“2025.1 Update” I’m now able to sign back into my Google Account, though there are still all kinds of weird issues. But I think I’ve more or less figured out how Google Account risk management works. Let me share a few takeaways.

  • How to break the endless account recovery loop: In one word: wait. If you simply can’t sign in no matter what you do, there’s a good chance your IP address or even your Mac address has been flagged as high risk. In that case, that particular computer may be unable to sign in no matter what you try. In my case, after waiting about a month, the repeated verification loop on my desktop finally stopped. Once the recovery verification finished, Google asked me to change my password, and after that I was able to sign in on that computer again.
  • Getting forced into recovery again on another computer: Here’s the strange part: after I resolved the verification issue on my desktop, I had to sign back in on my laptop too because I had changed the password on the desktop. But on the laptop, Google again made me go through account recovery, and it even asked me to change the password again. After I did that and went back to the desktop, it wanted me to go through recovery there again too. I still haven’t fully solved this, and for a while I was planning to just leave the account signed in on one computer only. Update: after adding a phone number and verifying the account by phone, I was finally able to sign in on both the desktop and the laptop.
  • Signing in through built-in email apps: Previously, even when I couldn’t sign into the web version of my Google Account on the desktop, Gmail in Office 365 could still receive mail normally. However, after changing the password, I had to sign in again there too. So a quick warning: if the web version gets locked, don’t rush to change your password. At the very least, keep one access point alive if you still can, and wait until the account risk level comes down before making more changes.
  • About Google’s risk controls: First, this appears to be handled entirely by automated systems. I searched around online and didn’t see anyone successfully getting customer service to manually unlock an account. So the more you understand how the system is assessing your account risk, the better your chances of getting access back. I found a few things that seem to reduce risk significantly. The first is adding a phone number. After I added one, the built-in Mail verification on my Mac—which previously could not sign in—prompted me for a text verification code instead. Once I entered it, there was no more recovery loop and the account was added successfully right away. So I strongly suggest adding and verifying a phone number. Also, Macs have a built-in fingerprint sign-in option. You can turn that on, and when verifying your Google Account, it may let you use your fingerprint instead, which can also help avoid getting stuck in the repeated email recovery loop.
  • Sign in from familiar locations: Usually that means a familiar IP address and a regularly used device. But if you use a VPN, you may not be able to keep the IP address consistent, so I’d suggest reducing account risk in other ways.

To sum up, if your Google Account gets locked, here are a few things you can do:

  • First, check whether you can still sign in on any other device you use regularly. If you can, don’t panic—wait about a month before trying again on the device you actually want to use. If not, then check whether Gmail is still connected through Office 365 or your Mac’s built-in Mail app. If mail is still coming through normally, then there’s no need to rush to fix the lockout immediately.
  • If you can still sign in on a regular device, consider adding more secure sign-in options, such as a phone number or fingerprint sign-in, since both may help reduce risk.
  • If something unusual happens, wait it out. Don’t keep trying things or repeatedly run account recovery, because that may keep increasing the account’s risk level and could even lead to all of your devices getting blocked.
  • If you’re locked out on all devices, my suggestion is to wait about a month and then try again.

Google Account locked, and email stopped working too

Then the most frustrating part happened. I was booking a hotel a couple of days ago and accidentally used an expired credit card that Google Autofill had saved earlier. After I selected it, Google said the card had expired and asked me to re-enter the expiration date and CVV. I pulled out the card I had on hand—I’m not even sure whether it was the exact same one—entered the new expiration date and CVV, and that part went through. But when I tried to check out, Google flagged it as risky, wouldn’t let me pay, and sent me an email about it, which I didn’t read at the time. I then manually entered the card number, expiration date, and CVV for a new card on the payment page, and the payment went through successfully with no risk warning at all, which shows the card itself was perfectly fine. The next day I noticed Chrome needed identity verification, and then I checked the email from the day before, which said my account had serious security risks.Then I wanted to see what exactly the suspicious activity was. If you’re going to tell me there’s a risk, at least let me see what it is—but of course I had to sign in first before I could see any of thatAfter signing in, Google then told me I needed to recover my Google AccountFine, I thought—I’ll just go through the steps. But after entering my recovery email and the verification code I received, it said verification would take 48 hours, and that during those 48 hours a sign-in link would be sent to my recovery email. Unbelievable. And during that time, all Google Account-related services were unusable. Including Gmail. Including Gmail. Including Gmail.And “check status” just meant refreshing the exact same page againA reminder: during this period, do not try signing into your Google Account again. Otherwise, the recovery process can be canceledI’m guessing sites where you registered or signed in using your Google Account also won’t work during this period.

My advice

It really is convenient to keep everything under one account, and I do believe Google’s autofill security, encryption, and risk controls are generally pretty solid. Still, I’d strongly recommend separating your everyday essentials from your financial information. Having a credit card issue trigger risk controls across your entire Google account—and then losing access to everything, including Gmail—is just way too disruptive. Going forward, I’m going to use my Google Account mainly for email and address autofill. For credit cards, I’ll just keep track of them myself. Even the card issuer had no problem with the card, and it continued to work normally, so I really don’t know what made Google suddenly freak out. I’ll post another update after I get everything fully unlocked.