That Time I Hacked My Own Gmail Account

Preface: Because this post deals with a topic for which I don’t really have pictures, I decided to spice it up with photos of animals.

For years, all I have wanted is an email address that is [firstname][lastname]@gmail.com (or my own domain, but I’ve been too lazy to set that up).

You see, back on September 4, 2004, when I created my first Gmail account (when Gmail was still in beta testing and you had to be invited, because I’m so 1337), we still believed in internet anonymity. Most people were not using the [firstname][lastname] convention; most were simply migrating over their old AOL/AIM handles. However, having created my meowzer18 AOL screen-name at age 8, I couldn’t possibly keep that dream alive as a 17-year-old. I settled for my name and a random number, and thus my first Gmail account was born.

But as times changed, we collectively decided that we wanted to be able to be found on the web. As social media crept into our lives, we wanted our friends to find us (and be able to tag us appropriately in an inappropriate amount of questionably appropriate photos, duh!), and as email became more important to our job searches, we began creating email addresses that reflected our real names. (And though we’re slowly starting to desire a bit of anonymity again, most people maintain a [firstname][lastname] email address for professional purposes.)

Of course, when I finally saw the need for a more professional email address, the other Carly Roaches of the world had already taken carlyroach@gmail.com. I created a few variations of my first and last names just to have something more serious to use on job applications, but everything I came up with required a number to be unique — something that I detested. Having a number in your email address had gone out of fashion. No one takes you seriously if you are jonsnow1@gmail.com. It looks like you weren’t forward-thinking enough to jump on the email train early and ensure your rightful [firstname][lastname] address. Sure, I could have gone to Yahoo or AOL or Hotmail, but everyone knows that your email address domain reflects your computer skills, and I couldn’t risk looking like a n00b.

I knew my only option was marriage.

Dobby, Peanut, and their cousin Arya

Embarrassing as it is to admit, I was so driven by my desire for a [firstname][lastname] email address that I created a new email address every time I dated a guy who might be “the one.” Let’s just say I have many an abandoned email address based on past, unsuccessful relationships. Sensing a pattern (date guy + make email address = get dumped), and also knowing that no one in the entire world would ever be named Carly Hublou, I put off creating an email address when I met Kevin until we were engaged, reasoning, as most sports fans do, that something irrelevant that I was doing was affecting the outcome of my relationships. (It doesn’t matter if you wear your lucky socks, sports fanatics; you do not affect the outcome of the game!) I didn’t want to jinx this relationship with my unlucky email-address-making!

I say all that to make my point: I saw carlyhublou@gmail as something I had earned and something that I needed. Changing my name was so much more exciting knowing that I would finally enter the ranks of those with the [firstname][lastname] email-address scheme that I had coveted for so long (11 years, to be exact). I would do anything to protect it, and I would be devastated if I lost it.

Fast forward to June 2, 2016.

In addition to my original and married-name email addresses, I have many other Gmail addresses (because reasons). But I don’t check them all; that would be crazy. I stay signed in to my main account and simply have all of my other addresses forward the mail they receive to the inbox of that main account. Usually, I also tell Gmail to delete all copies of incoming emails from the other accounts after it forwards them to my main account. This way, I’ll never reach my storage limit on these accounts that I never check.

But on June 2, as I was doing some maintenance on my beloved carlyhublou account, I noticed that Gmail had not been deleting the emails in this inbox. I had thousands of emails taking up quite a bit of space. I checked my settings, fixed the problem, and decided to delete everything in my inbox to save space and because I had copies of it all in my main inbox.

Hindsight is 20/20, but looking back, this was a very stupid thing to do.

Here’s a hawk that lands in my backyard sometimes. Probably large enough to carry away Dobby.

Why?

Because Google thought I was a hacker.

It’s not uncommon for hackers to steal users’ accounts, immediately change the password and set up two-factor authentication to keep the rightful user out, and then do asinine things like delete all the emails from an inbox (perhaps after gathering whatever information they may have wanted from your emails).

So when Google saw that thousands of emails had been deleted in a matter of seconds, it disabled my account.

Not locked. Not suspended. Disabled.

“No big deal,” I thought. “I’ll just walk through the recovery process.”

