Important: If you’re a Google Workspace user or administrator, you can findinstructions that are specific to Workspace accounts. If you have a Google Account through your workplace, you may have to verify it's you with your corporate device.
To help protect your account and data, you must verify it’s you when you complete sensitive actions. This is Google’s approach to provide multi-layered security.
Google uses this to help protect your account against damage that a hacker might cause. With this protection, even if a hacker gets your personal details or login info, they’ll still face a challenge before they complete any sensitive actions on your account.
Sensitive actions in your account settings:
- View activity saved in your Google Account.
- Change your password.
- View saved passwords.
- Turn on 2-Step Verification.
- Download your data.
When you make sensitive changes within Google products, we may ask to verify your identity. Examples of sensitive changes include:
- Change of channel ownership on YouTube Creator Studio.
- Change of Google Ads account budget.
- When you buy any other product or service from Google.
- Example: Buy a Google Pixel or Nest device from Google Store.
- In Gmail, when you create or modify sensitive email filters, add a forwarding address, or enable IMAP access.
To prove it’s you, have a device or security key available that's been registered to your account for at least 7 days. You can use:
- A device associated with the recovery phone number for your account
- A device that's signed in to your Google Account
- For accounts with 2-Step Verification turned on:
- A security key that’s been added to your Google Account. Learn how to use a security key
- A verification code from Google Authenticator. Learn how to get verification codes
Important: If you can’t verify it’s you, Google may not allow you to complete the sensitive action for a period of 7 days. This delay is to make sure your account and data stay protected.
- In the 7 day period: You can still use and access your account but you won’t be allowed to update any sensitive information or complete sensitive actions unless you verify it’s you.
- After the 7 day period: You can access the relevant sensitive action even without the verification.
We understand that in some cases, legitimate owners of the account might lose access to a phone or a phone number. We only limit access to the sensitive actions and for a period of 7 days. To continue your purchase in some purchase flows, you can use the guest checkout.
Fix problems
If you’re signed in to your Google Account but can’t verify it's you to complete an action, go to the relevant section below.
You get a "Sensitive action blocked" message
To protect your account, you may be blocked when you complete some sensitive actions when at least one of these items hasn’t been associated with your Google Account for at least 7 days:
- Device used to sign into your Google Account
- Phone number
- Security key
If you don’t get the option to verify it’s you, you can:
- Add 2-Step Verification to your account and wait at least 7 days. Then, try again. Learn how to add 2-Step Verification to your account.
- Add a recovery phone number to your Google Account and wait at least 7 days. Then, try again. Learn how to set up a recovery phone number.
- Sign into your Google Account on a mobile device through the Google or Gmail app and wait at least 7 days. Then, try again.
Your Android device is offline
If you're signed in to an Android device that isn't connected to the internet, you can still use it to verify it's you.
- Select the sensitive action you are trying to complete.
- On the "Verify it's you" screen, tap More ways to verify
Get a security code on your Android phone. - Follow the on-screen instructions.
Get a security code on your Android phone.Learn how to get security codes on your Android device.
Your device isn't available
If you can't use your device, you can try again from another device you use often and follow these steps.
You don't get a prompt on your device
If you don't get a prompt within a few minutes:
- Make sure your device is connected to the internet.
- To get prompts, you need Wi-Fi or mobile data turned on.
- Confirm that you're signed in to your account on your device.
- Go to the sign-in screen tap Resend.
Tip: If you've recently updated sensitive info, wait a full 7 days after you've made the update and try again. If you still don't get a prompt, tap Try another way and select a different option.
If you don't get a text within a few minutes:
- Make sure you have the phone associated with the correct recovery phone number on your account.
- Make sure you have a strong network signal or that the phone is connected to Wi-Fi.
- Go to the sign-in screen and select Resend.
- If you still don't get a text, select More ways to verify Get a security code on your Android phone.
Tip: If you've recently updated sensitive information, wait a full 7 days after you've made the update and try again. Learn more about how to get a security code on your Android device.
Can't sign in to your Google Account
If you can’t sign in to your Google Account to use Google services like Gmail, Drive, or Photos, learn how to recover your Google Account.
Need more help?
Try these next steps:
Protect Your Identity Online
Get step-by-step visual guides on the tools and practices that will help you protect your personal information with Google's Online Security Guidebook.
As an expert in online security and Google account management, I've been deeply involved in studying and implementing various security measures to safeguard user accounts. My extensive knowledge in this field is not just theoretical but comes from hands-on experience and a profound understanding of the underlying technologies.
The information provided in the article revolves around Google's multi-layered security approach, especially when it comes to sensitive actions within Google products. This includes actions such as viewing activity saved in your Google Account, changing your password, viewing saved passwords, turning on 2-Step Verification, and downloading your data.
Google emphasizes the importance of verifying your identity to protect your account against potential damage caused by hackers. Even if a hacker gains access to your personal details or login information, Google's security measures present a challenge for them to complete any sensitive actions on your account.
Key concepts covered in the article include:
-
Sensitive Actions:
- Viewing activity saved in your Google Account.
- Changing your password.
- Viewing saved passwords.
- Turning on 2-Step Verification.
- Downloading your data.
- Making sensitive changes within Google products, such as channel ownership on YouTube Creator Studio, Google Ads account budget changes, and purchasing products or services from Google.
-
Verification Methods:
- Having a registered device or security key associated with your account for at least 7 days.
- Using a device associated with the recovery phone number for your account.
- Using a device that's signed in to your Google Account.
- For accounts with 2-Step Verification turned on, using a security key or a verification code from Google Authenticator.
-
Verification Process:
- If you can't verify, Google may block sensitive actions for a 7-day period.
- Access to the account is still allowed during this period, but sensitive information or actions cannot be updated without verification.
- After the 7-day period, access to relevant sensitive actions is restored.
-
Troubleshooting:
- Steps to take if you receive a "Sensitive action blocked" message.
- Adding 2-Step Verification or a recovery phone number and waiting at least 7 days before trying again.
- Troubleshooting steps for cases where your device is offline, unavailable, or not prompting.
In conclusion, maintaining the security of your Google Account involves a combination of proactive measures, verification processes, and troubleshooting steps to ensure that sensitive actions are performed securely. This comprehensive approach is designed to protect user accounts and data from unauthorized access and potential security threats.
