6 ms·

Tell HN: Need help, locked out of Google account with 10 years of personal data

242 points by taosx 2y ago

I've been locked out of my Google account which contains over a decade of my digital life, and I'm at my wit's end trying to recover it. The situation: - Woke up today completely locked out - Got "secure your account" message - Set new password + recovery info but kept getting redirected to login - Received "unusual activity" warning (around the time I was asleep) - System asks for old phone number (lost in 2022) - Have tried recovery dozens of times through g.co/recover - Still have access to old recovery email but system never asks for it it What I've tried: - Using same devices and network as always (google pixel) - Multiple recovery attempts with both old/new phone numbers - Both old/new passwords (then never say which one they accept) - Following all official Google recovery guides I have so much of my life there: - Primary email communications - Password manager data - Business documents and projects - Personal documents - Google Drive contents - Contacts - OAuth access to numerous services - Years of irreplaceable data I've exhausted all official channels and online resources. The thought of permanently losing access to this account is terrifying. Has anyone successfully recovered their account in a similar situation? Any Google employees or security experts who might be able to help? This account represents my entire digital identity, and I'm desperate for any guidance or assistance.

passwordoops 2y ago
Upvoting as this usually proves the only effective way to get service. Try cross-posting to Reddit as well
- taosx 2y ago
  Thank you, will probably resort to that as well.
  - Loughla 2y ago
    Also do Twitter and whatever other socials you have. The only way to get them to help is public shame. It's sad, but we don't make the rules, we just play by them.
    - taosx 2y ago
      I'm not on any socials. At this point I'm more ashamed of myself, I'm technical enough to build a homelab, I was just delaying the migration until I had something a bit more solid with k8s and ceph that I could share with a nice UI. Even a small job that would backup emails and data to S3 and a hdd once a day would have saved me all this embarrassment. Hopefully starting with 2025 will have something to share with HN that is more positive.
      - Loughla 2y ago
        No reason to be embarrassed. You put your faith in one of the largest companies that has ever existed. That is a logical thing to do.
        LargoLasskhyfv 2y ago
        It's not, considering the scale. The projected image of reliability and trustworthiness can't be than more of a facade, with only 'some' humans shepherding an endless army of 'zalgorithms on crack'. If any of their spasms is hitting YOU for whichever reason, you're usually out of luck if the expectation is normal, casual means of interaction/recovery. For me that began with the necessity of providing a SMS-capable mobile phone number for recovery, which I won't ever give them. They have alternative e-mails, fully verified, which were sufficient for opening that account. Depending on where you are, that behaviour could even considered illegal, because they are weasle-wording around that necessity in their TOS, letting you make an account without that in earlier times, then changing that somewhere in their TOS later, which you have to agree to, or else... But still just not explicitely stating that necessity when you're opening some account somewhere in googleverse right now, instead weasle-wording around in some of their fora, and censoring questions about that in there. No matter if in german, or english. While having my full 'Ladungsfähige Adresse' ( https://de.wikipedia.org/wiki/Ladungsf%C3%A4hige_Anschrift https://de.wikipedia.org/wiki/Ladungsf%C3%A4hige_Anschrift ) with POTS/Landline for other reasons. (Imagine endless stream of CENSORED cusswords here...) edit: If any of your services require a SMS-capable mobile-phone to operate, even if only for authentication/recovery, then F....... say so loud and clear, right from the start, for every service, any place, anywhere, any time! But that would be too obvious, innit?
solumos 2y ago
The same thing happened to me in 2016 — I gave up and started a new account.
- bitbasher 2y ago
  > I gave up and started a new account. Some people never learn?
  - eonmist 2y ago
    What would have been the lesson to learn in this case? What is a good solution? I solved it by completely moving away from Google and services where I'm offered little control over verification settings. I remember I found the related settings in Google too restrictive at the time, and they seem to change requirements over time, thus making it too unpredictable for me. The "verify on old phone" really scared me away.
    - bitbasher 2y ago
      Ultimately, the lesson learned was big tech isn't your ally nor is the data you lend to them yours. Act accordingly. If they decide you no longer deserve access to the data, they can and will cut you off. Personally, I pay for a service (email, data, password manager, etc). I also backup my data in multiple locations. It's a lot of work, but I don't really see an alternative at the moment.
catlikesshrimp 2y ago
First things first: (Parenthesis) From now on, if it is important, pay for it. At least a smaller email provider with real human support, but best is "buying" your own domain and hosting your email. Same goes for backups. And pass the info to your loved ones. Less importantly: Since you know exactly what phone# is requested, try to contact it. Approach it in a way that doesn't alarm the renter and blocks you. Meanwhile, contact a real human in "telephone company" (maybe said # is free) and explain the situation: you want/need to PAY to get the phone number assigned to you (My telecom offers that service) Human Is always the keyword
- taosx 2y ago
  Learnt my lesson, already working on taking measures for new data or hopefully the data from the account if I recover it. I already called the number, it seems it's not in use, called someone (he was selling "pretty" numbers online) to ask if it's possible to get it back and they said that there have been cases and it's currently in something they call "quarantine" and there may be complications as there are two operators involved, the original operator of the number and the one to which the number was ported to. I will follow up on Monday on that front. Thank you.
  - kstenerud 2y ago
    Once you've got it all sorted, get 2 yubikeys, use them to secure the account, and keep one on you and another in a safe place. You can just use the cheapest ones.
- whizzter 2y ago
  I gave up on keeping my main on my own domain a few years back since MS mailservers (both Azure and on-prem Exchanges) started rejecting as spam, spam drove us all to centralization and now that they're running amok we have no good recourse.
- A_D_E_P_T 2y ago
  > but best is "buying" your own domain and hosting your email I wish this were still the case. Sadly, if you buy a domain and host your own email, you're going to get stuck in spam filters all the damn time. Your email address will feel broken, sending messages into the void. The only email infrastructure services that are reasonably reliable belong to the likes of Google (Workspace), Microsoft (365), etc. Protonmail is reportedly okay, but my experience is that they still get spammed an awful lot.
wilderw 2y ago
You say you lost a phone number in 2022. Might some of the people you know, still have it in their contact lists?
- taosx 2y ago
  Sorry, I meant that I don't have it in my possession as I've moved out of the country and stopped paying for it, but I still know the number, the issue is that I can't get a message to it for 2FA.
  - rogerrogerr 2y ago
    Have you tried calling it and pleading your case with whomever owns it now?
    - taosx 2y ago
      I did, it's not currently allocated and it's in a "quarantine" list before some phone network operator allocates it.
  - EVa5I7bHFq9mnYK 2y ago
    I also moved out of country, but I kept paying $10/month for the phone number and $20/month for the mailing address, it's worth it.
voisin 2y ago
Not intending to shame OP, but in 2024 with stories like this occurring regularly, I am totally baffled why anyone still trusts Google with anything important. Make the switch! Run, don’t walk. Do it today. Google is the Scorpion in the parable of the frog and the scorpion - it cannot help its nature. https://en.m.wikipedia.org/wiki/The_Scorpion_and_the_Frog https://en.m.wikipedia.org/wiki/The_Scorpion_and_the_Frog
- loloquwowndueo 2y ago
  Which service do you recommend as alternative?
  - toomuchtodo 2y ago
    FastMail, Dropbox, Apple iCloud (Photos, Keychain, etc)
    - pluc 2y ago
      +1 for fastmail, it has built-in backup mechanisms.
    - FagNigKiller 2y ago
      [flagged]
    - politelemon 2y ago
      Would definitely not recommend ecosystems. They can and do lock you out and you have more to lose.
      - toomuchtodo 2y ago
        I’m able to get ahold of a human for support with all products I mentioned. I’m unable to get ahold of a human at Google ever for any of their consumer offerings. I see lots of HN threads begging for Google support, I see no HN threads begging for support from any of the companies I listed. You should always have backups, regardless of provider.
teddyh 2y ago
<https://xkcd.com/743/ https://xkcd.com/743/>
CityOfThrowaway 2y ago
YMMV but I've had similar loops during login that were resolved by trying to login in incognito mode. And if it works, then clear all your cookies / reboot / try again in the main browser. There's something broken in google's auth security system.
- taosx 2y ago
  Just tried, first screen: "Account disabled 'myemail@gmail.com', We noticed unusual activity in your Google Account and locked it to protect your information. Learn more" and a button "Try to restore". And now I got: "Too many failed attempts, Unavailable because of too many failed attempts. Try again in a few hours.". At least I got a new message.
  - CityOfThrowaway 2y ago
    Yeah... this is consistent with my experience. Try to keep calm and actually try again in a few hours. It sounds like you have 2FA enabled so an account takeover is very unlikely. It sounds like you haven't violated the TOS in some egregious way, so actual ban is unlikely. Most likely is there's some type of crazy cookie thing going on that is causing the auth system to vomit. It's shocking that this happens, but alas.
    - EasyMark 2y ago
      Also make sure you’re not on a VPN when trying any of this.
    - jeffbee 2y ago
      Seriously, just take the messages at face value. Better headline would have been "Google proactively protected my 10 years of private data after some villains tried to steal it".
- ravenstine 2y ago
  Same. I don't remember how I got out of it the last time, but I came to the conclusion that their login security is dysfunctional. I even had the right phone, authenticator codes, etc., and it kept asking me for something else that woulf lead to an authenticator code being asked for again, restarting the whole loop. Maybe it's more "secure", but the situation is strikingly similar to a hacker changing your passwords. So glad I switched to ProtonMail a long time ago and decentralize my data across different services. One's life should not be left in the hands of The Google.
eminent101 2y ago
I'm sorry this happened. This is my digital nightmare scenario! It is disturbing how much of our digital and physical life (utility accounts, medical insurance, etc. etc.) are tied to email addresses and these email addresses are something we can never ever truly own. If you are locked out of email, you are also locked out of at least half a dozen critical portals that send password resets, OTPs and all kinds of authentication fragments to your email address! Most email addresses are on somebody else's domain and they can lock you out anytime. Even if you manage to set up your domain name, you are still renting the domain name from someone. One missed payment or you somehow mess up the admin work of your domain name or you lose your domain name for any reason (yes, it happens!), nobody in the world can reach your email address! How did this happen? Weren't the old days of snailmail better? You could own a house or you could rent a house and get actual physical letters at your home. If you moved houses, you could have the new tenants of the old house forward mail to your new one until everything settled down. Email addresses seem like good secondary mode of communication but I find it disturbing that all around the world, email addresses have become the primary mode of communcation and sometimes the only mode of communication! Does anyone else feel extremely uncomfortable that so much of our critical digital and physical lives are tied to email addresses, things that we can never truly own and can be taken away from us anytime?
