50

I got a message on my mobile today:

"There's been a change to your Google account"

along with a prompt to re-enter my password.

Could someone be using my account or is this a known issue?

  • some say it could be loosely related to this: bugs.chromium.org/p/project-zero/issues/detail?id=1139 (Oauth tokens might have been compromised) – Federico Feb 24 '17 at 8:38
  • Your description is slightly different, but beware of a late 2016/early 2017 very successful and rapidly spreading Google Account phishing scam, related in particular to Google Docs. One article describing it is Google Gmail Phishing. The key giveaway is seeing "data:text/" at the start of the url that should show when you hover over the password prompt. – mdisibio Feb 24 '17 at 23:24
  • I got a very official looking notification bearing this message on my (Android) phone. After going through my entire Google Dashboard, I determined it was almost definitely real, and logged in, in both my accounts. I REALLY hope this wasn't a virus on my phone. It was acting through the Play Store app, so if this is illegitimate, it'll be hard to get rid of. – Carcigenicate Feb 25 '17 at 21:24
41

It looks like this is a known issue, and Google is on top of it.

From the product forums:

We've gotten reports about some users being signed out of their accounts unexpectedly. We're investigating, but not to worry: there is no indication that this is connected to any phishing or account security threats.

Please try to sign-in again at accounts.google.com and if you cannot remember your password, please use this link (g.co/recover) to recover your password. If you use 2-Step Verification, there may have been a delay in receiving your SMS code. Please try again or use backup codes.

Essentially the same message is currently displayed at the top of the Accounts Help: Can't sign in to your Google Account page.

Also, from @google on Twitter:

We know some of you had issues signing in today. Please try again now. Rest easy -- your account's security was not affected.

See also:

  • Also apparently some have had settings reset, so you should check for that – David Grinberg Feb 24 '17 at 16:36
  • 1
    @David: OnHub and WiFi routers, specifically. – ale Feb 24 '17 at 16:39
  • Funny. Are they really using a 'g.co/recover' link in their official message? How are users supposed to trust this kind of domain name? – Grzegorz Oledzki Feb 24 '17 at 17:33
  • 5
    g.co is Google's official URL shortener. Only they can use it. – ale Feb 24 '17 at 17:34

protected by Community Feb 24 '17 at 14:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.