Lost Password Recovery
‍
The recover process can be started in either of two ways:•
‍
1. Go to the Gmail sign in page at https://mail.google.com/ and after entering your e-mail address click the "Forgot password? Link.•
‍
2. Go directly to the start of the recovery process at https://accounts.google.com/signin/recovery Once you have supplied your e-mail address, you will move into the account recovery process. In the past this was sometimes called the "account recovery form" although there is no longer an actual form to fill out.
‍
You will then be presented with a number of steps to try and prove ownership of the account.  The options available are dictated by what recovery options were previously configured on the account.  For example, if no recovery e-mail address was configured, that option will not be shown.  If options were configured but not kept up-to-date, they will be shown but may be useless for recovery.  

In the case of a compromised account, the options may be shown, but if they were modified by the hacker they will be useless for recovery.
If the lost account has 2-step verification enabled (https://gmail.googleblog.com/2011/02/advanced-sign-in-security-for-your.html) the process will be a little different as discussed below. This will also be true if the account was compromised and the hacker enabled 2-stepverification to make it harder to recover the account.

Known Device -
It can't be emphasized enough how important it is to attempt account recover from a known device. A know device would be a computer or mobile device recently used to sign into the account. For recently, think weeks or perhaps a few months. Longer than that and it will have been "forgotten" (no longer recognized).

Previous Password -
The recovery process will often ask for the current or a recent password used on the account. This makes more sense for account recovery cases not due to a lost password. The last password need not to help, but it probably not sufficient to prove ownership all by itself.

Mobile Device -
Account recovery places a high priority on using a mobile device if one is attached to the account. It is considered reasonably secure as it's something physical owned by the user. Mobile verification can take several forms like a tap prompt on the device, or receiving a code on the device that you need to type in. Of course, if the device is lost/stolen/broken/upgraded it can't be used for verification. It's therefore important to make sure the list of devices used on the account is kept current. In Google account settings, see the Security tab, Your Devices.

E-mail Recovery -
Similar to a phone number, the presence of a configured recovery e-mail address holds significance. The process is quite simple: a verification code is sent to the designated address, which you subsequently enter.

Occasionally, in rare instances, the system may dispatch an e-mail verification to the original misplaced account. During such occurrences, Google seems to hold the belief that you are still logged into the account, either on a computer or a device.

Security Question -

In the event that your account has reached a certain age and you have previously set up a security question, there is a possibility that you might be prompted to provide the answer. Although having knowledge of the answer you initially established is beneficial, it alone is insufficient to establish ownership. It is worth noting that if you have enabled 2-step verification for your account, the security question does not seem to be utilized in the process.

Support for security questions has been discontinued for several years. It is no longer possible to add or modify security questions; they can only be removed from accounts.

Contact E-mail -
Occasionally, the procedure may require you to provide a contact e-mail address to which a verification code will be sent. However, receiving this code does not automatically grant you permission to reset the password. The purpose of this step is to confirm that you possess a legitimate and operational e-mail account that you can access. Google may utilize this contact address to communicate the outcome of your account recovery endeavor.

Successful Recovery -

Once you successfully provide satisfactory answers to enough ownership verification questions, Google will prompt you to generate a new password for your account. This password creation may occur either directly at the culmination of the aforementioned process or by means of a link sent to you via e-mail. Regardless of the specific method, once you have created a new password, you will regain access to sign into your account.

Failed Recovery -

In the event that you are unable to provide sufficient answers to prove ownership of the account, Google will not grant its return. This outcome may be communicated directly at the conclusion of the aforementioned process, or alternatively, you may receive an e-mail notification at your designated recovery or contact e-mail address.

While you are welcome to make further attempts, and Google may even suggest doing so, it is important to note that if you are unable to answer additional questions in subsequent attempts, you should not anticipate a different outcome or result.

Lost Account Name -

If you have clicked the "Find my account" link on the initial page, a series of steps will guide you towards generating a list of accounts that correspond to the information you provide.
‍
The following steps will be involved:

1. Enter a previously configured e-mail address or phone number associated with the account.
2. Provide the first and last name registered on the account.
3. Input a verification code sent to the e-mail address or phone number specified in step #1.
Upon successful completion of these steps, you will receive a list of accounts that match the information provided, allowing you to proceed with signing in. If you are also unaware of the account password, you can utilize the aforementioned process to attempt a password recovery.

Accounts with 2-Step Verification Enabled -

Two-step verification serves as an additional layer of security for accounts, requiring an extra action or code alongside the password during the sign-in process. Consequently, account recovery for an account with 2-step verification enabled follows stricter protocols. However, this can pose challenges for the account owner if the account has been compromised and 2-step verification has been enabled by the hacker.

