This content is likely not relevant anymore. Try searching or browse recent questions.
Receiving verification codes via SMS and email, still can't recover account (solved; process flawed)
Pin
Lock
1 Recommended Answer 25 Replies 877 Upvotes I've been through the Account Recovery process a couple of dozen times now, and getting nowhere, so I definitely need expert help.
I have a Google-account I created in 2009. I then configured my Gmail to retrieve mail via POP3 from the account in question, but last year I started getting notifications that Gmail was unable to fetch incoming mail. Seems the first time this happened was in August 2018 (Authentication Error: Server returned error "[AUTH] Username and password not accepted."). I do not know what changed (i.e. I don't recall changing the password myself).
I have copies in my Inbox from emails fetched from the account in question (up until August 2018, obviously) and now when I go through the Account Recovery via "Lost Password", this happens:
- I'm prompted for the last password used. I do know a password previously used, so I enter that.
- I'm asked to type in the recovery mobile phone number ending in -00. I type it in and get a text message with a code, type in the code and get to the next step.
- I'm asked to type in the recovery email adress, partially shown on screen. I type in the adress, receive a code via Gmail, type it in and click "Continue".
- Results: "Google couldn't verify this account belongs to you."
I've been through the process multiple times and have on one occasion had it temporarily locked from further attempts. Right now, I'm able to initiate the process but I still get nowhere.
At one point - but only once - I got the question "What was your first telephone number?". I answered that and got the message "Google needs additional time to review your information". Anyone know what that means?
I then clicked "Continue" and got the "Google couldn't verify...".
If asked, I could answer questions on when the account was created down to the month, or answer any other security questions if only prompted, but it's been 10 years so using the same IP or computer is out of the question.
Anyone have any smart ideas?
Details
Recommended Answer Recommended Answers (1)
Recommended Answer
Relevant Answer
Today CONCLUDES this issue I’ve been working on intermittently for the past months, but almost daily for the past 28 days. I posted in these forums and I posted on Twitter. I submitted four (4) account recovery requests, got some confusing replies (3 in the same day), one to the wrong account and subsequent resubmissions went unnoticed (at least unanswered).
Here’s a summary of how I see things in retrospect.
=== AUTOMATIC RECOVERY PROCESS ===
During the Account Recovery process:
- I was asked for an old password which I supplied along with a date for when that password was valid.
- I was asked to supply a mobile number ending in -00. I assumed this was the recovery mobile number.
- I was asked to supply a recovery e-mail (with a hint). I assumed this was the recovery e-mail address.
- I once (and only once) got asked a security question: my first telephone number.
Password (CORRECT): I assume this was correct information, a password that worked in the past (not necessarily the most recent one).
Mobile number (OK): Now that I’ve gained access to the account, I can see that I did NOT have a recovery mobile set up. I did however have 2-factor authentication set up with a mobile phone and that’s the number Google supplied me with a hint to (“ending in -00”). I successfully got recovery codes delivered to the number.
E-mail address (CORRECT): I had indeed a recovery e-mail address set up, corresponding with the one I got recovery codes delivered to.
Security Question (MAYBE): After gaining access to the account, I could see that “Your first telephone number” was set up as a security question, but not able to view and compare the answer to what I had answered during the AR-process.
So out of the process I would say I scored 2x CORRECT, one OK and one MAYBE - and that’s not even giving me the benefit of the doubt. Still didn’t allow me to recover the account.
=== ESCALATED RECOVERY PROCESS ===
Via these forums I was, with help from @bkc56, able to have a Case ID registered and got an e-mail to my primary account with instructions on how to fill out an Account Recovery form. (I would think that the Case ID is created beforehand, as there’s nothing in the URL to the form indicating anything specific to my issue. It’s the same URL I’ve later found other people are being referred to.)
The recovery form has fields for the basic information:
- An e-mail address to contact me at (I assumed the one set up for recovery);
- the address of the account I’m trying to recover;
- the full name of the person holding the account to recover).
I wrote a whole piece full of information about the account:
- A period of a few weeks during which the account was created a decade ago;
- Geographical information pertaining to the account creation, and even the hardware used;
- The precise date of the first outgoing e-mail from the account;
- A previous password to the account.
