About security notices from Google Notice

We contact you when we detect activity on your account that looks like it wasn't you. The notice exists so the change can be confirmed or reversed before it becomes a lockout.

Getting a call right now? Nothing is needed from you on the call itself. This page explains what we check, how to confirm the caller is genuine, and what we never ask for.

What triggers a notice

A notice is raised by any one of the following:

The account password was changed — including changes made from a device already signed in.
The primary phone number was replaced. The old number stops receiving codes immediately.
A recovery email or recovery number was added, changed, or removed.
A sign-in came from a device, browser, or location not seen before.
A third-party app or OAuth client was granted access to the account.
An unusual burst of verification codes was requested, usually a sign someone is probing the number.

Several of these together is the pattern we treat as a probable compromise. One alone is usually a change the account holder made.

What happens next

Where the account still has a working fallback route, we call it within 24 hours, in local business hours. If the activity was yours, the call is short: the case is closed and nothing changes. If it wasn't, the agent stays on the line while access is restored.

How to confirm the caller is genuine

A static image that shows where to check the security details of a received email.

Ask for the case reference number at the start of the call.
Compare it with the reference in the notice you received. They match or it isn't us.
If anything feels off, hang up and call back on the number published below. We won't be offended.
Never read out a one-time code that arrives mid-call unless you triggered the sign-in yourself.

Ask for the case reference number at the start of the call.
Open the notice in the Gmail app and compare the reference. They match or it isn't us.
If anything feels off, hang up and call back on the number published below.
Never read out a one-time code that arrives mid-call unless you triggered the sign-in yourself.

Ask for the case reference number at the start of the call.
Open the notice in the Gmail app and compare the reference. They match or it isn't us.
If anything feels off, hang up and call back on the number published below.
Never read out a one-time code that arrives mid-call unless you triggered the sign-in yourself.

What we never ask for

Your Google account password
Your full 16-digit card number
Remote access to your device through a third-party app
Payment to "unlock", "verify", or "restore" an account

If you missed the call

You don't need to call back. Open Recent security activity, review the last 7 days, and confirm the entries are yours. Anything you don't recognise goes to Secure your account.

If the change wasn't yours

Change the password from a device you trust, not from a link in any email.
Remove any device, session, or third-party app you don't recognise.
Re-add your own number as primary if it was replaced, then set 2-Step Verification.
Check the recovery email and remove anything unfamiliar — this is the most common way access is retained.

Related resources

Give feedback about this article