Ask HN: I'm a small business and Google locked me out
90 comments
A few years back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it. I tried to go through the appropriate support channels more than once. Filled out extensive forms, even identified recent emails like they asked, to no avail. It was very disappointing, considering I had spent a good amount of money purchasing apps/ games etc. with that account. What a waste.
Unless you get rescued here by a personal favor of a Googler, I would imagine that account is good as dead.
Unless you get rescued here by a personal favor of a Googler, I would imagine that account is good as dead.
Do you still use Google?
Haha, no I have almost completely removed myself from their grip. I still use a couple accounts, but they are not primary. Only throwaway purposes, and the only app I use with them is gmail. All activity settings and history are turned off and cleared.
I have an iPhone now. I should probably go ahead and cut ties with the throwaway gmails, not serving much purpose now.
I do find it hard to stop using Google maps and Waze. But I use maps without logging in, not sure it makes a difference though.
I have an iPhone now. I should probably go ahead and cut ties with the throwaway gmails, not serving much purpose now.
I do find it hard to stop using Google maps and Waze. But I use maps without logging in, not sure it makes a difference though.
2 factor authentication (w/ security tokens, mobile "apps" etc.) comes with an inherent risk of getting locked out of stuff. Most of the time you can mitigate that risk by generating "recovery" codes in advance, but it's still something to be aware of.
While true, this is more of a Google problem than a 2FA problem.
Google will lock you out of your account even without 2FA if it cannot recognize you. It happened to me on a Google Apps account that does not have 2FA.[1] Customer service should be present to handle edge cases.
[1] https://news.ycombinator.com/item?id=21168834
Google will lock you out of your account even without 2FA if it cannot recognize you. It happened to me on a Google Apps account that does not have 2FA.[1] Customer service should be present to handle edge cases.
[1] https://news.ycombinator.com/item?id=21168834
Yeah for sure, It was kind of my fault. It all happened very quickly, I think 2FA was relatively new at the time. I kept getting ‘recommendations’ from Google to enable it to be more secure.
As a dutiful user I obliged, and downloaded the authenticator app. I think it gave me 10 one time recovery codes, but of course I didn’t back them up externally :)
I was having some performance issues with my Samsung phone at the time, and a couple days later, did a factory reset. Then when it came back on and I tried to log into my google account, my stomach sank to the floor when I realized I could not get in without the authenticator app.
That was that. Everything gone. What an idiot :) Couldn’t even get on through a computer without the stupid codes I could no longer generate. Answered all the questions, identified specific emails, personal info etc. Google was not impressed.
As a dutiful user I obliged, and downloaded the authenticator app. I think it gave me 10 one time recovery codes, but of course I didn’t back them up externally :)
I was having some performance issues with my Samsung phone at the time, and a couple days later, did a factory reset. Then when it came back on and I tried to log into my google account, my stomach sank to the floor when I realized I could not get in without the authenticator app.
That was that. Everything gone. What an idiot :) Couldn’t even get on through a computer without the stupid codes I could no longer generate. Answered all the questions, identified specific emails, personal info etc. Google was not impressed.
I think at core it is their fault for letting users pick a single software 2FA method without a second device, its a poor design choice.
Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too.
This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.
Asking users to print backup codes shouldn't count, it needs to be a second device. It is a bad fallback method especially because you can't force users to do it, but you still have to deal with the fallout later. While we are at it, if you're printing codes, you might as well print your passwords too.
This is why hardware tokes are a world better than software based...multiple hardware keys are required, you can't choose to not back it up, although what you do with that second key is critical too but its easier to track than a slip of paper.
> I kept getting ‘recommendations’ from Google to enable it to be more secure.
Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.
Yes, this is problematic in itself. Hardware-based 2FA is not an unqualified win; I definitely would not want to use it without some very robust contingency plans of what to do if my authentication device gets bricked or otherwise malfunctions.
