Google Introduces Trusted Contacts for Gmail Account Recovery

Google has launched a new security feature for Gmail and Google accounts that allows users to designate trusted friends or family members as recovery contacts. This feature is designed to help users regain access to their accounts if they are locked out, for example, due to forgotten passwords, lost passkey devices, or account compromise. Users can select up to 10 trusted contacts, who must accept the request to serve in this role. When a user is locked out, they can initiate the recovery process, which involves sharing a code with their chosen contact. The contact receives a notification and must verify the request by selecting the correct code from a set of options, ensuring that only genuine requests are honored. This process uses number-matching authentication to reduce the risk of social engineering attacks. Google recommends that users choose contacts who are likely to respond quickly, as the recovery request expires after 15 minutes. The company also advises selecting individuals with strong cybersecurity awareness to minimize the risk of exploitation by attackers. The trusted contacts feature is part of Google’s broader push towards passkeys as the future of account authentication, addressing the challenge of device loss that can leave users unable to access their accounts. The recovery process is designed to be secure, with the contact unable to access the user’s account directly, but able to verify the user’s identity. Google Messages will also alert users to spam and help keep texts private, further enhancing account security. The setup process for recovery contacts is straightforward and can be completed on both desktop and mobile devices via the Google account security settings. This new method provides an additional layer of resilience for account recovery, supplementing existing options like email and SMS. The feature aims to reduce the frustration and risk associated with being locked out of critical accounts, especially as more users transition to passwordless authentication. Google’s approach balances convenience with security, leveraging personal trust relationships while maintaining technical safeguards. The company acknowledges that, while unlikely, sophisticated attackers could attempt to exploit the process, so user vigilance remains important. Overall, the trusted contacts feature represents a significant enhancement to Google’s account recovery options, providing users with more reliable and secure ways to regain access to their accounts.