My email is listed as recovery email for an unknown Google account

Question

I just received a "New sign-in" notification email from Google, saying

Hi UNKNOWN_PERSON,

Your Google Account [email protected] was just used to sign in from SOME_BROWSER on SOME_OS

Where UNKNOWN_PERSON and UNKNOWN_ACCOUNT are total strangers to me. They have no resemblance to mine and even belong to a different culture.

The email also explains:

You received this message because MY_EMAIL_ADDR is listed as the recovery email for [email protected]. If [email protected] is not your Google Account, click here to disconnect from that account and stop receiving emails.

Where MY_EMAIL_ADDR is my email address, to which the message was sent.

While clicking the disconnect link seems the obvious action, I am not sure that this is enough. It seems unlikely that my address was added as recovery email by mistake, so I am wondering if UNKNOWN_PERSON or someone else had any malicious intent

The disconnect link doesn't look like a phishing one; it is in this form:

https://accounts.google.com/AccountDisavow?adt=SOME_HASH

Answer 1

What I find is that many people are not aware on how to properly use their email accounts. I also encounter this frequently. So, here's what I could understand so far.

1. If your email username account happens to be a very common name, you are more likely to receive such email.
2. I find that many average users, even blindly enter an email address thinking that it would work.
3. When they create new email address, they would add recovery email address, just to fill up that option.
4. If you didn't click that disconnect, I find that I would receive email about any security related stuff for the unknown account link to my account.

So, it's not a phishing just some average users unaware about security risk. Imagine, I could, if I want to, reset their login using the link account.

If you are not sure, you can always copy the link and paste in your browser address instead of clicking directly. That way you can check the actual link.

Answer 2

The devils are in the details.

This message is yet another variant of malicious spoof spam mail tries to trick you to click the link that says "click here to disconnect".

If you hover over the URL, you will see the actual URL are NOT from Google, but some unknown site or shorten URL that will trigger a screen that downloads a malware(AKA Computer virus) or phishing site to trick you to enter Google username and password.

(UPDATE) there is another possibility mentioned here. Somebody accidentally enters your email address as recovery email (either due to typo or other reasons) It is mentioned here in google product forum. If you read through the message, you will notice most people will ask you DON'T CLICK any HTML link from an email.

If somebody wrongly enters their recovery email address, their Gmail account will not be activated. So you don't need to do anything with it.

That email actually is a terrible google email registration process that shouldn't be crafted in the first place. It just gives spammer ways to phish users: pour in tons of similar spam, people will think clicking the link will "fix" the spamming problem.

Perhaps this kind of email should be marked as "SPAM" to warn Google mail developer.