Agreed. The whole app based 2FA does not seem great in retrospect. I accidentally bricked my whole account, by simple user error. That’s a good point, that it could just happen from a hardware malfunction as well.
Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.
Seems like most 2FA these days is based on the service sending you the code by text or email. Sounds like a much better approach.
>A few year back, I got locked out of my primary gmail account due to a 2 factor authentication SNAFU. I was never able to recover it.
This is the downside (or hidden cost) of 2FA that most security experts purposefully ignore, because they work for companies like Google and only care about account security rather than user security.
This is the downside (or hidden cost) of 2FA that most security experts purposefully ignore, because they work for companies like Google and only care about account security rather than user security.
I did a 2FA system a while back.
The happy login path and crypto work took a couple of days, and the mobile app work was similarly easy. Probably 80% of the effort was working through account recovery and other support-related issues.
The happy login path and crypto work took a couple of days, and the mobile app work was similarly easy. Probably 80% of the effort was working through account recovery and other support-related issues.
Why does everyone seem to be glossing over the fact they said 'suspended for nonpayment'?
And it doesn't seem like they're trying to pay their bill, but just get that one email out of the account...
Maybe google isn't in the wrong here.
And it doesn't seem like they're trying to pay their bill, but just get that one email out of the account...
Maybe google isn't in the wrong here.
Maybe that one email is the login info to their bank?
There are other avenues to deal with your bank.
Those avenues tend to involve being physically present at some bank branch (or perhaps an ATM). Something that's not really feasible in the time of Corona.
I mean, maybe? I call my banks to do all manner of things all the time.
Please email me (email in profile) and I will try to get you support internally.
All: it's understandable that commenters react with generic indignation about how things shouldn't work that way, but please let's not pile on a user who's trying to help another user. It stacks up into the wrong incentive. After doing this once or twice and running into a buzzsaw of protest, who would want to it again?
Also, these comments appear mechanically and interchangeably every time the topic comes up, which means they're not the greatest for intellectual curiosity (https://news.ycombinator.com/newsguidelines.html).
Also, these comments appear mechanically and interchangeably every time the topic comes up, which means they're not the greatest for intellectual curiosity (https://news.ycombinator.com/newsguidelines.html).
HN is the only place you can get Google support. Thanks for the effort, but you guys should seriously fix that, and not by shifting into your "let's automate this and do it smarter" mindset. It does not work.
I don't know why they can't just hire a bunch of people to take care of stuff like this, like this is so ridiculous that I'm pretty sure someone could make a successful start-up to pay Googlers to enter internal tickets on behalf of people having issues with Google accounts/services.
It’s obvious that Google doesn’t want to incur the cost of client support staff.
They're ruining so much goodwill that they've built up over the years by cheaping out on customer support that even customer hostile companies like Comcast do better.
I'm sure that lots of people would be happy to pay good money for plenty of support issues if that meant not having to use the terrible Google help pages and issue forms, and not having to wait a week or ten for a response.
Agreed. It's the main reason why I've refrained from using Google for business activities, otherwise it would be a no-brainer. If something breaks, I need to be able to call or email someone and receive a response within 24 hours. Anything else is just not tenable from a reliability perspective.
If you use Google services for business activities you‘d presumably pay for a support tier. For the consumer side I suspect, with over 2 billion users, it‘s pretty much impossible to offer human support at scale. That‘s not even taking into account malicious actors that would use the support as an attack vector. I might be mistaken. Is there an example of a company with that big a user base which offers human support for everyone?
I suppose you can argue users vs customers, but Amazon does a much better job. Their support isn't perfect, it's off-shored, but it's still good enough for most purposes, I think.
This user is explicitly not paying for that old account. If you do pay for an account, you can get slightly better support.
But the account in question is closed for non-payment.
But the account in question is closed for non-payment.
