5

I received this email from Google (translated from my native language):

We have got the request to access to your Google account using email address. Your code is XXXXXX.

Does it mean that somebody already has my password and all that he needs is second factor (code)?

8

It can be two possibilities:

  • Someone tried to create a new account and enable the 2 Factor Authentication but he enter the wrong phone number. So you receive the sms.
  • Someone have your password and tried to log in to your account but thanks to your 2 Factor Authentication he can't.

You can try to put your email address here to know if your email address is in public leak.

If you still receive these sms in a few days, you could change your password and security questions to be sure.

  • Thanks. Does it matter that it was email, not SMS ? – demas Jul 10 '17 at 18:48
  • It doesn't matter. The google's advice is to ignore this email / SMS. It can be an error. – Florian Jul 10 '17 at 18:59
  • I have got 3 more email and have changed password. – demas Jul 10 '17 at 19:55
  • Is you account on this database: haveibeenpwned.com? Can copy the header of one email and put it on a pastebin – Florian Jul 10 '17 at 19:57
  • Yes, my account is in this database. pastebin.com/VF48rY04 . Hmm 'andreydemidov'. But my account is 'andrey.demidov'. – demas Jul 10 '17 at 20:26
2

It could also be a phishing email. Do the links in the email lead to a google.com domain or somewhere else?

If what you pasted in is word-for-word from the email, it contains a few English grammar mistakes which can be another indicator of a phishing email.

If your email address has been exposed it may become the target of further attacks, like phishing.

Without more of the email in context it is hard to make an absolute determination of phishing, and considering what you found at HIBP @florian's answer sounds more feasible, but it is still worth considering this may be a phishing attempt.

  • We have checked during the conversation the email's header. It comes from google server from noreply@google.com. And it is signed with DKIM and SPF – Florian Jul 11 '17 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.