I just received a "New sign-in" notification email from Google, saying


Your Google Account UNKONWN_ACCOUNT@gmail.com was just used to sign in from SOME_BROWSER on SOME_OS

Where UNKONWN_PERSON and UNKONWN_ACCOUNT are total strangers to me. They have no resemblance to mine and even belong to a different culture.

The email also explains:

You received this message because MY_EMAIL_ADDR is listed as the recovery email for UNKONWN_ACCOUNT@gmail.com. If UNKONWN_ACCOUNT@gmail.com is not your Google Account, click here to disconnect from that account and stop receiving emails.

Where MY_EMAIL_ADDR is my email address, to which the message was sent.

While clicking the disconnect link seems the obvious action, I am not sure that this is enough. It seems unlikely that my address was added as recovery email by mistake, so I am wondering if UNKONWN_PERSON or someone else had any malicious intent

The disconnect link doesn't look like a phishing one, it is in this form:

  • 7
    Consider that some people use third parties as recovery address holders - for example, spouses. It wouldn't be especially unusual for someone to mistype the email address (or even guess it wrongly) in this case, especially if you have an email address of the form initial.surname@gmail.com - see xkcd.com/1279 for an example... – Matthew Aug 22 '16 at 8:38

The devils are in the details.

This message is yet another variant of malicious spoof spam mail tries to trick you to click the link that says "click here to disconnect".

If you hover over the URL, you will see the actual URL are NOT from Google, but some unknown site or shorten URL that will trigger a screen that downloads a malware(AKA Computer virus) or phishing site to trick you to enter Google username and password.

(UPDATE) there is another possibility mentioned here. Somebody accidentally enters your email address as recovery email (either due to typo or other reasons) It is mentioned here in google product forum. If you read through the message, you will notice most people will ask you DON'T CLICK any HTML link from an email.

If somebody wrongly enters their recovery email address, their Gmail account will not be activated. So you don't need to do anything with it.

That email actually is a terrible google email registration process that shouldn't be crafted in the first place. It just gives spammer ways to phish users: pour in tons of similar spam, people will think clicking the link will "fix" the spamming problem.

Perhaps this kind of email should be marked as "SPAM" to warn Google mail developer.

  • 4
    Sorry, I should have mentioned that the link is in the form: accounts.google.com/AccountDisavow?adt=SOME_HASH – Mario Trucco Aug 22 '16 at 8:45
  • 5
    This isn't always the case - Google legitimately sends out similar emails when an account is linked, and certain actions happen on that account. These go to a link at accounts.google.com/AccountDisavow?adt=<token> (based on having had a few of these for people with similar names...) – Matthew Aug 22 '16 at 8:46
  • In this case, the account seems to be active and what I received is a notification of its usage from new device/location. I guess that doing nothing could cause me receiving more notifications – Mario Trucco Aug 22 '16 at 9:15
  • 1
    You will get further notifications on certain actions from the account if you don't disconnect it. It is a terrible method for Google to use, since it's generally really bad practice to get people to follow links in emails, but I'm not sure what the alternative would be (this email doesn't just go to gmail users, so couldn't rely on an account existing). If you're worried, log into Google before following the link, so you never enter your details on the page it directs you to, but as far as I can tell, this is a legitimate email. – Matthew Aug 22 '16 at 9:20
  • 1
    @Matthew : I agree that some of this emails are legitimate. But it can be easily abused by phisher that will not hesitate to take their chances. If a users click this kind of email by habits, one negligence will risk a malware infection. – mootmoot Aug 22 '16 at 9:33

protected by Community Jul 2 '18 at 8:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.