Google suspicious activity warning persists for 4 days despite my confirming I recognize it, does this indicate additional security issue? [closed]

Question

I had a google suspicious activity warning four days ago triggered by logging in from a location I don't use often. I accepted the offer to view the activity and acknowledged that I recognized it. This normally makes the warning go away.

However in this instance every time I log back in over the last four days, I get a red warning bar at the top of a signed-in google page.

When I click Review your recent activity I get the critical security alert box grayed out with a white box over it saying "You've already replied that you recognize this activity" followed by two options Change reply and OK.

Of course I click "OK" every time because I do not want to change my reply and risk the possibility of locking my account.

QUESTION: Does this behavior indicate that there is a further security issue that I'm unaware of? What would happen if I instead clicked Change reply? Right now I have two-factor turned off so I'm very concerned about getting locked out. Are there any further problems that I could look for somehow?

• macOS & Chrome incognito mode

I should note that in the last weeks I received two dialogues from google when initiating a search, to verify that I was not a robot, due to "unusual traffic from (my) computer network". (also shown below)

That happened at a shared WiFi connection using a DSL line.

---

---

---

update:

Following AlphaD's comment to go to https://myaccount.google.com/security-checkup I found that there is an issue of a possible 2nd device being logged in.

Does this mean that for certain there is a Mac somewhere that's been logged in to my google account for 164 days without me knowing it? I haven't ever knowingly logged in on any other computer than my own computer.

I don't know how to check if this device is real or not.

However if I go to https://myaccount.google.com/security I only see one device:

Answer 1

QUESTION: Does this behavior indicate that there is a further security issue that I'm unaware of? What would happen if I instead clicked Change reply? Right now I have two-factor turned off so I'm very concerned about getting locked out. Are there any further problems that I could look for somehow?

That your google account notes suspicious traffic from your computer or network might be an indicator for automated usage of google search (e.g. if you built a tool to search a lot) or if you are using a vpn/tor and change ip/location during your sessions.

The other security issue you search for is having turned off two factor authentication. I'd suggest you turn that on. If you own a smartphone, use the Google Authenticator App to generate Timebased One Time Passwords (TOTP). You'll also get 10 backup codes you can use if you loose access to your device. So I'd suggest keeping them at a reasonably secure space (e.g. printed out under your mattress.

Afterwards, change your google account password and sign out of all devices - you'll need to login in to every device again, using the 2FA code generated from the app. This will make sure that you do not have anyone (ab)using your account.

Answer 2

Google suspicious activity warning persists for 4 days despite my confirming I recognize it

This behavior is intentional. If an attacker had gained access to your account, allowing the warning to be dismissed would allow the attacker to dismiss the warning before you were able to see it.