I made a gmail for my buddy, let's call it buddy@gmail.com. I made a special recovery email that only I control, call it: recovery@gmail.com. In buddy@gmail.com I set recovery@gmail.com as the recovery email.

Buddy's girlfriend breaks into all his accounts and changes the passwords and recovery info to grief him. I don't understand how she did it on this one. She got buddy@gmail.com once, but I received an email on recovery@gmail.com, clicked the link to "recover my account," recovered the account, and remitted the account back to my buddy.

This time, the password was changed without me ever receiving an email to recovery@gmail.com. How is that possible? I seem to be unable to recover buddy@gmail.com which seems bonkers to me.

What did she do? How do I fix it? Is there something I could have done to secure it against her?

  • 1
    2FA is usually the best thing to prevent this type of hijack, aside from, y'kno, not giving anyone else the password?
    – QuickishFM
    Jun 18 at 17:43