I am just curious if anyone experienced the following and have any insight to add to this.

Once in a while, I notice some random person attempting to setup my gmail account as their "recovery" mail.  I dismiss this attempt as mistyping of account name and not a deliberate effort. Whenever I get the verification request email from google titled "Email verification code: xxx" for this attempt, I just ignore it. There is also a 2nd email from google to me with the subject title "Security alert for [email protected]" which states "The recovery email for your account was changed". Though the mail says it was "changed", I think it is just a notice/alert, not a confirmation of change because the change workflow can not be completed w/ out the verification code. Examining the SMTP headers in the 2nd email, I see the following custom headers google adds which seem to indicate what I suspect (i.e. "change pending")

X-Account-Notification-Type: 2-RECOVERY-anexp#-changed_pending_verification
Feedback-ID: 2-RECOVERY-anexp#-changed_pending_verification:account-notifier
ReachoutTracker: xxxxxxxxxxxxxxxxxxxxxxxx

I'd like security experts here to weigh in on this. And if anyone believes this a deliberate effort to take over account, what does this accomplish other than the random person destroying their ability to recover their own account?

Thanks in advance.

  • I get this from time to time. Also I get people using my email as the login to various websites. It amuses me to invoke the recovery and destroy their accounts.
    – Chenmunka
    Commented Jan 13 at 18:29
  • @Chenmunka that's both unethical and in some jurisdictions illegal.
    – schroeder
    Commented Jan 13 at 21:02
  • @Chenmunka no offence but your method of dealing with this particular issue seems a bit… harsh! When people do this it’s probably just an accident! Commented May 1 at 22:34

1 Answer 1


The workflow appears to go like this:

  • someone enters your email as a recovery email by mistake
  • they notice the mistake
  • they remove your email as a recovery account
  • gmail sends you a notice of the change (because if you were the legitimate backup, you should be notified in case the change was illegitimate or unauthorised)

You can test and confirm this process by doing the same thing with another account.

This is all normal and happens to a lot of us, especially of you have an address that could be mistaken as someone else's.

  • The workflow you mention does not add up. How would anyone manage to add my email w/ out the verification code? My understanding is that when you add an e-mail as recovery, google sends verification code to the newly added address, once you provide the verification code, only then google confirms the process. You can't add any email as recovery w/ out proving to google that you own access to that email. Commented Jan 14 at 0:05
  • As I said, you can try it. I spent 2 minutes testing it out and it does exactly what I laid out...
    – schroeder
    Commented Jan 14 at 0:57
  • Ok. will check it out. Commented Jan 14 at 2:11
  • @Arul, sending the verification to the new email would mean that an evil hacker can change your recovery address and make the change permanent. It also means if an innocent person enters the wrong email, the person whose email was entered can prank them.
    – gnasher729
    Commented May 4 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .