Ask HN: My Google account was hacked, Google says they can't help

Was the phishing email designed to impersonate Google and/or passed Gmail's spam filter? If so, Google should be very interested, so make sure this is communicated to them.

Getting Google's attention is unfortunately one of the few ways to increase your chances in the human intervention account recovery pipeline, which I suspect is understaffed. If that doesn't work, sharing an (appropriately redacted) screenshot of the phishing email on social media could also be helpful. (Absurd, I know)

If you're lucky, some Google employee on abuse/account recovery might see this and escalate. Wish your friend best of luck!

Every time I commandeer a google account, its with the prior owner - usually in India - punching in the authentication number on the phone. (I get the 2 digit number on my screen and I tell them what it is, and they select the same number from a multiple choice selection on their phone)

Maybe this measure could be circumvented if remote desktopping into a computer nearby the prior owner’s postal code, and taking over the account from that computer, this is how some online credit card fraud passes scrutiny, because the hacker doesnt appear far from the location of other purchases.

Disagreed.

They could request knowledge that only the account owner would possess such as dates/locations of past activity, subjects of emails (received before the breach, so that the attacker can't just send out new emails to the target account), require multiple notarized proofs of ID or other past activity (get a letter from your ISP that attests that you had that IP address at that time, etc) and maybe a huge monetary deposit to that is required to start the process and is forfeited if bad faith is suspected.

The idea is to make the process as long, annoying and "dangerous" as possible to deter or make malicious activity unprofitable while still giving the rightful owner a chance. The legitimate owner wouldn't mind getting all these documents and leaving a huge paper trail behind him as well as waiting a month while the real owner of the account is spammed with notifications (allowing them to easily cancel the process if it turns out to be a takeover attempt), but an attacker trying to break into an account would think twice.

Ask yourself what would happen if your phone crapped out and/or if you lost your wallet. Very unfortunate for sure. But there are mostly things you can do to not make it a crisis.

I lost access to gmail because of 2FA - Google Authenticator to be precise.

One random sunny day my 2 year old bit in my phone, thereby breaking it. A few days before i had reinstalled linux and apparently had not yet logged into gmail. So suddenly I have only unrecognized devices and no authenticator. Despite living in the same place, using the same wifi, etc, I simply cannot get back in since then. Its been years with dozens of attempts from any possible 'known' device, but there simply is no way. I know the password, I know previous contacts, i have old emails, i have the password, ... But even when I enter all the info Google requests for account recovery I simply get a screen saying they will get back to me - and never do.

My fault for not having a backup sheet of codes, but I was too worried someone would find and abuse that sheet. Well, goodbye 10 years of email.

More than this: use a password manager that has 2FA built-in and use THAT as your google account MFA.

The "easy" MFA with gmail involves approving new login attempts with an existing authed app present. But without an activated phone or other authed devices present, there is no way to authenticate to the GMail app to receive email.

Apple replaced the back of my iPhone after I dropped it. They do this by putting a new phone onto your screen and then tossing your old phone along with its activation status. ESIM, so no way to activate it without the old phone (which is now screen-less and inoperable). I could not even activate my phone because TMobile required a OTP from my email which I could not access. (Apple did not warn me about this at all btw.)

I was essentially 100% locked out of my account and unable to use voice, data, or access my google account until I could find a TMobile store to get a new SIM card and then use live-chat on the TMobile website to relay the one-time code from my laptop which thankfully was still authed. To say I was panicking about not being able to access anything was an understatement.

Lesson learned: use an MFA mechanism that doesn't require an activated phone since you can't activate your phone without having access to your phone. Now I have my MFA details in 1Password which is restored as a part of iCloud backup.

Buy a cheap domain and use that with your gmail account. All the convenience of gmail, but if the worst happens and you lose your account, you can pick a new email provider, redirect your email and you're back in business without losing access to all those accounts tied to your xyz@gmail.com email address.

I think usually it's obvious for someone who can see the account's recent activity. You can also design challenge-response type questions for the person claiming the account, that only they could know, within some reasonable confidence interval.

We don't. But we can assume that they aren't for the purpose of discussion. It seems more likely that a victim would post the OP's post than a perpetrator.

Google also doesn't, but they can say with increased confidence what the probability of the OP being a victim is.

But there's an even hard problem: say person A sells their Google account to person B, and does this with completely offline communications (offline wrt Google). To Google, this situation may look no different than a stolen account, at least for some period of time. But person A is a scammer, claims their account was stolen, and attempts to initiate a recovery process with Google.

This situation is the reason I virtually never perform account recoveries for players of my games. I also require users to use a third party login (like Google or Facebook) for their account, because I want as little to do with account management as possible.

As for wiping the phone, that's a standard feature of both "Find My iPhone" and the android equivalent "Find My Phone" so presumably they used that to wipe them.

A suggestion I would make to anyone who is uncertain of how this works, and since it's a moving target: once a year, test what it takes to compromise your own account. Ensure that you're comfortable with a recovery scenario of "I can demonstrate control over X to the automated recovery service."

I did it a few years ago with my personal GMail account, which I had thought was well-secured, and it caused me to make significant changes to my security settings.

Whatever you still have access to (again, from cache, existing browser that's still logged in, etc), start making backups - screenshots, etc.

Then it would be been impossible to login. Did you use a password that was leaked? If yes - may be they logged in - and you would have got a 'notification' on your phone to allow them. And you perhaps said yes to that remote login.

So what I would suggest is to focus on getting home. If you have to borrow money from family or friends or whatever, that's what you do.

We all dread the day our Gmail password stops working, but this is what we signed up for.

I know my gmail is safe, because I know that without the password, not even I can get into it.

This is by design.

I'm not sure I follow? This isn't an exploit, but a feature of Gmail. It doesn't allow you to receive anyone else's email.

I tried doing a password recovery of the account (to see what I could do to change the address, or contact Playstation) and found that on their end, firstnamelastname@gmail.com and firstname.lastname@gmail.com are treated differently:

Both gave the message that a reset e-mail had been sent. Only firstnamelastname@gmail.com caused me to receive an e-mail.

So Google (and other e-mail providers, like ProtonMail) ignore the dots, but it's possible that other companies don't ignore this.

Resolving the Playstation account required calling their support line for about 30 min, talking with an agent, and then replying to an e-mail generated specifying some information to confirm that I hold the e-mail account. They seem to already have the option for reporting misuse of an e-mail address.