They can afford it, they just don't value it. If your org thinks this way, then Customer Support will not be a place where your best people end up (this goes for all levels in the organization). Consequently, if the CS department does not have the respect or mandate from top-management, the other departments will ignore issues that CS brings up and it will be even less empowered. And Google already has tech abandonment issues that make support super difficult. Google support employees: I feel for you.
Compare this with Amazon that publicly claims placing customer service above all else. At least if you work in CS there, you have the feeling that you are always a fundamental part of the company.
Compare this with Amazon that publicly claims placing customer service above all else. At least if you work in CS there, you have the feeling that you are always a fundamental part of the company.
To add some more context: for every successful person that reaches Google via social shaming, there are hundreds of cases of people that are not heard. I don't know how to fix this problem at your scale (a gigantic problem), but as I understand it, there is something wrong in your value system which rewards innovation and engineering experience much more than customer satisfaction.
Hold on. I'm an admin on a few paid GApps things. One got locked out, removed me, switched phone numbers, made a mess. Then owner hit me for help, I went through the channels with G and we were back on in a few hours/next day. This was only three months ago. The process was largely automated, IIRC there was one 15 minute call.
Sure, documentation & automation works for the majority of cases. The problem is with the other cases where you hit a wall and have no way to talk to a customer service rep to get your issue resolved.
So I'm clear: we hit walls using the normal process. It was abnormal from my prior experience too. Then it was escalated and a CSR called me. Then the issue was resolved.
I disagree specifically with the "no way to talk to" part.
I disagree specifically with the "no way to talk to" part.
To your point though, until some automated system escalated your case, there was no way to talk to. Assuming another user doesn't trigger this escalation, then they are stuck. I'm glad your experience was better, don't get me wrong.
Yea, thats true. The owner reached me cause I'm good a pressing buttons on websites. And I had to press a bunch before we got to the human. The process for non-technical humans is not easy (those would also be the most expensive calls)
Point taken! I'm basing my point on a single negative personal experience from long ago (as a paying customer) as well as seeing similar posts over the years on HN. It's certainly possible that Google has improved their CS for many products since then. That being said: if you can show the OP a way to get his issue addressed by Google support, please do :)
I had an issue with GSuite for Education that I was able to get resolved by cavitching about it on Reddit (and someone gave me the email address of a high-level GSFE Program Manager), when, we had opened about 12 different tickets over the course of a month while waiting for our accreditation to post online.
The woman never responded, but, our issues were fixed the next day.
I needed support from Google Cloud, and the only way I was able to get meaningful support was to bother the Sales guy who started to bother me once he saw the news that we had our Round C go through.
When google punts their partner program at you, they openly say that they suck at support, use partners and get support better/faster. At least they're honest about it...
The woman never responded, but, our issues were fixed the next day.
I needed support from Google Cloud, and the only way I was able to get meaningful support was to bother the Sales guy who started to bother me once he saw the news that we had our Round C go through.
When google punts their partner program at you, they openly say that they suck at support, use partners and get support better/faster. At least they're honest about it...
[deleted]
I'm a small business using gapps ( and paying for it).
And the support I received was fast ( just a timer or something of 40 seconds) till I got "in".
I personally have no complaints, but I'm not using it as a free service also.
And the support I received was fast ( just a timer or something of 40 seconds) till I got "in".
I personally have no complaints, but I'm not using it as a free service also.
As respectable as your involvement in the situation is, this is exactly how it's not supposed to work.
It seems that the only way for a small business to get in contact with someone at Google is to raise hell on social media (or HN) and to wait for someone to take mercy on you.
It seems that the only way for a small business to get in contact with someone at Google is to raise hell on social media (or HN) and to wait for someone to take mercy on you.
I agree, I don't understand why such wildly profitable tech companies willfully ignore live support...
I mean, even a paid option.
As a business, I would gladly pay $99 for a phone call if I have a high-pri issue.
I remember using that when Microsoft had something like that years ago.
If they did that, high-priority support can be a profit center (or at least break even) if they're really that worried about costs.