- I offered to answer security questions, even while admitting that they are in a vacuum (without access to recovery e-mail and / or mobile) not a valid way to recover accounts - but maybe a valuable addition to the other information.
I also attached screenshots of Gmail's POP3-configuration showing how I set up my primary account to be able to send mail from the "lost" account, as well as information on when the POP3-functionality stopped working. I also provided a theory on what had gone wrong: “Maybe I had updated the account password but not the POP-access configuration, locking the account by fetching mail with the old password?”
Submitting all of this information on October 31st had me waiting 5 days before I posted again expressing my concern for the lack of reply (https://support.google.com/accounts/thread/17950909?msgid=18606133). Little did I know that Google had already reviewed the case ( I would only find out about this after regaining access) but the answer got delivered to the WRONG ACCOUNT. Google’s answer was delivered to the account I was trying to recover, and not my primary account which is set up as the recovery e-mail address. It looks like there was a mixup of addresses, so that they believed I was trying to recover my primary account: the one I’m using to post in these forums.
On November 8th I re-submitted my information, and inexplicably got three (3) answers delivered to my primary account, the first two just 1 minute apart:
- at 5:04PM “We can't verify that you own erl***@gmail.com” (this is actually my primary account, not the one I’m trying to recover)
- at 5:05PM “Unfortunately, based on the information you provided, we were unable to verify your ownership over the account you escalated” (in this e-mail, it is not stated which account has been escalated).
- at 10:53PM “Unfortunately, based on the information you provided, we were unable to verify your ownership over the account you escalated” (seems like a duplicate, but again it’s unclear which account they’re referring to - was it perhaps my primary account all along?).
This had me thoroughly confused at the time and I was doubtful that the case had been handled properly. Obviously there was some misunderstanding and mixup - after all, Google never had to verify that I own erl***@gmail.com: it’s my primary account, and working just fine.
=== SUPPORT VIA TWITTER ===
I took to Twitter (https://twitter.com/erlingvignisson/status/1192756466517716997), feeling that no more help was to be had via the Support Forum.
Long story short, with Twitter brimming with messages from people having problems with the recovery process, I got a reply from the @Google account. At first I publicy got referred to the usual page for Account Recovery (been there, done that) but later got a personal DM from @Google with a link to the Escalated Account Recovery page.
Back at familiar turf, I re-wrote my 1,000 character argument for recovering the account and submitted it - but never got a reply. I’ve since come to know that the DM from @Google is a standard one and not personalized, and replying to the DMs doesn’t yield any response. Probably nobody’s reading these, and I would speculate that the account is run by automation.
I was contacted by other users on Twitter having similar problems and they suggested some creative ways of getting in touch with Google — which I’ve tried (including live chat for other services) — but didn’t get anywhere with my recovery issue.
=== ENDGAME ===
At this stage, after a 4 week battle, I felt that Twitter and the Support Forums were dead ends. So I came up with a new strategy, albeit a low-tech, grueling one: write down every single variation a previous passwords and systematically (brute-force) try to log in to the account over the course of days, weeks or even months in case the account would get temporarily disabled in between attempts.
As it turns out I got lucky: one of the password variations was in fact the current password - I was able to log in!
I did notice a slight difference in the “Lost Password?” process: after supplying "the last password I know worked", I got to the step where Google wanted to send a text message with a verification code. Up until now I had always been asked to SUPPLY the number (but with Google hinting that it "ends in -00"). The difference I noticed this time around was that on this step, I no longer had to supply the number but rather it said "Google will send a verification code to --00", and there was only the "Send"-button (absent were input fields for supplying the entire phone number).
I received the code via text message, entered it on the page and was suddenly logged in with this message:
“Sucess - you are signed in now. You entered your current password and passed your second step, so you can continue to your Google Account. You can still change your password if you want.”
I was at this point mostly taken by surprise, but obviously exhilarated having finally cracked the case!
Finally - as it turns out - the theory I wrote to Google turned out to be right: in August 2018, I enabled and registered my mobile phone for 2-factor authentication and will have changed my password at the same time. Subsequently, the POP3-access to the account from my primary Gmail stopped working.
