Recently, I was forced to log in to my Gmail account with a browser to keep using it.

Then, Gmail noted that the "alternate e-mail address", my 1999 Hotmail one, which I had long ago associated with my Gmail account (in 2004), has been "detected as not secure". I forget the exact phrasing. Something about it being detected as not secure.

I'm 100% sure that I have never used the password for that Hotmail account anywhere else, and that it has not leaked, and that the account was not compromised.

However, I was still locked out of it, since approx. 2014, when Microsoft started demanding that you enter a phone number to access the account, refusing to let me dismiss it. So I was (and remain) "essentially" locked out of it.

Is it possible that, somehow, Gmail could detect this from a third-party service? What else could they mean by "detected as not secure"? Some guesses:

  1. Maybe they have some means of checking the age of the account, and just assume that since it was registered in 1999, it must be abandoned?
  2. Maybe it's listed in some kind of leak database, even though any password there would not be usable to log in since I never used the password elsewhere and have not been so careless as to leak it.
  3. They are just making random nonsense up because it's a competitor's address.
  • there must be a know more/learn more where it was written that the email is insecure
    – yeah_well
    Nov 8, 2020 at 9:13
  • Vipul Nair: Well, there isn't.
    – Gsnail
    Nov 8, 2020 at 9:26
  • We might need more info on the exact message. And this looks more like a support question for Gmail to understand what they mean by this.
    – schroeder
    Nov 8, 2020 at 9:42
  • 1
    Please stop making new accounts to comment on your question. Log into your original account or make just one more and ask to merge your accounts
    – schroeder
    Nov 8, 2020 at 10:49
  • 1
    I thought some sites were marking Microsoft emails as "insecure" because they allowed deactivated accounts to be reregistered (and thus allow account takeover if set as a recovery account).
    – user
    Nov 13, 2020 at 15:04

1 Answer 1


Google is not going to reveal security algorithms to the public, so any guesses here are speculation.

My main guess is that Google sent 1 or more notifications to your alternate address, then decided it was abandoned because one or more of the following happened:

  • The notification was actionable, but you ignored it. Possibly this could have been an e-mail asking you to reconfirm your account.
  • The notification was never opened (this is detectable, but not reliable).
  • Microsoft rejected Google's notification e-mail. This could happen if the mailbox was full or if Microsoft blocked the account from receiving mail due to it being abandoned.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .