An unfamiliar recovery email address or phone number on a Google Account is not a minor profile change. Recovery methods can be used to help prove account ownership, receive security alerts, and regain access after a lockout. If one appears that you do not recognize, treat it as a security event until you can explain exactly how it got there.
The first mistake is to panic and start deleting things from a random link in an email. The second is to assume the masked address or number must belong to an attacker. Recovery details are often partially hidden, so a number ending in digits you do not immediately recognize may still be an old number, a family number you once used, or another address you added years ago. The safest response is to verify the setting from your Google Account itself, then work through the account in a deliberate order.
Why a recovery method matters so much
A recovery phone or recovery email is not simply a place where Google sends reminders. Google uses recovery information to help you get back into an account, help verify that an account belongs to you, and notify you about suspicious activity. That means an attacker who manages to add or replace a recovery method may be trying to create a second route back into the account.
This does not mean the account is definitely lost. Google actively treats unfamiliar changes to recovery information as suspicious security activity, and recent changes to authentication or recovery factors can be delayed or restricted while Google decides whether they are trustworthy. The useful question is not “Is this definitely a hack?” but “Can I account for this change from my own activity?”
First, make sure the recovery detail is truly unfamiliar
Masked recovery information can be deceptive. Google may show only part of an email address or the final digits of a phone number. Before assuming compromise, compare the hint with:
- old phone numbers you previously owned;
- a secondary email account you rarely use;
- a work or school address you once connected;
- a family member’s number that you may have used temporarily;
- a recovery method you changed recently and forgot about.
Google’s own account-recovery guidance notes that an unfamiliar recovery hint can have several explanations: you may not recognize the masked version, you may be trying to recover the wrong account, or someone may actually have hijacked the account and added the method. That is why checking the signed-in account itself matters more than guessing from the masked hint.
Do not use the link in the warning email as your only route
If the change was discovered through an email or text, open your browser and go to your Google Account directly instead of trusting the message link. Legitimate security alerts are useful, but attackers also imitate them. Starting from the account dashboard removes one unnecessary variable.
Then open the security area and review the recovery phone, recovery email, recent security activity, signed-in devices, and sign-in methods. If the unfamiliar recovery method is visible there, you are dealing with a real account setting rather than a fake warning page.
If the change was not yours, secure the account before doing anything cosmetic
If you confirm that the recovery email or phone is not yours, the account should be treated as compromised or at least exposed. Google advises users who see unfamiliar critical security changes to correct the setting and secure the account immediately.
Start from a device and network you already use regularly for that account. A familiar device gives you a better chance of completing sensitive security changes without being mistaken for another suspicious sign-in.
1. Change the password from a trusted device
Use a new password that is not reused on any other site. If the old Google password was also used on shopping, social media, work, banking, or other accounts, those accounts need separate password changes as well. Changing only Google while leaving the same exposed password elsewhere keeps the incident open.
If you are already signed in, do not deliberately log out just to “start fresh.” Finish the important security checks first unless Google itself forces a re-authentication.
2. Remove or correct the recovery information
Open the recovery-phone and recovery-email settings and remove anything you cannot identify. Add a recovery phone that belongs to you and that you regularly keep with you. For recovery email, use an address you actually monitor and that is different from the Gmail address you are protecting.
After changing the recovery details, do not be alarmed if the previous recovery method still appears as an option for a short period. Google says changes to recovery phone or email can take up to seven days to fully take effect, and previous recovery information may still be offered during that security window. The delay is designed to help an account owner reverse an unauthorized change.
3. Review recent security activity
Look for unfamiliar sign-ins, newly added sign-in methods, password changes, recovery changes, new devices, and security settings you do not remember modifying. If Google shows an event that was not yours, use the account’s built-in option to report that it was not you and follow the security flow.
This is more useful than relying on the location alone. IP-based locations can be imprecise, mobile carriers can route traffic through another city, and VPNs can make a legitimate sign-in look distant. Device type, timing, and the surrounding account changes usually tell a stronger story than the map label by itself.
If unfamiliar devices are part of the incident, use NerveFilter’s guide on checking every device signed into your accounts rather than assuming a password change removed every active session automatically.
4. Check every sign-in method, not only the password
A changed password does not help if an attacker added another approved way to sign in. Review 2-Step Verification methods, passkeys, security keys, authenticator entries, trusted phones, and any other sign-in factor shown in the account.