=== PROPOSALS FOR IMPROVEMENT ===
- I would like to see Google include the actual address of the escalated account in the e-mail template information about the results of the review: “Unfortunately, based on the information you provided, we were unable to verify your ownership over the account you escalated”.
In my case, if I would have seen that the accounts were mixed up, I could have acted accordingly.
- I would like to see Google make official recommendations for account recovery information. Once upon a time these included the account from which you had gotten an invite to Gmail; one or more labels you had created for sorting mail; the date of when you created the account. These are no longer valid, it seems.
There are no guidelines to what kind of information Google regards as proper proof of ownership (they do explicitly exclude gov’t documentation / identification) and even if you can search and find some sensible suggestions online, there will be no dialogue with Google about the quality of your information when they come back with the verdict of the review of your case. If it's denied, it's denied - and you'll never know if it was because one item of information out of 20 you supplied didn't match up exactly, or even approximately.
- THIS ONE IS IMPORTANT:
In retrospect I can see that I had the recovery e-mail set up correctly, and during account recovery I received the codes Google sent to that address. I did however NOT have a recovery phone set up for the account but still, Google offered me a hint for the number I had set up for 2-factor authentication. I supplied the number and Google would send a verification code to that number, which I received and supplied.
Why this combination doesn’t work is a mystery to me.
It's two separate methods of communication: one is explicitly configured for account recovery via e-mail. The other one (verification code via mobile) is proposed by Google even if the number isn't explicitly set up for recovery. And if a phone number isn’t set up for recovery, why supply the hint to the 2-factor authentication number and then disregard the result of a customer correctly completing the process and entering the verification code?
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
Relevant Answer Relevant Answers (0)
Our automated system analyzes the replies to choose the one that's most likely to answer the question.
All Replies (25)
Recommended Answer
Relevant Answer
Additional information:
I also tried entering the AR-process by going through "Forgot e-mail address?", where I supplied my main Google account e-mail address as the "Recovery address", followed only by the first and last name on the account I'm trying to recover (it's my child's name).
I received a code via e-mail and after typing it in, Google actually displays the account I want to recover, e-mail address and all! This leads me to believe that: my Google account is indeed still correctly listed as the recovery e-mail address for the account in question.
However, from here on I'm back to the "Enter password" step, with the option of clicking "Forgot password", sending me into a loop starting at the initial post in this thread.
Essentially I'm looking for a way to
- force the process to ask additional security questions (as recovery via SMS and e-mail doesn't cut it), or:
- supplying additional information to the Account Recovery team to get past hurdles in the automated process due to differences in IP-adresses, machine / hardware keys, general geolocation or other variables that have inevitably changed over time.
Update: In writing this reply, I went through the process to accurately describe the steps and results only to now have my account temporarily locked for further attempts:
Too many failed attemptsUnavailable because of too many failed attempts. Try again in a few hours.
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
Recommended Answer
Relevant Answer
My email account cannot be open
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
Recommended Answer
Relevant Answer
Replay My google account Code by SMS
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
Recommended Answer
Relevant Answer
The "Too Many Failed Attempts” message can happen when you “spam” the recovery system with too many failed recovery attempts. You'll have to wait a few days to a week before trying again. Don’t make any recovery attempts during this time as that may just reset the timer. But that won't help unless you can provide more, or more accurate answers to the questions asked. Providing the same information that didn't work the last dozen times won't work the next time either.
Although, I would think having both a recovery phone and e-mail would be pretty good proof of ownership.
Are you attempting the recovery process from the device/location/IP-address that was recently used to access the account? This is probably the single most important thing you can do to help prove ownership.
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
Recommended Answer
Relevant Answer
Can't see my password u send me
recommended this
marked this as an answer
Recommended based on info available
Our automated system analyzes replies to choose the one that's most likely to answer the question. If it seems to be helpful, we may eventually mark it as a Recommended Answer.
This question is locked and replying has been disabled.
Link to post
Delete post?
This will remove the reply from the Answers section.
Notifications are off
Your notifications are currently off and you won't receive subscription updates. To turn them on, go to Notifications preferences on your Profile page.
This reply is no longer available.
Badges
Some community members might have badges that indicate their identity or level of participation in a community.
