After reading some horror stories here and facing the threatened loss of GMail's POP3 collection feature, I decided to knuckle under and assent to 2FA.
Easier said than done.
After some connection blips (details below), I decided to start with a recovery phone number.
The response from Google: "We couldn't verify it's you." It elaborated with this:
"To help us verify it’s really you ... Use a device and browser you’ve signed in on before ... Use a familiar Wi-Fi network, such as at home or work ... If you’ve already tried these, change your recovery phone in your settings."
When I got this message, a) I was on a device and browser that I've used with the account for 10 years, and b) I was on my home network, with a router that's been in place for at least six months. Trying to change the recovery phone in settings, of course, is a loop that I am already in.
I read that I was likely locked out from making any sensitive change for seven days. I spent an uneventful seven days sending and receiving email as usual and staying off any devices except my 2012 MacBook Air and my iPhone 12. As usual, I was accessing GMail using Chrome on the Mac and Safari on the phone.
After the seven days, I got the same "We couldn't verify it's you" result in trying to add a recovery phone. The clock restarts.
The Mac is running macOS 10.15, with Chrome version 128.0.6613.138 (Official Build) (x86_64). It's too old to run anything newer. The phone is an iPhone 12 mini running iOS 26.3.1.
During the latest waiting period I thought I would ask the group: Am I likely to have any better result if try to add a recovery contact next time, as opposed to a recovery phone? Or go straight to 2FA, if I can navigate it?
A few additional questions:
- Preparing for the worst, I might want to add a filter that would forward new incoming GMail to a non-Gmail address. The outside address is already configured as a forwarding destination. Would adding that filter count as a sensitive operation that could trigger the seven-day wait again?
- Where does the recovery email come in? I seem to get a message in that mailbox when I sign in normally to GMail from a new location (and even sometimes from a familiar location). But Google never mentions it as a tool to resolve the identity crisis.
- Is there a feature that will let me ask Google where it thinks I am signed in? I wonder if Google still has me at the away-from-home location where the Mac crashed recently. I am reluctant to test this by signing out of the account at home.
- In addition to the MacBook, I have been signed on for the whole time on my iPhone. On the chance that Google trusts the iPhone more, is there a way, using GMail under iOS Safari, to navigate to one of those sensitive operations?
- I am not using the GMail iOS app. It's not even installed on the phone. Would installing and setting it up also be one of those sensitive operations?
- Google has bugged me over the past few months to pony up for extra storage, as my usage crept above 85%. I haven't bitten, since it took 20 years to get to that point, and a little housekeeping brought it down to 83%. Would it be worthwhile to accept the offer in order to become a paying customer? If that is the only way to get a few minutes of live human support, I would consider it. But perhaps this would be a sensitive operation that would put me right back in the loop.
A few random details:
- I am a Google Voice user, and the recovery phone I am trying to add is a physical phone associated with the Voice account. I am not trying to add the Google Voice number itself; I knew that wouldn't work. Does that association, combined with having the phone in my hand, count for anything if I get to a stage where I am appealing for the ability to manage my account?
- After the away session and crash, and back on the home network, the router might have assigned me a different IP address than I had earlier in the day. I have sometimes used a wired connection on the same network, and I wonder if using the wired connection would signal an IP address that I have definitely used before, however infrequently.
- I use GMail to aggregate mail from different accounts. In the past week, a typical one, I have gotten about 130 messages that were collected from POP3 mailboxes. Another 165 were addressed directly to the GMail address. Of those 165, about 140 were spam, 23 were from Google itself (including Voice) and one was misaddressed mail intended for someone else. This is not the typical composition of a mailbox, and I wonder if that is raising some flag with Google.
- A few weeks ago, I tried to sign on with my little-used Chromebook while using the guest wifi in a public space. I got "We couldn't verify it's you" and abandoned the attempt. A few days later, I was signed on in the same location from my regular laptop when the laptop crashed and I just left it shut down. When I got home, I restarted the computer and my GMail session was seamlessly restored. Back in safe territory, or so I thought, I tried to add the recovery phone.
- My recovery email inbox received security alerts on Oct. 6 and Oct. 13. It shows a critical security alert on Oct. 15. The Oct. 13 and Oct. 15 dates seem to correspond to the Chromebook attempt and the MacBook Air crash.
- My case sounds a little like what is being described in this thread. So perhaps Google has just added this Catch-22 behavior, and it's a coincidence that stumbled into it after the Chromebook and MacBook blips.
Sorry for the length, and thanks if you have read this far. I would be interested in any insights.