When 2-step verification is active, upon providing your account name and password, you will encounter a third screen where you must input the 2-step verification code via the default method configured on your account. If you are unable to provide the 2-step response, the page will present a "Try another way" link.

At this stage, you may be presented with one or more options, including:-
1. A list of alternative 2-step verification methods, such as the utilization of backup codes.
2. A list of other conventional account recovery options.
3. The standard account recovery process as described previously.
4. An opportunity to provide a contact address for communication after a multi-day delay.

If the provided proof of ownership is deemed insufficient, Google will display a message similar to the "Google couldn't verify..." message seen in the standard account recovery process mentioned earlier. However, if the information provided is deemed sufficient for Google to conduct further investigation, a message indicating such will be displayed.

Once Google has concluded its investigations, which typically take 3-5 business days (approximately a week in real-time), you will receive a notification at the contact address you provided. For more details about the potential delay, you can refer to the information provided in the link: https://support.google.com/accounts/answer/9412469.

If your request is denied, your only option is to repeat the process by providing additional or more accurate answers to the questions. Simply reattempting the process with the same answers will not yield any progress. It is crucial to provide additional proof of ownership, as Google will not return the account without it.

It is worth noting that you have the option to create and use passkeys for your personal Google Account. By doing so, Google will not require your password or 2-Step Verification (2SV) when signing in.

For more information on passkey creation in Google, you can refer to the following links:

https://sites.google.com/view/how-do-i-create-passkeys-on-go
https://g.co/passkeys
‍https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html.

Workspace account:-
‍
Regarding Workspace accounts (formerly G Suite or Google Apps), which are accounts not ending in "@gmail.com," you may be given the option to follow the standard account recovery procedure. Alternatively, you will need to contact the Workspace administrator for the respective domain, as they have the ability to reset the password and facilitate account access restoration.

Additional recovery hints and tips:

Factors you can control before the account is lost:

1. Account password -
Write it down and keep it in a secure place to avoid forgetting it.
2. Record keeping -
Keep a record of your password in a safe location to easily retrieve it if needed.

Recovery options:

3. Configure alternate e-mail and phone -
Set up alternate e-mail and phone information for account recovery purposes.
4. Keep information up-to-date -
Regularly update your alternate e-mail and phone details to ensure they are current.

Backup measures:

5. Generate backup codes -
If you have 2-step verification enabled, generate and save backup codes in a secure location.
6. Store backup codes separately -
Avoid storing backup codes on the same device used for 2-step verification.
7. Configure Recovery options -
Set up recovery options such as alternate e-mail and phone for all your accounts.
8. Keep information up-to-date -
Ensure that your alternate e-mail and phone details are current to receive the SIX DIGITS Recovery Code.

Backup codes:
‍
9. Generate backup codes -
If you have 2-step verification enabled, generate a set of ten backup codes and store them securely.
10. Store backup codes safely -
Avoid keeping backup codes on the same mobile device used for 2-step verification to prevent loss in case of device issues.

Factors you can control during account recovery:

11. Provide accurate past password -
Use the most recent password you can remember accurately. Google does not store readable versions of passwords, so it must be 100% correct to match the account's password history.

Security question:

12. Answer accurately if applicable -
Although security questions are no longer supported, if you have one on your account, provide an accurate answer if prompted. Note that the answer must be precise, not just close.
By following these recovery hints and tips, you can enhance your chances of successfully recovering your account and regaining access.
‍
Information about known access types:
Factors you can control during account recovery - details about the questions asked and how to answer them.

Known access type -
Google has made it clear that doing account recovery in the same way the account was normally accessed will help a lot with recovery. Google hasn't clearly documented what all they use, but empirical evidence suggests it's some or all of the following:
1. Browser (perhaps related to saved cookies).
2. The physical computer or mobile device. If you use an e-mail app/client, then use a browser on that same physical device to attempt recovery.
3. Physical location. If you always accessed the account from a specific location (home, work, etc.), then do recovery from that same physical location.
4. IP address. Similar to the physical location, although IP addresses can and do change regularly.
If the account was used regularly on multiple devices, try the account recovery process from each of them.
By considering these known access types and attempting account recovery from the same browser, physical device, physical location, and IP address, you can improve your chances of successful account recovery.
‍
When describing your issue or providing additional information during the account recovery process, it's important to include relevant details that Google can verify. Here's a breakdown of what to include and what not to include:

What to include:

1. If you still have access to the account, specify the type of access (mobile, browser, etc.) you currently have.
2. Explain why you lost access to the account, such as a compromised account, lost password, 2-step verification lockout without backup codes, "Unrecognized device" or "Something unusual" challenges, or other security challenges that didn't work.
3. Provide any additional past passwords that you remember accurately.
4. If the account creation date was never asked for during the recovery process, mention it if you know it.
5. Share the last time you successfully logged into the account.
6. List the devices (computers or mobile devices) that were used with the account.
7. Mention the locations (country and city) from which you accessed the account.

What not to include:

1. Avoid including any information that requires account access to verify, as Google employees do not have access to user account contents for privacy reasons.
2. Do not include details about the linkage or usage of your email on other accounts/sites you own, such as Facebook, PayPal, etc.
3. Avoid including anything that might prove your personal identification, like a government ID. Proving your identity does not prove ownership of a specific account.
Remember, only provide information that Google can verify based on account access history and server logs. Including relevant and verifiable details will help increase the chances of a successful account recovery.
‍
Factors you cannot control during the account recovery process are crucial as Google possesses a wealth of information about user accounts on their email servers.

While Google doesn't explicitly disclose all the details, we can make educated guesses about some of the factors they likely consider:
1. Locations where the account has been accessed in the past:
Google keeps a record of the geographical locations from which the account has been accessed, providing valuable data for verification purposes.
2. Devices, computers, browsers, clients, and apps used to access the account:
Information about the devices, operating systems, browsers, email clients, and apps utilized to access the account can help establish ownership.
3. Types of account access used:
Google likely takes into account the different methods of accessing the account, such as web access, IMAP, POP3, mobile devices, and other protocols.
4. History of account recovery claims:
Google maintains a history of previous account recovery attempts, including when and where they were initiated, the device used, and the location. This information is relevant for assessing the legitimacy of the current recovery request and detecting any suspicious activity.
5. Current access types and account usage:
If an account has been compromised and is being used by an unauthorized party, Google can monitor the current access types and usage patterns to identify any irregularities.
It's important to recognize that these factors are just a glimpse of the information Google has access to. They leverage this knowledge during the account recovery process to validate ownership and ensure the security of user accounts.

When engaging in the account recovery process, there are several logistical considerations to keep in mind. These factors can significantly impact the success and efficiency of the recovery:

1. Improve your answers with each attempt:
The goal is not to repeat the account recovery process multiple times but to provide more comprehensive and accurate answers with each submission. If your initial submission is rejected, focus on gathering additional information and enhancing the accuracy of your responses in subsequent attempts. Repeating the process without new or improved information is unlikely to yield positive results.
2. Wait for a response before reattempting:
It's essential to exercise patience and wait for a response from Google before submitting a new recovery request. If the estimated response time is 1-3 hours, consider waiting until the following day to allow ample time for a reply. Similarly, if the estimated timeframe is 3-5 business days, which translates to a full week in real-time, it may be beneficial to give it an extra day or two before initiating another submission.
3. Check your Spam or Junk folder:
Ensure that you regularly check your Spam or Junk folder in the email account specified for replies from Google. Sometimes, legitimate responses may end up in these folders. Also, verify that you are checking the correct account, the one you verified with a code in the last step of the recovery process. If you provided multiple email accounts during different attempts, it's important to check all of them for any potential responses.
4. Avoid duplicate submissions without waiting:
Submitting multiple recovery requests without allowing sufficient time for a response can trigger a submission lock. This means you may have to wait a few days before being able to try again. To avoid this, refrain from submitting duplicate requests before receiving a reply from Google.
5. Avoid guessing at answers:
Guessing answers, such as the account creation date, is likely to be recognized by Google and can impede the progress of the recovery process. It's best to provide accurate information based on your knowledge or try to locate the specific details before submitting your answers.

By considering these logistical issues, you can optimize your chances of a successful account recovery and minimize any potential setbacks or delays.
‍
In addition to the account recovery options mentioned earlier, there is another potential method for simple password recovery if you have forgotten your password and your account hasn't been compromised.

If you have set up your browser to remember your account information, you may be able to view your saved password. Both Firefox and Chrome offer the ability to view saved passwords in plain text. If you are using a different browser that doesn't have this feature, you can install Firefox or Chrome, import your settings, and check if the saved password is accessible. This method is applicable only to those who have relied on the browser's auto-fill function and have forgotten their password. It can be a more convenient option compared to the previously mentioned procedures.
‍
For additional assistance with completing the account recovery steps, you can refer to the Google help article titled "Tips to complete account recovery steps": https://support.google.com/accounts/answer/7299973This resource provides further guidance and tips to help you navigate the account recovery process effectively.