- Kuinox 2y ago
  While you dont own a domain name, you have legals means to get it back. Thats not the cast with a GAFAM email account.
  - eminent101 2y ago
    > While you dont own a domain name, you have legals means to get it back. Can you or someone else share more about this? Do these laws work across countries? Can someone in Bhutan exercise their legal right to get back their .com or .org domain name? Must someone in Bhutan always buy a .bt domain name? I'd like to learn more about how the legal framework works and protects the customer from loss of their domain names?
  - aphantastic 2y ago
pockmarked19 2y ago
> The thought of permanently losing access to this account is terrifying. Complete non-sequitur here, but that is one of the two inevitable things, according to Ben Franklin. Yes, I’m talking about death. So we should all make plans if there is actually worth anything preserving in posterity, plans that go beyond “just log in to my account” (which as OP shows is a huge PITA).
stevenicr 2y ago
nice reminder that I need to set a reminder to download a full backup of all things google takeout regularly. In a (maybe, maybe not) similar situation when a friend got a new phone, added sim card - then could not start the phone because google pass was not working.. (and he could not get 2fa of sms auth) I suggested he go home where is already logged into gmail - and update account settings to allow additional methods of account recovery - bam - fixed.
edent 2y ago
If you live in the EU, you can send a Subject Access Request to Google. That will get you back the contents of your account (emails, photos, etc). You can also try submitting a right to rectification. They hold data about you (your account) but have incorrect data regarding ownership. If either of those fails, you can escalate to the data protection authority in your jurisdiction. It is likely to take several weeks though.
- taosx 2y ago
  I do live in the EU, if the plan to get access to the phone number with the telecom operators on monday doesn't pan out I will try to do that. Honestly I don't mind waiting weeks to recover the contents of my account as long as I know that it's not lost forever. But all the FAQ and comments on the internet regarding similar scenarios have no good ending and people just giving up with no recourse. I knew about Subject Access Request but didn't cross my mind I could use it in my current scenario. Thank you!
zaidf 2y ago
Good luck. I lost access to my Facebook account of 18 years a few years ago due to some 2fa bug (it tells me to enter a code from the fb app which doesn’t have that code.) Despite sending copies of my passport, license etc, the automated systems are of no help.
xlaacid 2y ago
Moving forward: always have an email client on a local machine downloading a copy of all emails. Have a local copy of all gdrive contents. Backup your password mangers to a txt file and encrypt it on a drive. And above all, dont trust google with all your stuff. They dont care. I lost a gmail years ago and only use it as a throwaway email client now. You get what you pay for.
- anakaine 2y ago
  That's completely impractical for the average, and even above average user. Just because something can be a solution doesn't mean it should be.
  - beepbooptheory 2y ago
    We live in less than an ideal world though, we don't really get to dictate how practical the solutions to our problems are. It is in a way what makes a problem truly a problem. Otherwise, "problems" would all just be different ways of being ignorant of the better way.
  - tomcam 2y ago
    Agreed. What are the practical alternatives to GP’s suggestion?
- stemlord 2y ago
  At the very least the average person can simply download all of their google data every year or so to soften the blow considerably. something that's actually super easy to do. https://takeout.google.com/ https://takeout.google.com/
  - aagha 2y ago
    And then what? If you're the average person and have gigabits of email, what are you supposed to do then?
- anotheracc88 2y ago
  Google takeout. Do it every 3 months. Easy peasy.. Good for privacy too. It jas everything! Look through it an permanently delete what you don't want them to keeo. Note that it is slightly lossy with respect to headers, times etc. Not ideal for anything legal related. For those print them off.
cameldrv 2y ago
The solution to this is to find a Google employee that can vouch for you. There is an internal process to recover an account in this situation.
taosx 2y ago
This post seems to have been flagged but I want to thank everyone for their suggestions and future measures. The plan for now is: 1. Retry again with email/pass in incognito in a 24 hour interval; 2. Try to get the same phone number from the telecom operators; 3. Make Subject Access Request (EU) to Google in hopes of at least getting my data back. In order not to get caught up in the same thing again there are many good suggestions in the comments, all with some overhead/friction but 100% worth it if you ask me :D.
- taosx 2y ago
  Update: Recovery attempt via telecom operators failed - the number is stuck in limbo between two carriers. While this didn't work in my case, other European users may still recover their number by either: 1. Starting a new 2-year contract 2. Paying a one-time fee for a preferred number (~150 EUR in my case) Tip: Contact your local carrier to check if number recovery is possible, or if you can request a specific number for a new contract. Currently pursuing Plan B: Submitted a Data Access Request [1] to Google in hopes of getting my data back. [1]: https://support.google.com/policies/contact/sar https://support.google.com/policies/contact/sar
  - taosx 2y ago
    Finally, Google gave me access to my account by allowing me to use the new phone number they asked me to provide and not the one from 2022, exactly 8 days after the incident.
ppp999 2y ago
Happened to me once a few years ago but after trying many times with the correct and older requested passwords, it eventually worked for some unknown reason. I didn't have 2FA setup though...
IYasha 2y ago