I mean, even a paid option.
As a business, I would gladly pay $99 for a phone call if I have a high-pri issue.
I remember using that when Microsoft had something like that years ago.
If they did that, high-priority support can be a profit center (or at least break even) if they're really that worried about costs.
To be fair, both GSuite (business oriented) and Google One (for end users) come with paid support. Not sure to what extent this includes recovering a locked-out account, but it's a thing.
In a company using Google Apps for Business, administrators can reset any user account.
> It seems that the only way for a small business to get in contact with someone at Google is to raise hell on social media (or HN)
I'm intrigued by the implication that HN is not social media.
I'm intrigued by the implication that HN is not social media.
HN is the only very large, threaded comment forum I know of that is still (a) anonymous, and (b) actually has excellent content in the comments. In my own opinion, the signal/noise ratio is nearly 2 orders of magnitude greater than places like reddit (or perhaps the mathematically correct formulation is that the noise/signal ratio is nearly 2 orders of magnitude less at HN).
I credit the excellent, thoughtful moderators at HN for that.
I credit the excellent, thoughtful moderators at HN for that.
What part of hn remind you of social media?
Every part of it, with no exceptions. It's a website where you register an account and interact with the other accounts socially.
Contrast Netflix, where you consume fixed content, or Amazon, where you buy things.
Contrast Netflix, where you consume fixed content, or Amazon, where you buy things.
Social media also includes the social profile (with info about you)/friends (followers/watchers),sharing, personalized feeds.
This is more like your local news site. Articles are presented with comments below. Comments can be from real people but anyone can use a fake name. And who gave the comment rarely matters.
This is more like your local news site. Articles are presented with comments below. Comments can be from real people but anyone can use a fake name. And who gave the comment rarely matters.
I’m not going to defend the lack of live customer support — especially in cases that are largely automated (like Google), but even when you do have live customer support — social media or other ways of escalating/raising a signal is often necessary.
In a perfect world, it wouldn’t be — but if you are a very large company (or have millions or tens of millions of users), it’s often not possible to have live support staff who have the knowledge to handle every issue. It’s not just about paying for it either — if you have tens of millions of customers, support doesn’t scale that way, irrespective of cost (if you pay more you can generally get people more committed to gaining the knowledge to offer good support, but you still have a relative fixed number of “good enough” candidates). And that doesn’t even account for the fact that a vast majority of questions/calls are for issues that can either be automated or handled by less-skilled/lower-paid support.
In the face of those realities, using external platforms to act as a signal boost/triage for the most critical issues isn’t necessarily the worst thing.
Nine or ten years ago, I visited Delta’s headquarters to see how they were using Twitter to inform and re-define their customer service experiences. Airlines were some of the first industries to scour social media for issues to handle in real time and to go from being reactive (you have an issue and use Twitter to complain), to proactive (you’re invited to reach out over Twitter DMs or Facebook Messenger or WhatsApp) and I think they’ve actually done a good job. (I’d be curious to see what it has been like for airlines the last month as there have been unprecedented cancellations and support volumes are flooded across contact points). I have to give Delta immense credit, even a decade ago, they were doing phenomenal work in the space. I’m a Diamond Medallion, which means I theoretically get highest-priority phone support — and the agents on the phone are fantastic for helping me with complicated itineraries or rebookings), but for many things (like applying a regional upgrade certificate), I just DM the Twitter account because it is faster and it is a way the agent can work with multiple customers at once.
It would be great if all small businesses had a direct line to their vendors, but in the absence of that (which isn’t realistic), at least there is a way to boost the signal and get attention.
In a perfect world, it wouldn’t be — but if you are a very large company (or have millions or tens of millions of users), it’s often not possible to have live support staff who have the knowledge to handle every issue. It’s not just about paying for it either — if you have tens of millions of customers, support doesn’t scale that way, irrespective of cost (if you pay more you can generally get people more committed to gaining the knowledge to offer good support, but you still have a relative fixed number of “good enough” candidates). And that doesn’t even account for the fact that a vast majority of questions/calls are for issues that can either be automated or handled by less-skilled/lower-paid support.
