issues with account recovery - there are a number of other things to keep in mind when doing account recovery
  • It’s not about the number of times you repeat the account recovery process, it’s about providing more and better answers with each attempt. If your submission is rejected, you must work hard to provide more answers, and make the answers more accurate in subsequent submissions. There is no point in repeating the process if you don't have anything new to add.
  • Wait for a response before each new submission. If you are told 1-3 hours, I'd suggest waiting until the next day.  If you are told 3-5 business days (which is a full week real time) give it an extra day or two.
  • If you are not receiving a response, check your Spam or Junk folder on the account you specified for replies. Also make sure you are checking the correct account, the one you verified with a code in the last step of the process.  If you provided multiple accounts during different attempts, check them all.
  • Duplicate submissions, or submissions without waiting for a reply can trigger a submission lock forcing you to wait a few days to try again.
  • Guessing at answers (like the creation date) are probably obvious to Google and can cause the process to stop asking that question.

There may be one other option for simple password recovery if your account wasn’t compromised and you simply forgot your password. If you have your browser setup to remember your account information you may be able to view your saved password. Both Firefox and Chrome allow saved passwords to be viewed in plain-text. If you use another browser that does not permit this, then you can use/install Firefox or Chrome, import your settings, and then check to see if the saved password is accessible. Again, this only works for people who forgot their password due to relying on the browser’s auto-fill function, but if it applies it might be an easier than the above procedures.

Finally, here is a Google help article on "Tips to complete account recovery steps":  https://support.google.com/accounts/answer/7299973

Other Account Recovery Cases

We will assume you went to https://mail.google.com/ and tried to log into your account. It didn’t work and you're unsure what to do next.  The following is a list of common situations or errors and what you should do for each.

Your password does not work - use the “Forgot password?” link on the sign-in page and then follow the instructions.  You may be able to use previously configured recovery options or answer questions about the account to prove ownership.

You do not remember the account name (e-mail address) - use the “Find my account” link on the sign-in page and then follow the instructions.

You are instructed to supply a mobile number to receive a SMS code - follow the instructions provided.  This could include mention of "suspicious activity" or there being "something different" about how you are signing in.

"Contact your domain admin for help" - this is a Workspace account (NOT @gmail.com) and you will need to contact your Workspace administrator for help with the account.  https://support.google.com/accounts/answer/181627

"Sorry, Google doesn't recognize that email" - the account does not exist.  It could be due to a spelling error in the e-mail address, or perhaps because the account was deleted.

“Temporary Error...” or "Oops..." or a similar message - see the following troubleshooter for more information:  https://support.google.com/mail/answer/140031

Any messages about being underage - this indicates the system believes you are too young to own a Gmail account (generally under 13).  See:  https://support.google.com/accounts/answer/1333913

Any message about your account being “Disabled” or “Suspended" - typically indicates some abuse, violation of the Terms of Service, or possibly a compromised account. Follow any instruction given or provided links when you try to sign in.  https://support.google.com/accounts/answer/40695

“Google doesn't provide another way to sign in to this account” - typically indicates the account has been disabled. Follow the process for a disabled account recovery  https://support.google.com/accounts/answer/40695

"This account was deleted and is no longer recoverable" - then the account is lost.  There is no way to recover it, and the account can not be re-created.

Some other error not listed above - use the following troubleshooter:  https://support.google.com/mail/troubleshooter/2943007


FAQ About Account Recovery

Q. Why can’t I tell someone private information about my account that they could look up to verify my claim?
A. Account privacy rules are very strict within Google, and allowing employees to look at the contents of an account would be a serious breach of privacy.  You may know enough about the contents of the account to prove ownership, but no one at Google can verify that information.

Q. Why isn’t there a comments section in account recovery where I could add additional information to prove my claim?
A. Like above, it would be a violation of account privacy for an employee to look in the account to verify any additional information supplied.

Q. Why can’t I simply talk to somebody about this?
A. Unfortunately, Google does not offer live support for the free Gmail product. You must use the recovery methods provided.  There is also the fact that even if you could talk to someone, you would still have to answer the same questions to prove ownership of the account.

Q. Why can’t Google lock the account to protect it from any more damage or outgoing spam.
A. Google may disable an account if they notice suspicious usage or if the account is being used to send out spam. But again, privacy concerns would prevent them from simply locking an account because someone claims it’s theirs and is compromised. In addition, since there is no live support, there is no one to even make such a request to.

Q. I had a really long password of random strings that would be impossible to guess. How was my account compromised?
A. Google (as most e-mail providers) have blocks to prevent trying lots of passwords to guess the correct one (brute-force attacks). Most accounts are compromised by harvesting passwords other ways. While a secure password is important, it’s only one in a long list of things needed to keep any online account secure.  This article has more information on this topic:  http://gmail-tips.blogspot.com/2012/01/how-not-to-get-hacked.html

Q. But I’m very careful with my password. I don’t give it to anyone except an official request from Gmail.
A. Unfortunately if you provided your password in response to any e-mail (even claiming to be from Google/Gmail) then your password was harvested by phishing. It’s very common, and can trick even the most careful people.

Q. I'm not getting any reply after submitting my account recovery information.
A. First, make sure you are using a valid, working contact e-mail address that you check regularly for any replies. Also, check the junk/spam label in case any reply was miss-filtered. Then try again. You might also try a different contact e-mail address.

Q. My contacts were deleted by the hacker, how do I recover them?
A. Deleted contacts can now be restored to any point in the last thirty-days: https://support.google.com/mail/answer/1069522

Q. My e-mail history was deleted by the hacker, how do I recover it?
A. Have you looked in All Mail and Trash for the missing information? Have you used Search to try and find it? Unfortunately, messages deleted from Trash or Spam can not be recovered. If you would like to request Google attempt to recovery messages deleted by a hacker, see: https://support.google.com/mail/troubleshooter/4530113

Q. My account was deleted by the hacker, can I recover it?
A. The account recovery process can sometimes restore a recently deleted account. That is your only option in this case.  But if you are told that "This account was deleted and is no longer recoverable" then the account is lost.

Q. I don’t care about the account, can I just get the e-mail history or the contacts from it.
A. Unfortunately, you have to be able to access the account in order to transfer any information out of it. This means you need to try and recover the account first.

Q. I don’t care about the contents, I just need the e-mail address back because I have other things linked to that address.
A. Account names are never re-used, so you can’t re-create the account. So to get the name back you will have to try and recover the account.

Q. Can I find out who did this? Can anyone prosecute them?
A. About the only information you have available is the list of the last 10 IPs to access your account (see the Details link below the Inbox). But given how easy it is to fake IPs, and how inaccurate they are, it’s unlikely that more than a general location can be determined. In general, law enforcement is not interested in a simple compromised account, and Google is not a law enforcement agency. Bottom line is: one’s energy is better spent on recovery and re-securing the account.

Q. Isn’t what the person did illegal? Can I sue them or get them arrested?
A. Any legal questions should be asked of local law enforcement or an attorney. Google is neither of those and can not advise you on any actions.

Q. Can I find out what they did in my account while they had access.
A. There are no account activity logs available, so you can’t find out for sure. If there is spam in your Sent Mail, they you know they used the account for that. But there’s no way to know if or what messages they may have looked at, so take appropriate precautions.