Hey there, mate! Can't really do a thing, but I'm here for emotional support. You won't believe how many of us are here. :( In my case Google refused working secondary e-mail link, secret word, current password - all of those. Probably just because my IP address changed. And my gmail and YouTube channel are now lost forever with no explanation. (I had no mobile number attached to it)
- taosx 2y ago
  Appreciate the emotional support, I feel for you. You reminded me of my youtube music subscription with my massive playlist, I like to think of it as just currently unavailable, I lose hope slowly. https://i.ibb.co/QdsKthf/markup-1000014882.png https://i.ibb.co/QdsKthf/markup-1000014882.png
- GoblinSlayer 2y ago
  >(I had no mobile number attached to it) That's just heresy for Google.
peekaboopiper 2y ago
[flagged]
hyperbrainer 2y ago
Can you somehow obtain a new SIM with the same number?
- taosx 2y ago
  I may, remains to be seen, the main offices of the telecom don't work during the weekend.
romanhn 2y ago
Really sorry this happened to you! I don't really have an immediate solution for you, my own experience tells me you're unlikely to get the account unlocked any time soon. That said, my story did have a happy end eventually: https://news.ycombinator.com/item?id=36335975 https://news.ycombinator.com/item?id=36335975. There were other reports that 2 years might be a magical amount of time before they let you back in. Not consolation right now, I know, but maybe better than nothing.
friedtofu 2y ago
This happened to me back in ~2018 or so. I'm trying to think back to what happened and how it was resolved. The only way I've ever been able to get decent support from googles help center is by calling and escelating the issue and then eventually getting to the right person via the email chain started following the call. Its a pain in the ass I know. I *think* I ended up just having to get my phone replaced because it was the primary device that every other service relied on in the end for authentication(Google pixel & Google fi, Google TV, gmail, oauth, etc). Also look in your recovery email for an email that contains a list of backup/recovery codes. I'm pretty sure they don't email these codes anymore and your prompted to write them down/save them elsewhere but worth checking. Needless to say sibce then I do not use google for hardly anything other than the phone itself.
jpcom 2y ago
Why don't you just contact someone at Google? I would recommend starting an Advertising Campaign and not paying it. You will be surprised how quickly a support number with a real human being at the end appears.
- TowerTall 2y ago
  how do you do that if your are locked out of your account?
01jonny01 2y ago
Ok this is what you do. 1) Incognito mode in Firefox 2) Use the same IP as before, or a private proxy with the same country and city as before 3) Goto Bing and search for gmail 4) Attempt to login 5) If asked to enter your full recovery email address - opt for this option 5) If you are then prompted for pva code use a fresh SIM which has same country code as the one you are in. 6) This might work
readyplayernull 2y ago
Always remember to set a recovery email for your Google's account.
- drivebycomment 2y ago
  Recovery email is good but still not the most reliable way. My #1 recommendation is to setup a passkey, and also set multiple security keys as the 2nd factor. All other authentication factors are subject to some form of heuristic defense. Beyond that, a few optional things you can do in addition: - Use Advanced Protection. - Use a platform that's more secure , which are iOS, ChromeOS and some android (e.g. Pixel), in general and especially during recovery attempt.
Frederation 2y ago
Do what I did. Draft a formal complaint covering all of this. Document as well as possible, take it to get notarized, send registered mail to Google's legal arm. Worked for me but you have to prove as well as possible that its you. Good luck.
exabrial 2y ago
I dunno, call their tech support line? Oh wait… sv doesn’t do that.
deleted 2y ago
[deleted]
tonymet 2y ago
I was just helping someone with this. Attackers captured the account at night time his hours, and updated all of the recovery contacts to their own. The account recovery process is deliberately secretive to prevent attacking the protocol. Eventually you get escalated to a team that reviews your govt ID. have you hit that point yet? https://support.google.com/accounts/answer/6294825 https://support.google.com/accounts/answer/6294825?
tonymet 2y ago
For others in the thread: it's a good time to run Google Takeout (every 6 months) and copy your content to your own drive. Google Takeout now supports other clouds Review your security and recovery settings. Hackers are very aggressive right now. 1. third party apps 2. 2fa activation 3. family member settings 4. recovery email & phone contacts
tdeck 2y ago
I'm sorry, this is the Stripe support forum, not the Google support forum.
eonmist 2y ago
Exactly this is why I moved away from Google and never use it for anything important. When they started requiring verification from old phone it was too much. What if I lost it, it got stolen etc. Also have to account for them changing their verification requirements as they wish.
jpfdez 2y ago
Have tried recovery dozens of "times through g.co/recover"I don't quite understand your statement. The device can be lost, but you can always make a copy of the SIM cards. You may be referring to the fact that you gave or had your phone number cancelled.
anotheracc88 2y ago
Try a different network entirely. Maybe you have a bad neighbour on that IP address. Or you are fingerprinted for some other reason. If your phone has downloaded data, such as emails and contacts, back that phone up right away. At least that is something if not everything.
- taosx 2y ago
  Tried that, the loop remains the same and asks for the phone number and then asks for the code.
youngkingtz 2y ago
[flagged]
theLegionWithin 2y ago
> account represents my entire digital identity probably a mistake - not saying I havent done the same, I have and still do... however, I regularly back up my mailbox and data I cannot live without every 4 months to local storage & then copy the dataset to 2x physically separate media stored in different secure locations. currently using "Corsair survivor stealth" usb drives. short term fix? post on their social media feeds about it.
dgosling84 2y ago
This is my worst fear fr
btfo 2y ago
You did it to yourself by WILLINGLY and KNOWINGLY using proprietary software. You can only blame yourself.