If you see a method you did not add, remove it. Google may also flag a suspicious or newly added sign-in method and temporarily disable it. Current Google guidance says an unrecognized flagged method should be removed, followed by a password change and a review of security settings.
5. Review connected apps and websites
Compromise does not always end with a password change. A third-party app may have been granted access to account data while the attacker was signed in. Review apps and services connected to the Google Account and remove anything you do not recognize or no longer use.
This is especially important if the incident began with an OAuth consent screen rather than a fake password page. NerveFilter’s article on consent phishing explains why a real Google sign-in screen does not automatically make the requested access safe.
Check Gmail for changes that can outlive the original sign-in
When a Google Account has been accessed by someone else, Gmail settings deserve their own audit. Google lists unfamiliar forwarding, mail delegation, filters, blocked addresses, outgoing-address changes, POP or IMAP access, and other Gmail settings among the signs worth checking after suspicious activity.
This matters because a malicious forwarding rule can continue sending copies of messages even after you change the account password. Likewise, a filter can hide security emails from the inbox, making the account appear quiet while changes continue.
Check forwarding addresses, filters, delegates, “send mail as” entries, blocked addresses, and any other mailbox setting that could redirect or hide messages.
Why the seven-day recovery window can be confusing
Google uses delays around sensitive authentication and recovery changes because the same setting can be changed by either the real owner or an attacker. If every newly added recovery factor became fully trusted instantly, someone who stole a password could replace your recovery methods and immediately lock you out.
Google states that some changes to authentication or recovery factors may take up to seven days to take effect. During this period, the old recovery information may still be offered. That can feel alarming after you have already removed an attacker’s number, but it can be part of the protection mechanism rather than proof that the attacker still controls the account.
The important distinction is whether the unfamiliar method is still configured as an active recovery method in your account versus temporarily appearing as an older verification option during the security-delay period.
What if you cannot change the recovery method?
Google may restrict a sensitive account change if your sign-in looks unusual. If the option to change recovery information is missing or blocked, Google recommends trying again from a device you normally use, from a location where you normally sign in, or later from the same device.
Do not respond by bouncing between many devices, browsers, VPN locations, and networks. That can make your activity look less familiar, not more.
If you are locked out and the attacker changed the recovery details
Use Google’s official account-recovery process. Do not pay a person on social media who claims to have a private recovery tool or an “inside contact.” Google’s recovery system is the route used when a password, recovery number, or other account information has been changed.
For the best chance of recognition, use a device, browser, and location you commonly used with the account. Google recommends answering as many recovery questions as possible rather than skipping them, and using the most recent password you remember accurately when asked.
If the recovery page shows an email address or phone you cannot access, look for the option to verify your identity another way. Repeatedly guessing random recovery details is not useful; accurate historical information and a familiar environment are more valuable.
A security alert is a starting point, not the whole investigation
Google security alerts are designed to help you react quickly. If a sign-in or security change was not yours, Google’s current process can sign the account out on other devices and require extra verification for unfamiliar devices. But an alert does not tell you every action that happened before it.
After dealing with the recovery method, still review devices, passwords, sign-in methods, Gmail rules, connected apps, and recent account activity. Treat the recovery change as one visible symptom of a wider account event.
Do not forget the recovery email account itself
If your recovery email belongs to another provider, protect that mailbox too. A Google Account can be perfectly configured and still be vulnerable if the recovery mailbox is compromised.
Give the recovery email its own unique password and strong sign-in protection. Review its active sessions and forwarding settings. If the same attacker has access to both the main account and the recovery mailbox, fixing only one side may not close the incident.
When the strange recovery method may be a false alarm
Not every odd-looking recovery entry is malicious. A partially masked old number, a recently changed recovery address still shown during the transition period, or an account with a similar username can all create confusion.
A false alarm becomes more likely when there are no unknown devices, no recent security changes, no new sign-in methods, no Gmail-rule changes, and the masked recovery detail can be matched to something you previously used. A real compromise becomes more likely when several independent signals appear together.
The order that reduces the chance of a second lockout
When you still have access, keep the trusted session alive, verify the suspicious change from the account itself, change the password, correct recovery details, remove unfamiliar sign-in methods and devices, review connected apps, and inspect Gmail settings. Then strengthen the account with a recovery method you control and a phishing-resistant sign-in method such as a passkey or physical security key where practical.
If you no longer have access, switch to Google’s recovery process rather than trying to reproduce the attacker’s changes. Use the familiar device and location that give Google the strongest evidence that you are the real owner.