Q. How was my account compromised?
A. There are many ways passwords can be harvested and account compromised, but the most common ones include:
  • Using the same password on multiple web-sites. A less secure site is hacked and they get the user database (e-mail and password) and then just try them all. If the person did not use a unique password, the hacker gains access to the e-mail account.
  • Phishing e-mails that ask for account information or direct you to a phishing web-site. Don’t dismiss this because the messages are a lot more convincing that you would imagine, often using text copied from actual Google e-mails or on-line forms.
  • Use of a computer that is infected with a key-logger or other malware (most common for public computers like at a school or library) which records your login information.
For more information about how accounts can be compromised see the article: http://gmail-tips.blogspot.com/2012/01/how-not-to-get-hacked.html

Securing Your Account

When You Reclaim Your Account

The process of re-securing an account actually consists of two parts:  (1) securing your Google account that holds all the products and services you use, and (2) securing your Gmail account to make sure no settings have been altered.  Both parts must be completed or changes made by someone else may be missed allowing the account to be compromised or accessed again.

1.  Google has created an Account Security Checkup which will list a number of key Google account settings that need to be verified. Google will mark any that appear to be at-risk or suspicious for you to look at more carefully.
https://security.google.com/settings/security/secureaccount

2.  Google has also created a Gmail Security Checklist which performs a similar function specifically for Gmail.  Step 1 is the same Account Security Checkup as above.  Step 2 includes several specific areas to check.  The first, "Choose a strong password" you hopefully have already done. The second, "Check your Gmail settings" is critical to fully complete.
https://support.google.com/mail/checklist/2986618?rd=1

What follows are some of the more important setting to check in your Gmail account.  This is not a replacement for doing them both, but may be helpful to address the most critical items quickly allowing you to perform the above two checks at a later time (just don't forget). These are organized by the type of threat they represent. 

To access the Gmail settings page, click the Settings gear (or cog) icon in the upper/right to access the "Quick settings" panel, and the click on "See all settings".
Potential Spam
Settings that could result in spam being attached to outgoing e-mail.
  • Settings -> General -> Signature
    Make sure nothing as been added to your signature. Be sure to scroll down in case any additions aren't visible.

  • Settings -> General -> Vacation Responder (or Out Of Office Reply)
    Make sure it's disabled and empty.
E-mail Theft
Settings that could result in the theft of e-mail (perhaps without any indication that it is happening).
  • Settings -> Forwarding and POP/IMAP -> POP Download
    It is best to disable it unless there is a clear need for it.

  • Settings -> Forwarding and POP/IMAP -> IMAP Access
    It is best to disable it unless there is a clear need for it.

  • Settings -> Forwarding and POP/IMAP -> Forwarding
    Forwarding should be disabled or verified that the forwarding addresses are correct.

  • Settings -> Filters and Blocked Addresses
    Make sure no filters have been added, and that no existing filters have been modified to forward or delete e-mail.

  • Settings -> Accounts and Import -> Send mail as
    Make sure it is using your correct e-mail address, and delete any unrecognized entries.  Also click the "edit info" link on the right and verify each entry you have (including the default one) do not have a reply-to address set to an account you do not own.
External Access
Settings that could allow outside access to the account.
  • Settings -> Accounts and Import -> Grant access to your account
    Make sure that no delegated access has been configured to an unknown account.

And don't forget the Gmail Security Checklist and Account Security Checkup mentioned above.

Additional Information


Protecting Your Account Contents

Even when a compromised account is recovered sometimes the hacker has deleted the e-mail history and/or the contacts. Unless you have backed up that information to your local computer, it may well be lost forever.

There are several ways to backup a Gmail account and a number of tools to help you. Perhaps the most appropriate for Gmail the free utility https://github.com/jay0lee/got-your-back/wiki (Got Your Back or GYB) which supports backup and restore of both Gmail and Google Apps account with full support for labels and the ability to be run as an automated scheduled task. It stores the files on your local computer so they can be include in your normal computer backup.

The following article provides a lot more detail about doing backups and other tools that are available: http://gmail-tips.blogspot.com/2012/01/gmail-backup.html

* Gmail is a trademark of Google, Inc. This page is not sponsored by or affiliated with Google.





Posted by
Labels:
Subscribe to: Posts (Atom)