But to recover a Google/Gmail account, you have to be able to verify your identity to a computer — a computer that you can’t plead with or reason with. It knows what answers it needs, and if you don’t provide them exactly as it is expecting to receive them, you’re simply not the owner of that account. To recover a disabled account, you need:

  • The last password you remember having for the compromised account.
  • The date of the last time you were able to log in.
  • The date when you created your account.
  • Five frequent contacts (and these should be contacts to whom you’ve sent mail and from whom you’ve received mail).
  • Four labels you created (not the defaults).
  • Knowledge of all of the other Google services this account has used (e.g., Google Calendar, YouTube).

And you have to match precisely what the computer expects as input. No wiggle room.

Providing this information was problematic for me. Because carlyhublou is an email address that I don’t use via its actual inbox (I receive and send emails for it through my main Gmail account), I never created labels for it, I never used other services with it, and I had never technically contacted anyone with it. (Sending email as carlyhublou via my main Gmail account adds those recipients to the frequently contacted list for my main account, not for carlyhublou.) Despite submitting the form at least 20 times, the computer didn’t believe I was me.

“That’s OK,” I thought. “I’ll call Google’s help desk.”

EXCEPT THERE IS NO GOOGLE HELP DESK.

That’s right; one of (if not the) biggest tech company in the world has no user support (unless you are a Google Apps paid user). I even called Google’s main number, listened carefully  (as their menu options had changed), and found myself listening to an automated man telling me that I can only unlock my Gmail account by completing the account-recovery process.

Now, I understand. Google has millions of users. It’s not probable to staff a help desk to support a user base of this magnitude. Google’s solution is to provide an internet help forum, which is moderated by non-Google-employees who have somehow risen through the ranks of the forum to achieve the status of super loser user. They answer questions and also have access to Google employees if they can’t solve the problems themselves.

The very best friends.

But if you read through the Gmail forum, you’ll see that most users post to complain about the same problem I was having: their accounts got disabled for one reason or another and the account-recovery process isn’t working. Most times, there is no help for these people; they are told their accounts are lost forever, or they are provided a link to a blog that someone created to walk others through the recovery process.

Those are the only options.

(Dear Googs: If that many users are experiencing the same problem with your only option to recover their accounts, perhaps the process for recovering accounts is flawed. Love, Carly, beta tester circa 2004)

Think about it: What else in your life is that secure? Not even your credit-card account is that secure. You can recover a credit-card account by giving a human the last four of your Social Security number and the answers to a few not-so-difficult-to-hack-if-you’re-really-trying security challenges. That doesn’t even come close to the level of scrutiny programmed into Google’s account-recovery process.

Having exhausted my options, I called Kevin, nearly in tears.

Why was I in tears over an email address? Part of it was because I had waited so long to have this email address and now I might never have it again. Part of it was because this was the address through which most of my professional communications took place, and I did not want to have to send that email of shame: “My email address has been disabled and I cannot retrieve it. Please update your records with my new one.” (How embarrassing!)

And part of it was that I realized how much I relied on Google — on one company — just to function every day. Between Gmail, Google Calendar, and Google Drive, a huge chunk of my life belongs in the Google suite of services. How uncanny it felt to have part of my internet identity so abruptly revoked and not be able to get it back. It was a partial glimpse into what life might be like if my real identity were to ever be stolen. I felt lost and helpless.

I called Kevin for emotional support. As he listened to me describe the day’s events to him, he gawked at the ridiculousness of Google’s user help solution. And then from his mouth — er, the phone speaker — poured the most beautiful, romantic words he’s ever uttered to me: “I’ll call Google directly.”

Kevin will be upset if I end this post without a picture of his beloved bird.

To make a long saga shorter, Kevin used a little wizardry (i.e., his sys-admin powers) to find a human at Google and alohomora my account.

As the dark skies over my first-world problems cleared, I felt eternally grateful for all the wonderful things in my cyber life, like Google Play Music curated playlists, the fact that I can add 2GB of storage to my Google Drive each year by completing a security check, and how Gmail adds events to my Google calendar when it senses dates in emails. Google had treated me like a boyfriend who says, “I want to take a break,” and then decides that he really does want to be with me after all (which is never how that story actually goes, by the way), and I felt no shame in running back to its login page.

After the makeup, I got down to business. Google had Scrooged me, and it was time to make sure this never happened again. So, for all of my Google accounts, I made sure I could answer all of those bullet-point criteria I listed above. I created four labels, found the dates the accounts had been created, turned on two-step verification, sent emails to my other accounts so that I would have frequent contacts, etc.

And then I slept soundly that night knowing I wasn’t stuck in another super-depressing episode of Black Mirror.