6

I have enabled multi-factor authentication for my Gmail. When I need to log in to my mail, I should enter an OTP which is sent to my phone number.

I got a call from this number, even though I did not sign in to my mail, and it said "Your verification code is ******". Does this mean that my account is at risk? I have checked my mailbox, and there is no attempt to login.

I found this on the Google support forum:

Yes, this number is definitely Google's number used for various verification purposes. Just be aware of this: If you initiate the verification process, then it is perfectly safe. If, on the other hand, somebody else sends you a code from this # (it is possible) and then asks you to give them the code verbally or by text, they are trying to scam you! So to be safe, do not ever give the code to anybody, no matter how convincing their story is!

Improve this question
0

1 Answer 1

Reset to default
5

There are two possibilities:

  1. Someone has your password and is trying to use it, but fails the 2FA. Change your password!

  2. Someone is trying to register a new account or 2FA to an existing one, but has (possibly accidentally) added your phone number instead of their own.

    It's possible that there's just a minor difference in your numbers and it's simply a typo, e.g. the Ghostbusters are trying to register +1-311-555-3268 instead of +1-311-555-2368.

It's safer this way, when there's just an automate that gives you information, but if someone calls from number +1 202-455-8888 and tells that they are from Google, it's probably still a scam, because Caller ID spoofing is relatively easy. You shouldn't tell them anything. If they really were Google, they would already know it anyway. :)

Improve this answer
3
  • Thanks Esa for the quick response, I have changed my password recently which means I am ensuring that no one has my password. If someone has my old password then is it possible to get this situation
    – RCvaram
    Nov 9, 2020 at 15:40
  • 1
    Well, it might, as I can recall Google uses "the last password you can remember" as one factor for their password recovery process. But they wouldn't get pass the password recovery with that alone.
    – Esa Jokinen
    Nov 9, 2020 at 15:47
  • When someone has my old/new password and if they attempt to log in to my account. Google will inform with mail. But I did not receive like that mail. What will be the final conclusion?
    – RCvaram
    Nov 10, 2020 at 5:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.