In the face of those realities, using external platforms to act as a signal boost/triage for the most critical issues isn’t necessarily the worst thing.
Nine or ten years ago, I visited Delta’s headquarters to see how they were using Twitter to inform and re-define their customer service experiences. Airlines were some of the first industries to scour social media for issues to handle in real time and to go from being reactive (you have an issue and use Twitter to complain), to proactive (you’re invited to reach out over Twitter DMs or Facebook Messenger or WhatsApp) and I think they’ve actually done a good job. (I’d be curious to see what it has been like for airlines the last month as there have been unprecedented cancellations and support volumes are flooded across contact points). I have to give Delta immense credit, even a decade ago, they were doing phenomenal work in the space. I’m a Diamond Medallion, which means I theoretically get highest-priority phone support — and the agents on the phone are fantastic for helping me with complicated itineraries or rebookings), but for many things (like applying a regional upgrade certificate), I just DM the Twitter account because it is faster and it is a way the agent can work with multiple customers at once.
It would be great if all small businesses had a direct line to their vendors, but in the absence of that (which isn’t realistic), at least there is a way to boost the signal and get attention.
Isn't that how our society works in general?
Say you are the victim of a crime. You can't really do anything about it except appeal to the authorities. They will generally take pity on you and try to enforce the law, but often enough they don't and they have discretion not to. You have no other recourse for justice if they take the route of not enforcing the law other than appealing to the public or to a higher authority. Many victims of crimes have had the existing system fail them in this fashion.
Say you are the victim of a crime. You can't really do anything about it except appeal to the authorities. They will generally take pity on you and try to enforce the law, but often enough they don't and they have discretion not to. You have no other recourse for justice if they take the route of not enforcing the law other than appealing to the public or to a higher authority. Many victims of crimes have had the existing system fail them in this fashion.
Why you are not hiring proper support staff?
Because they can get away with it.
Well, many people say Google will never catch back Amazon and Microsoft in the cloud market due to their terrible reputation.
Don't trust the machine if you don't trust the person who made it.
[deleted]
You are an awesome person.
Somewhat related... At our company we once deleted a G Suite account that had a balance on its AdSense account. They let us delete the account with a click of a button without checking if all the associated accounts for other Google products should actually be deleted. So we received a letter that the account was sent to collections, but there was no way to login and pay the bill because the account didn't exist anymore. Eventually we got ahold of support and had them link the AdSense account to another Google account so it could be accessed. Theres a lot of systems at play with Google and I imagine stuff like this is overlooked quite often.
Yahoo is/was the same.
I deleted my Yahoo (email) account, but they didn't delete the Yahoo Groups account tied to that account.
I couldn't access Yahoo Groups, but I was still receiving Yahoo Groups messages on all groups I'd set it to forward posts to my email or notify me of things. No way to unsubscribe or change settings.
I deleted my Yahoo (email) account, but they didn't delete the Yahoo Groups account tied to that account.
I couldn't access Yahoo Groups, but I was still receiving Yahoo Groups messages on all groups I'd set it to forward posts to my email or notify me of things. No way to unsubscribe or change settings.
Well at least now that Yahoo has shut down groups, that problem has gone away.
It’s not completely shutdown. [1]
> On February 1, 2020, Yahoo! removed online access to discussions and all other features except simple membership management, essentially turning all groups into mailing lists.
[1]: https://en.wikipedia.org/wiki/Yahoo!_Groups
> On February 1, 2020, Yahoo! removed online access to discussions and all other features except simple membership management, essentially turning all groups into mailing lists.
[1]: https://en.wikipedia.org/wiki/Yahoo!_Groups
How many other struggling businesses are facing the the same issue but don’t know about the “get on the HN front page” back-channel to human tech support?
