4 ms·

Hey guys thanks so much for your response. I do believe 2 step was going but the hacker changed the details to his, wiped my phone and with it, my Google authen

Hey guys thanks so much for your response. I do believe 2 step was going but the hacker changed the details to his, wiped my phone and with it, my Google authenticator and presumably set it up on his phone! I'm completely locked from making any changes yet I can still see my emails and stuff but I can't change anything or verify myself. I did use the authenticator app plenty of times so I'm certain I had it set up. Although I'm starting to doubt myself now.... It's a nightmare!

mdoms 5y ago
You're not making sense. You need to slow down, calm down and write clearly and with more detail. Doubly so when communicating with Google Support staff.
- ohashi 5y ago
  She believes she had 2 factor because she used the app on her phone and would enter in codes. But her phone was remotely wiped (presumably by the attacker) and lost access to the authenticator. She can't verify that way anymore because the attacker took that tool away from her. She is still logged into her account on the laptop, so she can see things, but can't make any changes (they require a password she no longer has since the attacker changed it). We saw what the attacker changed the recovery info to their email / phone as well. So recovery options aren't working. She is trying to pass their email/phone along to some form of law enforcement.
  - skeeter2020 5y ago
    >> She is still logged into her account on the laptop, so she can see things, but can't make any changes This doesn't make sense; the attacker changed all of her account information but didn't click "log out of all other locations"?
    - vageli 5y ago
      Bad actors make mistakes, too.
- lululouise 5y ago
  Sorry, I was in a panic , I have updated my situation in the comments , thank you
Nextgrid 5y ago
If you still have any devices that have your old data (cached, etc) it might be worth keeping them powered on but disconnected from the internet, so that they don't end up realizing they should no longer have access and delete what could be the last copy of your data that you can actually access. Whatever you still have access to (again, from cache, existing browser that's still logged in, etc), start making backups - screenshots, etc.
- lululouise 5y ago
  I've backed up all my important things and emptied the account too, unfortunately it's probably too late as he may have downloaded all anyway as he used the Google takeout to get backup data. I'm not in that account at all now, after I backed up and emptied it, I factory reset my computer.
easrng 5y ago
Try to use https://takeout.google.com/ https://takeout.google.com/ to back up your account data.
- ohashi 5y ago
  We tried this, needed to validate your identity to get it. The hacker started it though, presumably to get all the data.
vero2 5y ago
> I did use the authenticator app plenty of times so I'm certain I had it set up. Then it would be been impossible to login. Did you use a password that was leaked? If yes - may be they logged in - and you would have got a 'notification' on your phone to allow them. And you perhaps said yes to that remote login.

mdoms 5y ago

You're not making sense. You need to slow down, calm down and write clearly and with more detail. Doubly so when communicating with Google Support staff.

ohashi 5y ago
She believes she had 2 factor because she used the app on her phone and would enter in codes. But her phone was remotely wiped (presumably by the attacker) and lost access to the authenticator. She can't verify that way anymore because the attacker took that tool away from her. She is still logged into her account on the laptop, so she can see things, but can't make any changes (they require a password she no longer has since the attacker changed it). We saw what the attacker changed the recovery info to their email / phone as well. So recovery options aren't working. She is trying to pass their email/phone along to some form of law enforcement.
- skeeter2020 5y ago
  >> She is still logged into her account on the laptop, so she can see things, but can't make any changes This doesn't make sense; the attacker changed all of her account information but didn't click "log out of all other locations"?
  - vageli 5y ago
    Bad actors make mistakes, too.
lululouise 5y ago
Sorry, I was in a panic , I have updated my situation in the comments , thank you

Nextgrid 5y ago

If you still have any devices that have your old data (cached, etc) it might be worth keeping them powered on but disconnected from the internet, so that they don't end up realizing they should no longer have access and delete what could be the last copy of your data that you can actually access. Whatever you still have access to (again, from cache, existing browser that's still logged in, etc), start making backups - screenshots, etc.

lululouise 5y ago
I've backed up all my important things and emptied the account too, unfortunately it's probably too late as he may have downloaded all anyway as he used the Google takeout to get backup data. I'm not in that account at all now, after I backed up and emptied it, I factory reset my computer.

easrng 5y ago

Try to use https://takeout.google.com/ https://takeout.google.com/ to back up your account data.

ohashi 5y ago
We tried this, needed to validate your identity to get it. The hacker started it though, presumably to get all the data.

vero2 5y ago

> I did use the authenticator app plenty of times so I'm certain I had it set up. Then it would be been impossible to login. Did you use a password that was leaked? If yes - may be they logged in - and you would have got a 'notification' on your phone to allow them. And you perhaps said yes to that remote login.