Locked Out: A Woeful Tale of Two-Factor Authentication with Google Voice

This is my story of how I was locked out of my Google account for nearly two months because of a two-factor authentication (2FA) password reset attempt that I could not successfully complete. If you have a Google Voice number as your 2FA number, change it immediately! You will also be in the same basic situation if you lose your cellphone and access to your text messages. 

It took 57 days to resolve this issue. 

FIFTY-SEVEN DAYS!

Here's what happened.

The Beginning: A Mindless Password Reset Attempt

February 2. I am a remote worker using my laptop and receive a Windows update that prevents me from using the Edge browser I normally use on my work laptop. I decided to log in to my Gmail account using the Chrome browser (the first time on this particular device) after several months of using the Microsoft Edge browser, where my password was stored. I wanted to use the time during the update to check my personal email, but I couldn’t remember my password, so I thought I would just use the password reset function. This is how little thought went into the turn of events that happened.

The password reset required two-factor authentication. I think it is the first time I have ever had to use two-factor authentication for my Gmail account. My phone number for the 2FA is my Google Voice number associated with the same account. Since I am attempting to log in to a Google account and the 2FA is sending the text to a Google Voice number associated with the same account, I am unable to receive a text until I can log in. Either way, I’m screwed, and you are in the same predicament if you have 2FA sending texts to a cell phone number you no longer have access to.

Try Another Way sends a recovery code to my Gmail account that I am locked out of. Suddenly, I am locked out in an endless loop that returns to the screen to send a text to my mobile number.

I tried numerous times until I got this message in the screenshot below: “Too many failed attempts . . . Try again in a few hours.” (I will later learn that this message seems to require not a “few hours” but a one-week waiting period with no login attempts until the “Too many failed attempts” lock on the account goes away.)

No Humans Allowed

This message is on the account recovery page:

“For your security, you can't call Google for help to sign into your account. We don’t work with any service that claims to provide account or password support. Do not give out your passwords or verification codes.”

All research suggests this is a serious problem that may not be able to be resolved if you can’t navigate the automated processes. They do not involve humans in resolving login issues. At this point, the situation looks bleak.

The Mountain View Call

The next day, I called Google’s Mountain View number at 605-253-0000. The options related to my situation tell me to go to the online account recovery form. I pick other options to attempt to get a human being. After one hour and 15 minutes on hold, I got a person. He is reassuring and lets me know that my problem can be resolved when I explain about the Google Voice number being my 2FA number. (On the contrary to his optimism, online reading suggests the only resolution may be to open a new account, resulting in the loss of access to 15 years of work products, blogs, courses created, personal records, family photos, and bills associated with the Gmail account, and other things I am not even sure I can figure out.)

I am sent to this page and told to use the fill out this form option and it will be looked at by a human being.

I select the link and fill out the form below.

Finally, there seems to be hope that I can get the account access back. But within an hour (on the first attempt, and within five minutes on the second attempt at using the same form), I get this form message:

Even though I was assured these submissions are looked at by human beings, they are clearly just sending back a form email, or there is an automated response sent, or both. It is true that I should be able to log into my active account, but I can’t because of 2FA.

At this point, I am moving past denial in the five stages of grief into anger. I have never experienced a situation like this where a person can’t contact another human being to help them resolve a problem. But this is a new world we have made.

When You Get Locked Out of Your Google Account, What Do You Do?

This is the title of an article that saved the day for me. Sometimes, one person takes the time to do something that helps other people immensely, and this great article that was born out of anger and frustration of another user who was in the exact same position I was in helped me resolve the issue. The author was locked out of her Google account with a 2FA Google Voice number attached. You can read here article at the link above, but let me quote her key finding:

Since the [Google Voice] number is a VOIP number, they have to comply with FCC regulations. Google was denying me access to my account without cause. According to the FCC: FCC rules help to prevent telephone companies from abruptly discontinuing, reducing, or impairing wireline telecommunications service without proper notice, for any reason including bankruptcy. The discontinuance rules, which also apply to interconnected Voice-over Internet Protocol (VoIP) service, are designed to protect you from an abrupt change or termination of service and to allow you time to arrange for service with another provider.

In this case, it seemed the government was really here to help, so following this strategy, I submitted an informal complaint to the FCC on February 20. You can read the about this process at this link. I asked in the complaint for Google to unlock the phone number, thinking I would be able to port it as an additional phone line under my wireless carrier. Google had 30 days to respond to my complaint. But it didn’t exactly work out as I had planned.

A Mysterious Resolution

On March 24, I finally received the response from Google written apparently by an actual human being, through the FCC. Again, Google seemed to use a form email and told me to use their Help page to regain access to my account and requested the case be closed.

Five days later, I wrote back this response to the FCC:

Thank you for facilitating these communications. No, in my opinion this is not an acceptable response from Google.

In their response, Google is asking me to unlock my Google Voice number (XXX-XXX-XXXX) myself so that it can then be ported to a third-party provider. I am unable to do this because my Google Voice number is my two-factor authentication primary phone for my Google account. Since I am locked out of the Google account after a password reset that required two-factor authentication, I am also locked out of the Google Voice number associated with the account, leaving me stuck in an endless two-factor authentication loop where Google wants to text the two-factor authentication code to my Google Voice number that I cannot access. The only solution appears to be for Google to unlock the phone number so I can port it to another service provider, get the two-factor authentication text messages, and access the account.

The Google Voice number (XXX-XXX-XXXX) is still active and I can receive phone calls to it, but I cannot call out or receive texts at the number. I have taken several steps to resolve this issue:

1. Attempted numerous logins using various options to launch a different "path" of authentication steps.
2. Searched all of my devices for backup codes, but apparently I did not set them up.
3. Called the Google Mountain View support phone number and spoke with a representative after waiting 1 hour and 15 minutes, where I was advised to use the account recovery form "Request to restore your Google Account: Use this form if the above steps don't work." The account recovery form is apparently read by human beings; however, those 2-3 attempts ended with the following form response: "Thank you for contacting us about being unable to access your Google account. We've looked into your account and confirmed that it is still active, so you should be able to log in normally." I am still unable to log in normally.

I would appreciate it if Google would unlike my Google Voice number so that I can recover the account. Thank you.

Two days later, I mysteriously received this email from Google Support instructing me to “file a claim” using the link provided in the email.

 

 

The process is not exactly intuitive because to file a claim, you actually appear to start the login process again, but instead of getting the 2FA screen to send a code to your phone number, you key enter a valid email address. After that, it’s not clear, but submitting that email seems to “create the claim.” At that point, I stopped trying to do anything else and waited.

Two days later, I received a password reset email from Google at the email address provided through the process above. The password reset did not require 2FA. I successfully reset my password and had the account back after 57 days. It really shouldn’t be this difficult to resolve this kind of problem.

Other resources:

Gmail Account Recovery article from Google