242 points by taosx 2y ago

passwordoops 2y ago

Upvoting as this usually proves the only effective way to get service. Try cross-posting to Reddit as well

taosx 2y ago
Thank you, will probably resort to that as well.
- Loughla 2y ago
  Also do Twitter and whatever other socials you have. The only way to get them to help is public shame. It's sad, but we don't make the rules, we just play by them.
  - taosx 2y ago
    I'm not on any socials. At this point I'm more ashamed of myself, I'm technical enough to build a homelab, I was just delaying the migration until I had something a bit more solid with k8s and ceph that I could share with a nice UI. Even a small job that would backup emails and data to S3 and a hdd once a day would have saved me all this embarrassment. Hopefully starting with 2025 will have something to share with HN that is more positive.
    - Loughla 2y ago
      No reason to be embarrassed. You put your faith in one of the largest companies that has ever existed. That is a logical thing to do.
      - LargoLasskhyfv 2y ago
        It's not, considering the scale. The projected image of reliability and trustworthiness can't be than more of a facade, with only 'some' humans shepherding an endless army of 'zalgorithms on crack'. If any of their spasms is hitting YOU for whichever reason, you're usually out of luck if the expectation is normal, casual means of interaction/recovery. For me that began with the necessity of providing a SMS-capable mobile phone number for recovery, which I won't ever give them. They have alternative e-mails, fully verified, which were sufficient for opening that account. Depending on where you are, that behaviour could even considered illegal, because they are weasle-wording around that necessity in their TOS, letting you make an account without that in earlier times, then changing that somewhere in their TOS later, which you have to agree to, or else... But still just not explicitely stating that necessity when you're opening some account somewhere in googleverse right now, instead weasle-wording around in some of their fora, and censoring questions about that in there. No matter if in german, or english. While having my full 'Ladungsfähige Adresse' ( https://de.wikipedia.org/wiki/Ladungsf%C3%A4hige_Anschrift https://de.wikipedia.org/wiki/Ladungsf%C3%A4hige_Anschrift ) with POTS/Landline for other reasons. (Imagine endless stream of CENSORED cusswords here...) edit: If any of your services require a SMS-capable mobile-phone to operate, even if only for authentication/recovery, then F....... say so loud and clear, right from the start, for every service, any place, anywhere, any time! But that would be too obvious, innit?

solumos 2y ago

The same thing happened to me in 2016 — I gave up and started a new account.

bitbasher 2y ago
> I gave up and started a new account. Some people never learn?
- eonmist 2y ago
  What would have been the lesson to learn in this case? What is a good solution? I solved it by completely moving away from Google and services where I'm offered little control over verification settings. I remember I found the related settings in Google too restrictive at the time, and they seem to change requirements over time, thus making it too unpredictable for me. The "verify on old phone" really scared me away.
  - bitbasher 2y ago
    Ultimately, the lesson learned was big tech isn't your ally nor is the data you lend to them yours. Act accordingly. If they decide you no longer deserve access to the data, they can and will cut you off. Personally, I pay for a service (email, data, password manager, etc). I also backup my data in multiple locations. It's a lot of work, but I don't really see an alternative at the moment.

catlikesshrimp 2y ago

First things first: (Parenthesis) From now on, if it is important, pay for it. At least a smaller email provider with real human support, but best is "buying" your own domain and hosting your email. Same goes for backups. And pass the info to your loved ones. Less importantly: Since you know exactly what phone# is requested, try to contact it. Approach it in a way that doesn't alarm the renter and blocks you. Meanwhile, contact a real human in "telephone company" (maybe said # is free) and explain the situation: you want/need to PAY to get the phone number assigned to you (My telecom offers that service) Human Is always the keyword

taosx 2y ago
Learnt my lesson, already working on taking measures for new data or hopefully the data from the account if I recover it. I already called the number, it seems it's not in use, called someone (he was selling "pretty" numbers online) to ask if it's possible to get it back and they said that there have been cases and it's currently in something they call "quarantine" and there may be complications as there are two operators involved, the original operator of the number and the one to which the number was ported to. I will follow up on Monday on that front. Thank you.
- kstenerud 2y ago
  Once you've got it all sorted, get 2 yubikeys, use them to secure the account, and keep one on you and another in a safe place. You can just use the cheapest ones.
whizzter 2y ago
I gave up on keeping my main on my own domain a few years back since MS mailservers (both Azure and on-prem Exchanges) started rejecting as spam, spam drove us all to centralization and now that they're running amok we have no good recourse.
A_D_E_P_T 2y ago
> but best is "buying" your own domain and hosting your email I wish this were still the case. Sadly, if you buy a domain and host your own email, you're going to get stuck in spam filters all the damn time. Your email address will feel broken, sending messages into the void. The only email infrastructure services that are reasonably reliable belong to the likes of Google (Workspace), Microsoft (365), etc. Protonmail is reportedly okay, but my experience is that they still get spammed an awful lot.

