3 ms·

A "victim" would need to approve being used as a recovery account. (click link in mail etc.)

• aritmo 8y ago
  No. Ironically, this is opt-out, not opt-in. That is, you (as recovery email holder) would need click the link ONLY if you want to unlink. The URL is in the footer of the email and it is easy to miss.
  • whyagaindavid 8y ago
    No. It is opt-in. You need to type the 6 digit code from recovery email id into your settings.
    • dane-pgp 8y ago
      Having to actually type in a code sounds like a smart move on Google's part, to avoid spear-phishing and XSS attacks.
    • squeaky-clean 8y ago
      I just now added my personal email as a recovery to my work email to test this. It is opt-out. > Subject: "Someone added you as their recovery email" > Someone added <mypersonalemail>@gmail.com as their recovery email > <myworkemail>@<myworkdomain>.com wants your email address to be their recovery email. > If you don’t recognize this account, it’s likely your email address was added in error. You can remove your email address from that account. Disconnect email The "Disconnect email" at the end is an opt-out link.