0

I was assisting a man at the public library who was unable to login to his gmail account. He typed in his password and was prompted for a phone number, presumably so a code to be sent which would then have to entered in order to proceed with the login.

He said he had no phone and that he borrowed someone else's phone when he setup the account whatever that means. Anyway he kindly asked if I he could borrow the use of my phone number for this one-time purpose of logging in. I said no.

Would it have worked if I agreed and would there have been any implications?

  • 1
    That seems weird to me. The phone number should have already been set up and not asking for a new one upon login. – schroeder Aug 20 at 19:56
  • could be that the target is your phone number, not the gmail account. – not_very_nice Aug 20 at 21:46
1

In general, you should not give your phone number to someone else to log in.

I'm confused about how this would have worked. Every time he logged in, you'd get a text to your phone ...

  • It’s possible should said phone number have been given he would have then used it to open another account or use it for a new MFA on something different altogether. Maybe he was hoping the individual wasn’t as sharp as he was and would have just said yes not really understanding what he was doing. It’s possible then it would have been used for fraud. – ISMSDEV Aug 21 at 3:56
3

He may have been misleading you into thinking he was trying to gain access to an existing account, when in fact he was trying to setup a new account for some nefarious purpose.

Many email service providers (including Gmail) require a phone number when setting up new accounts. The service provider validates that the person who is setting up the account is able to receive messages at the phone number provided, using the method that you described in your question. This prevents people from anonymously setting up accounts. Then, later, if the account is misused, the provider has a phone number that they can attempt to use to track down the person who setup the account.

If this is what the person that you met was up to, and you had given him your phone number to use, and he proceeded to setup the account and then use it for some illicit purpose - then you may have soon received a call from law enforcement and had some explaining to do.

0

Allegedly, there is no risk in the scenario you describe, where a complete stranger borrows your phone number for a text sent to it which you read over back to him, however had the email account somehow had been yours, that would have been a different story and reading him the code texted to it could have become very risky to you.

Imagine someone has your email address and knows you who approaches you with the story you just described but in fact, he goes through the password reset to your account, pretending to log in to him own account. That may allow him to change your password and log you out so better be safe than sorry, never give your phone or even the number, reading to someone a 2-step verification text sent to you. Sounds too fishy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.