wilderw 2y ago

You say you lost a phone number in 2022. Might some of the people you know, still have it in their contact lists?

taosx 2y ago
Sorry, I meant that I don't have it in my possession as I've moved out of the country and stopped paying for it, but I still know the number, the issue is that I can't get a message to it for 2FA.
- rogerrogerr 2y ago
  Have you tried calling it and pleading your case with whomever owns it now?
  - taosx 2y ago
    I did, it's not currently allocated and it's in a "quarantine" list before some phone network operator allocates it.
- EVa5I7bHFq9mnYK 2y ago
  I also moved out of country, but I kept paying $10/month for the phone number and $20/month for the mailing address, it's worth it.

voisin 2y ago

Not intending to shame OP, but in 2024 with stories like this occurring regularly, I am totally baffled why anyone still trusts Google with anything important. Make the switch! Run, don’t walk. Do it today. Google is the Scorpion in the parable of the frog and the scorpion - it cannot help its nature. https://en.m.wikipedia.org/wiki/The_Scorpion_and_the_Frog https://en.m.wikipedia.org/wiki/The_Scorpion_and_the_Frog

loloquwowndueo 2y ago
Which service do you recommend as alternative?
- toomuchtodo 2y ago
  FastMail, Dropbox, Apple iCloud (Photos, Keychain, etc)
  - pluc 2y ago
    +1 for fastmail, it has built-in backup mechanisms.
  - FagNigKiller 2y ago
    [flagged]
  - politelemon 2y ago
    Would definitely not recommend ecosystems. They can and do lock you out and you have more to lose.
    - toomuchtodo 2y ago
      I’m able to get ahold of a human for support with all products I mentioned. I’m unable to get ahold of a human at Google ever for any of their consumer offerings. I see lots of HN threads begging for Google support, I see no HN threads begging for support from any of the companies I listed. You should always have backups, regardless of provider.

teddyh 2y ago

<https://xkcd.com/743/ https://xkcd.com/743/>

CityOfThrowaway 2y ago

YMMV but I've had similar loops during login that were resolved by trying to login in incognito mode. And if it works, then clear all your cookies / reboot / try again in the main browser. There's something broken in google's auth security system.

taosx 2y ago
Just tried, first screen: "Account disabled 'myemail@gmail.com', We noticed unusual activity in your Google Account and locked it to protect your information. Learn more" and a button "Try to restore". And now I got: "Too many failed attempts, Unavailable because of too many failed attempts. Try again in a few hours.". At least I got a new message.
- CityOfThrowaway 2y ago
  Yeah... this is consistent with my experience. Try to keep calm and actually try again in a few hours. It sounds like you have 2FA enabled so an account takeover is very unlikely. It sounds like you haven't violated the TOS in some egregious way, so actual ban is unlikely. Most likely is there's some type of crazy cookie thing going on that is causing the auth system to vomit. It's shocking that this happens, but alas.
  - EasyMark 2y ago
    Also make sure you’re not on a VPN when trying any of this.
  - jeffbee 2y ago
    Seriously, just take the messages at face value. Better headline would have been "Google proactively protected my 10 years of private data after some villains tried to steal it".
ravenstine 2y ago
Same. I don't remember how I got out of it the last time, but I came to the conclusion that their login security is dysfunctional. I even had the right phone, authenticator codes, etc., and it kept asking me for something else that woulf lead to an authenticator code being asked for again, restarting the whole loop. Maybe it's more "secure", but the situation is strikingly similar to a hacker changing your passwords. So glad I switched to ProtonMail a long time ago and decentralize my data across different services. One's life should not be left in the hands of The Google.

eminent101 2y ago

I'm sorry this happened. This is my digital nightmare scenario! It is disturbing how much of our digital and physical life (utility accounts, medical insurance, etc. etc.) are tied to email addresses and these email addresses are something we can never ever truly own. If you are locked out of email, you are also locked out of at least half a dozen critical portals that send password resets, OTPs and all kinds of authentication fragments to your email address! Most email addresses are on somebody else's domain and they can lock you out anytime. Even if you manage to set up your domain name, you are still renting the domain name from someone. One missed payment or you somehow mess up the admin work of your domain name or you lose your domain name for any reason (yes, it happens!), nobody in the world can reach your email address! How did this happen? Weren't the old days of snailmail better? You could own a house or you could rent a house and get actual physical letters at your home. If you moved houses, you could have the new tenants of the old house forward mail to your new one until everything settled down. Email addresses seem like good secondary mode of communication but I find it disturbing that all around the world, email addresses have become the primary mode of communcation and sometimes the only mode of communication! Does anyone else feel extremely uncomfortable that so much of our critical digital and physical lives are tied to email addresses, things that we can never truly own and can be taken away from us anytime?

Kuinox 2y ago
While you dont own a domain name, you have legals means to get it back. Thats not the cast with a GAFAM email account.
- eminent101 2y ago
  > While you dont own a domain name, you have legals means to get it back. Can you or someone else share more about this? Do these laws work across countries? Can someone in Bhutan exercise their legal right to get back their .com or .org domain name? Must someone in Bhutan always buy a .bt domain name? I'd like to learn more about how the legal framework works and protects the customer from loss of their domain names?
- aphantastic 2y ago

pockmarked19 2y ago

> The thought of permanently losing access to this account is terrifying. Complete non-sequitur here, but that is one of the two inevitable things, according to Ben Franklin. Yes, I’m talking about death. So we should all make plans if there is actually worth anything preserving in posterity, plans that go beyond “just log in to my account” (which as OP shows is a huge PITA).

stevenicr 2y ago

nice reminder that I need to set a reminder to download a full backup of all things google takeout regularly. In a (maybe, maybe not) similar situation when a friend got a new phone, added sim card - then could not start the phone because google pass was not working.. (and he could not get 2fa of sms auth) I suggested he go home where is already logged into gmail - and update account settings to allow additional methods of account recovery - bam - fixed.

edent 2y ago

If you live in the EU, you can send a Subject Access Request to Google. That will get you back the contents of your account (emails, photos, etc). You can also try submitting a right to rectification. They hold data about you (your account) but have incorrect data regarding ownership. If either of those fails, you can escalate to the data protection authority in your jurisdiction. It is likely to take several weeks though.

taosx 2y ago
I do live in the EU, if the plan to get access to the phone number with the telecom operators on monday doesn't pan out I will try to do that. Honestly I don't mind waiting weeks to recover the contents of my account as long as I know that it's not lost forever. But all the FAQ and comments on the internet regarding similar scenarios have no good ending and people just giving up with no recourse. I knew about Subject Access Request but didn't cross my mind I could use it in my current scenario. Thank you!

zaidf 2y ago

Good luck. I lost access to my Facebook account of 18 years a few years ago due to some 2fa bug (it tells me to enter a code from the fb app which doesn’t have that code.) Despite sending copies of my passport, license etc, the automated systems are of no help.

xlaacid 2y ago

Moving forward: always have an email client on a local machine downloading a copy of all emails. Have a local copy of all gdrive contents. Backup your password mangers to a txt file and encrypt it on a drive. And above all, dont trust google with all your stuff. They dont care. I lost a gmail years ago and only use it as a throwaway email client now. You get what you pay for.

anakaine 2y ago
That's completely impractical for the average, and even above average user. Just because something can be a solution doesn't mean it should be.
- beepbooptheory 2y ago
  We live in less than an ideal world though, we don't really get to dictate how practical the solutions to our problems are. It is in a way what makes a problem truly a problem. Otherwise, "problems" would all just be different ways of being ignorant of the better way.
- tomcam 2y ago
  Agreed. What are the practical alternatives to GP’s suggestion?
stemlord 2y ago
At the very least the average person can simply download all of their google data every year or so to soften the blow considerably. something that's actually super easy to do. https://takeout.google.com/ https://takeout.google.com/
- aagha 2y ago
  And then what? If you're the average person and have gigabits of email, what are you supposed to do then?
anotheracc88 2y ago
Google takeout. Do it every 3 months. Easy peasy.. Good for privacy too. It jas everything! Look through it an permanently delete what you don't want them to keeo. Note that it is slightly lossy with respect to headers, times etc. Not ideal for anything legal related. For those print them off.

cameldrv 2y ago

The solution to this is to find a Google employee that can vouch for you. There is an internal process to recover an account in this situation.

taosx 2y ago

This post seems to have been flagged but I want to thank everyone for their suggestions and future measures. The plan for now is: 1. Retry again with email/pass in incognito in a 24 hour interval; 2. Try to get the same phone number from the telecom operators; 3. Make Subject Access Request (EU) to Google in hopes of at least getting my data back. In order not to get caught up in the same thing again there are many good suggestions in the comments, all with some overhead/friction but 100% worth it if you ask me :D.

taosx 2y ago
Update: Recovery attempt via telecom operators failed - the number is stuck in limbo between two carriers. While this didn't work in my case, other European users may still recover their number by either: 1. Starting a new 2-year contract 2. Paying a one-time fee for a preferred number (~150 EUR in my case) Tip: Contact your local carrier to check if number recovery is possible, or if you can request a specific number for a new contract. Currently pursuing Plan B: Submitted a Data Access Request [1] to Google in hopes of getting my data back. [1]: https://support.google.com/policies/contact/sar https://support.google.com/policies/contact/sar
- taosx 2y ago
  Finally, Google gave me access to my account by allowing me to use the new phone number they asked me to provide and not the one from 2022, exactly 8 days after the incident.

ppp999 2y ago

Happened to me once a few years ago but after trying many times with the correct and older requested passwords, it eventually worked for some unknown reason. I didn't have 2FA setup though...

