1

I got an email from Google no-reply@accounts.google.com saying the following about the gmail address of an acquaintance that is supposedly connected to a non-gmail account I use:

> The password for your Google Account - &&&&&&(changed)&&&&&@gmail.com
> - was recently changed.  If you made this change, you don't need to do anything more. 
> 
> If you didn't change your password, your account might have been
> hijacked. To get back into your account, you'll need to reset your
> password. 
> 
> Sincerely, The Google Accounts team    This email can't receive replies.
> For more information, visit the Google Accounts Help Center.   If
> &&&&&&(changed)&&&&&@gmail.com isn't your Google Account, click here to
> disconnect your email address from this account.

As you can see, gmail is giving me the option of disconnecting my email from his gmail account, but before I do and without asking him I am wondering what earthly reason he could have for giving my address to gmail as his own.

Is this some kind of technique to build history to eventually hack into my gmail? I don't see how.

  • 2
    I highly doubt this email is from Google – Ulkoma Jan 25 '15 at 13:01
  • 1
    Hello, thank you so much for the responses. It looks like this is a legitimate email from Google: accounts.google.com/… Don't know what my acquaintance is up to. But thank you again for the clear explanations! – polaatx Jan 26 '15 at 21:13
4

TL;DR: It's probably exactly what it purports to be.

I got a Gmail address during the beta, so mine matches my (very common) name. I routinely get messages from Google saying that some account has been created and my address used as an alternate contact. I routinely click the "unlink this account" link and am never bothered by that address again.

Why? Well, in a small number of cases I think people really are too clueless to know their own email addresses. More likely the person creating the account is up to something, not necessarily extremely bad, but requiring anonymity. In the alternate address field, they put a plausible but (to them) fake address that turns out to be mine. That could be the case with your acquaintance.

What to do? Examine the "click to unlink this account" link very carefully by viewing the message source. A real link from Google looks like this:

https://accounts.google.com/AccountDisavow?adt=AOX8kir9Wk1MCXKhmJxH-rEC[redacted]

If so, click the link; problem gone. (I removed a part of the opaque token from the example link, but I probably didn't need to. Even if someone navigated to my example link, it would just try to disconnect an account that's already disconnected.)

I didn't really understand the "acquaintance" part of your message. If you are telling us that you recognize the alternate address as that of someone you know, disconnect it anyway because your account should not be connected to one you don't control. Then ask your friend what's going on. It might be as innocent as your friend wanting your help if he ever locks himself out of his account. But he (or she) should have asked you first.

It is possible that this is a phishing attempt and the sender wants to steer you to a particular link. Looking at the link should tell you. In any case, real Google "disconnect" links just tell you that the address has been disconnected and tell how to undo that if it was a mistake. They do not ask for authentication. So, never, ever supply authentication information like a password after clicking such a link.

3

As Ulkoma pointed out, there is a high chance that this mail is a fake to trick you into clicking the link which allegedly allows you to remove your mail address. Mocking the sender address is easy in SMTP. The link target could be a phishing and/or malware distribution site. So you should not click on it. If you hover over the link the target should be shown in the footer of your browser window. Fake sites usually reside on look alike domains - for example google.com.tld (tld being an arbitrary top level domain).

However if you are using a popular ISP (Gmail, MSN, Yahoo, ...) it could be that someone misspelled his own mailadress. Or it is a burner account and someone entered a random address.

protected by Community Jun 16 '16 at 13:15

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.