Google adds extra verification for Gmail settings to prevent email hijacking

Google has announced that it will add an extra verification step when users try to perform certain sensitive actions in Gmail, such as adding a forwarding address or editing filters. The new feature is intended to prevent unauthorized access to users’ emails and accounts. “Last year, we introduced stronger safeguards around sensitive actions taken in your Google Workspace accounts. We’re extending these protections to sensitive actions taken in Gmail,” Google said in a blog post.

According to Google’s blog post, the extra verification will be required for the following scenarios:

– Filters: creating a new filter, editing an existing filter, or importing filters.

– Forwarding: Adding a new forwarding address from the Forwarding and POP/IMAP settings.

– IMAP access: Enabling the IMAP access status from the settings. (Workspace admins control whether this setting is visible to end users or not)

If Google detects a risky action, it will prompt the user to verify their identity before proceeding. If the verification fails or is not completed, the user will receive a critical security alert to notify them of the potential breach.

The additional protection will be available to all Google Workspace customers and people with personal Google accounts. However, Google notes that “this feature only supports users that use Google as their identity provider and actions taken within Google products.” This means that users who sign in with third-party providers or use external email clients may not benefit from this feature.

Google introduced a similar verification prompt for “sensitive actions taken in your Google Workspace account” last year. The company says that this feature is part of its ongoing efforts to enhance security and privacy for its users.

Meanwhile, Google on Saturday sent emails to its billions of users, saying the company updating the inactivity period for a Google Account to two years across all its products and services. This change starts rolling out now, and will apply to any Google Account that’s been inactive, “meaning it has not been signed into or used within a two-year period”. An inactive account and any content in it will be eligible for deletion from December 1, 2023, the tech giant said.