IYasha 2y ago

Hey there, mate! Can't really do a thing, but I'm here for emotional support. You won't believe how many of us are here. :( In my case Google refused working secondary e-mail link, secret word, current password - all of those. Probably just because my IP address changed. And my gmail and YouTube channel are now lost forever with no explanation. (I had no mobile number attached to it)

taosx 2y ago
Appreciate the emotional support, I feel for you. You reminded me of my youtube music subscription with my massive playlist, I like to think of it as just currently unavailable, I lose hope slowly. https://i.ibb.co/QdsKthf/markup-1000014882.png https://i.ibb.co/QdsKthf/markup-1000014882.png
GoblinSlayer 2y ago
>(I had no mobile number attached to it) That's just heresy for Google.

peekaboopiper 2y ago

[flagged]

hyperbrainer 2y ago

Can you somehow obtain a new SIM with the same number?

taosx 2y ago
I may, remains to be seen, the main offices of the telecom don't work during the weekend.

romanhn 2y ago

Really sorry this happened to you! I don't really have an immediate solution for you, my own experience tells me you're unlikely to get the account unlocked any time soon. That said, my story did have a happy end eventually: https://news.ycombinator.com/item?id=36335975 https://news.ycombinator.com/item?id=36335975. There were other reports that 2 years might be a magical amount of time before they let you back in. Not consolation right now, I know, but maybe better than nothing.

friedtofu 2y ago

This happened to me back in ~2018 or so. I'm trying to think back to what happened and how it was resolved. The only way I've ever been able to get decent support from googles help center is by calling and escelating the issue and then eventually getting to the right person via the email chain started following the call. Its a pain in the ass I know. I *think* I ended up just having to get my phone replaced because it was the primary device that every other service relied on in the end for authentication(Google pixel & Google fi, Google TV, gmail, oauth, etc). Also look in your recovery email for an email that contains a list of backup/recovery codes. I'm pretty sure they don't email these codes anymore and your prompted to write them down/save them elsewhere but worth checking. Needless to say sibce then I do not use google for hardly anything other than the phone itself.

jpcom 2y ago

Why don't you just contact someone at Google? I would recommend starting an Advertising Campaign and not paying it. You will be surprised how quickly a support number with a real human being at the end appears.

TowerTall 2y ago
how do you do that if your are locked out of your account?

01jonny01 2y ago

Ok this is what you do. 1) Incognito mode in Firefox 2) Use the same IP as before, or a private proxy with the same country and city as before 3) Goto Bing and search for gmail 4) Attempt to login 5) If asked to enter your full recovery email address - opt for this option 5) If you are then prompted for pva code use a fresh SIM which has same country code as the one you are in. 6) This might work

readyplayernull 2y ago

Always remember to set a recovery email for your Google's account.

drivebycomment 2y ago
Recovery email is good but still not the most reliable way. My #1 recommendation is to setup a passkey, and also set multiple security keys as the 2nd factor. All other authentication factors are subject to some form of heuristic defense. Beyond that, a few optional things you can do in addition: - Use Advanced Protection. - Use a platform that's more secure , which are iOS, ChromeOS and some android (e.g. Pixel), in general and especially during recovery attempt.

Frederation 2y ago

Do what I did. Draft a formal complaint covering all of this. Document as well as possible, take it to get notarized, send registered mail to Google's legal arm. Worked for me but you have to prove as well as possible that its you. Good luck.

exabrial 2y ago

I dunno, call their tech support line? Oh wait… sv doesn’t do that.

deleted 2y ago

[deleted]

tonymet 2y ago

I was just helping someone with this. Attackers captured the account at night time his hours, and updated all of the recovery contacts to their own. The account recovery process is deliberately secretive to prevent attacking the protocol. Eventually you get escalated to a team that reviews your govt ID. have you hit that point yet? https://support.google.com/accounts/answer/6294825 https://support.google.com/accounts/answer/6294825?

tonymet 2y ago

For others in the thread: it's a good time to run Google Takeout (every 6 months) and copy your content to your own drive. Google Takeout now supports other clouds Review your security and recovery settings. Hackers are very aggressive right now. 1. third party apps 2. 2fa activation 3. family member settings 4. recovery email & phone contacts

tdeck 2y ago

I'm sorry, this is the Stripe support forum, not the Google support forum.

eonmist 2y ago

Exactly this is why I moved away from Google and never use it for anything important. When they started requiring verification from old phone it was too much. What if I lost it, it got stolen etc. Also have to account for them changing their verification requirements as they wish.

jpfdez 2y ago

Have tried recovery dozens of "times through g.co/recover"I don't quite understand your statement. The device can be lost, but you can always make a copy of the SIM cards. You may be referring to the fact that you gave or had your phone number cancelled.

anotheracc88 2y ago

Try a different network entirely. Maybe you have a bad neighbour on that IP address. Or you are fingerprinted for some other reason. If your phone has downloaded data, such as emails and contacts, back that phone up right away. At least that is something if not everything.

taosx 2y ago
Tried that, the loop remains the same and asks for the phone number and then asks for the code.

youngkingtz 2y ago

[flagged]

theLegionWithin 2y ago

> account represents my entire digital identity probably a mistake - not saying I havent done the same, I have and still do... however, I regularly back up my mailbox and data I cannot live without every 4 months to local storage & then copy the dataset to 2x physically separate media stored in different secure locations. currently using "Corsair survivor stealth" usb drives. short term fix? post on their social media feeds about it.

dgosling84 2y ago

This is my worst fear fr

btfo 2y ago

You did it to yourself by WILLINGLY and KNOWINGLY using proprietary software. You can only blame yourself.