[deleted]
> may take 7 days
This is one of the things at minimum that fends off takeover accounts from people demanding immediate access and faking urgency, while also notifying all associated accounts that someone is trying to recover access and giving them time to respond.
This is one of the things at minimum that fends off takeover accounts from people demanding immediate access and faking urgency, while also notifying all associated accounts that someone is trying to recover access and giving them time to respond.
We had this with one of our employees. Email was locked for 2 weeks due to a bug on google's end. Was impossible to get support even if you have a paid account and a relatively large team.
A recommendation going forward: make sure to host emails on a domain you control yourself. This will allow to change service provider for mail hosting when they act like this.
The OP is talking about a paid service, which I presume isn’t a gmail.com address (otherwise why the suspension for non-payment?). To add to your advice, just having an own domain doesn’t help if you don’t download and store all mails on a computer or other device so that you don’t have to resort to a server to get older content you need whenever you need it.
Of cause it helps. It just doesn't provide your old mails.
Relying on Google for any business seems like potential suicide. When they decide you violated whatever they come up with, you are basically fucked. That is the reason why I never used Google+ - they were deleting people's email accounts. I hope they won't delete my email because of this comment ;)
I've had this happen in the past. I used another GSuite account I had access to to get a phone support PIN and actually got someone on the phone and then kept calling back until I got a rep who would work with me on the account I did not have access to.
THANK YOU THANK YOU THANK YOU
I can't tell you how grateful I am. I'm actually a little emotional, thinking of all the people who upvoted this post until it got in front of the people it needed to (and thanks so much Aayush!).
God bless everyone on this site. You saved me.
I can't tell you how grateful I am. I'm actually a little emotional, thinking of all the people who upvoted this post until it got in front of the people it needed to (and thanks so much Aayush!).
God bless everyone on this site. You saved me.
This. Unless you are big enough to have a customer engineer assigned to you, as good as their services are I see people having similar issues again and again with their lack of support
This kind of articles make me think that it must be a good decision to not use 2 FA after all. I originally disabled it to test aerc (https://aerc-mail.org)
If you used a desktop or mobile app, they download a backup of emails locally. If you're just trying to read an old email, you could check your phone or computer's mail app to find the local copy.
Startup idea: backup your google everything.
I back up all my gmail locally with "gmvault". I am not affiliated, other than a satisfied user: http://gmvault.org/
Sign in is currently disked - "this app has not yet been verified by Google in order to use Google Sin In"
You can work around it: https://github.com/gaubert/gmvault/issues/335
You can just use a POP3 client.
I recently learned about takeout.google.com to backup your Google everything!
So happy they provide this service!
So happy they provide this service!
If only I could put it into my crontab ...
You can’t automate it with cron, but Google Takeout does let you schedule exports every two months (six a year), and you can choose to have the file added to a cloud drive or have a download link emailed. It’s not ideal, but it’s better than it was. For mail, there are some really good command-line backup implementations that’s you can automate with cron. When I worked in a GSuite workplace, I used gmvault to backup my inbox every week (IMAP would work too but I was paranoid and my inbox was crucial to my job). Apparently there is now a better alternative than that but for mail anyway — and likely files in GDrive — there are options.
[deleted]
Does Google Takeout https://takeout.google.com/?pli=1 work in this cases? And does GDPR can be applied in this cases?
Doesn't Google takeout remain functional even for locked accounts ? You can download anything in that mail account even when it's blocked.
[deleted]
You might have to file a lawsuit and then you might be able to get it through discovery.
This seems to happen more and more often.
[deleted]
Angeo34(1)
I can't get a hold of anyone at the same time that my email is more important than ever. Google suggests to "contact their support, may take 7 days" even after I successfully entered the phone 2FA and a recovery email code.
Every day I'm locked out things get worse.
Does anyone have any tips for contacting Google, maybe talking to a human being?
Thank you HN