I received this email from Google (translated from my native language):

We have got the request to access to your Google account using email address. Your code is XXXXXX.

Does it mean that somebody already has my password and all that he needs is second factor (code)?

2 Answers 2


It can be two possibilities:

  • Someone tried to create a new account and enable the 2 Factor Authentication but he enter the wrong phone number. So you receive the sms.
  • Someone have your password and tried to log in to your account but thanks to your 2 Factor Authentication he can't.

You can try to put your email address here to know if your email address is in public leak.

If you still receive these sms in a few days, you could change your password and security questions to be sure.

  • Thanks. Does it matter that it was email, not SMS ?
    – ceth
    Jul 10, 2017 at 18:48
  • It doesn't matter. The google's advice is to ignore this email / SMS. It can be an error.
    – Florian
    Jul 10, 2017 at 18:59
  • I have got 3 more email and have changed password.
    – ceth
    Jul 10, 2017 at 19:55
  • Is you account on this database: haveibeenpwned.com? Can copy the header of one email and put it on a pastebin
    – Florian
    Jul 10, 2017 at 19:57
  • Yes, my account is in this database. pastebin.com/VF48rY04 . Hmm 'andreydemidov'. But my account is 'andrey.demidov'.
    – ceth
    Jul 10, 2017 at 20:26

It could also be a phishing email. Do the links in the email lead to a google.com domain or somewhere else?

If what you pasted in is word-for-word from the email, it contains a few English grammar mistakes which can be another indicator of a phishing email.

If your email address has been exposed it may become the target of further attacks, like phishing.

Without more of the email in context it is hard to make an absolute determination of phishing, and considering what you found at HIBP @florian's answer sounds more feasible, but it is still worth considering this may be a phishing attempt.

  • We have checked during the conversation the email's header. It comes from google server from [email protected]. And it is signed with DKIM and SPF
    – Florian
    Jul 11, 2017 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .