In order to be able to help my mother, my gmail is listed as a recovery email for her Google account, mother@gmail.com (not her actual address).

Today I received a "Security alert for your linked Google Account" which notified me that someone requested recovery of her account. I first checked with her over the phone whether she might have forgotten her password, but she assured me she hasn't accessed or tried to access that account in some time.

The email said that if we didn't request account recovery, we should follow a link. I did so, as the email looked legit: sent from no-reply@accounts.google.com, mailed by gaia.bounces.google.com, and signed by accounts.google.com. The link led me to accounts.google.com with a green padlock marked in Firefox.

The link gave me options to cancel the account recovery process or letting it to proceed. However, the account to which this recovery was supposed to pertain was, confusingly, my father's email, which is not even a gmail address, father@localDomain. That is, on the top of the page it said that the recovery of account father@localDomain has been requested.

I marked the option to "Stop the account recovery" and very briefly mentioned this problem in a text box that was provided. I only got a confirmation after this and was not prompted to do anything else.

To add to my confusion, once I later checked to see if father@localDomain was also set as a recovery email for mother@gmail.com, I could find no connection between these two accounts.

If this was a very clever phishing attempt which somehow related my parents' email addresses, I don't know how it could have worked since at no point I was prompted to input any password or other personal data. I also tried hard to identify any telltale signs of phishing. Did I miss something?

If not, what happened?

closed as too broad by schroeder May 13 at 8:48

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think that you are assuming a control failure when you are not even sure what happened and what controls were triggered. The details you provide are more narrative than technical, making it difficult to sort out what was your impression and what actually happened. At best, this is looking like a gmail support question, not a security question until you can confirm there is a security angle to all this. – schroeder May 13 at 8:47
  • Thanks for your comment, @schroeder. Do you think there is anything I could do in order to obtain more information and improve this question? Or are you saying that without having insight into what actually happened this will not be answerable; that is, I should just contact Google support? – Fato39 May 13 at 10:23
  • The actual content and headers of the emails would have to be inspected (by someone) to determine if there was a failure of controls and if your assessment is correct. But at this point, you're wondering if there was a security problem, which makes this off-topic here. Support would help you eliminate non-security control failures first. – schroeder May 13 at 10:41