Welcome to my blog. I am a Google Diamond Product Expert and Mentor for Gmail and Google Account and here I write articles that explain various issues related to those two products as well as tutorials on topics that are either not available in the Gmail or Google Account Help Center articles, or are not available in the language the users want them to be in.
Verification Code Sent to the Same Google Account You Are Trying to Recover? Here is Why and What You Can Do
The situation where a verification code is sent to the very same Google Account being recovered is a common source of confusion in both the Gmail and Google Accounts Help Communities. Based on the many such cases encountered in those communities, this article explains why this can happen and outlines the recovery options that may be available.
For better readability and navigation, this article is divided into three sections:
Section 1: What typically happens
It typically begins when you forget the password to your Google Account and start the Google user-verification process to recover access. Depending on the account and the circumstances, Google may first prompt you to verify your identity using a phone number associated with the account. In the situation described in this article, you receive a verification code by SMS. Once you enter that code and click "Next", a second verification step appears, asking you to enter a code sent directly to the same email address you are attempting to recover.
Section 2: Why does this happen
This situation can occur when the verification method that would normally be available during the recovery process cannot be used or is not sufficient to complete the account-recovery process. The security configuration of the account, the verification methods available to you, and the circumstances of the recovery attempt can all affect which verification options Google presents.
Some of the circumstances commonly associated with this situation include:
You have forgotten the password for the Google Account.
2-Step Verification (2SV) is enabled, but you no longer have access to one or more of the verification methods configured for the account.
You are attempting to recover the account from a device that Google does not recognize as a trusted device.
A factory reset has removed information that previously allowed the device to be recognized.
The device has been repaired, replaced, lost, damaged, or stolen, resulting in the loss of access to a device or authentication method that was previously available.
Where multiple verification methods are available, the recovery process will typically present an appropriate high-security verification method first.
For example, if a passkey is available and applicable to the recovery attempt, Google may offer the passkey as the verification method. If you cannot use that method and select "Try another way" or "More ways to verify," Google may offer another available verification method.
An alternative method may provide a different or lower level of security than the method offered initially, but it must still provide sufficient evidence for Google to establish that you are the legitimate account owner. Being unable to use the strongest available verification method therefore does not necessarily make recovery impossible; it means that Google may require you to use another method that can still establish ownership to the required level of confidence.
This is also why successfully completing one verification step does not necessarily mean that Google has established sufficient ownership to restore access. For example, successfully verifying a phone number does not automatically mean that the recovery process is complete when additional security requirements apply to the account.
If the usual verification methods are unavailable because of a change in device state—for example, following a factory reset, device replacement, or loss of access to a trusted device—Google may present a different verification option.
In some circumstances, that option can involve sending a verification code to the very Google Account that you are attempting to recover. This can appear circular, because the code is being sent to an account that you cannot currently access.
However, the important point is that Google is offering the code as another means of verifying ownership of the account. If no other suitable verification method is available, Google may require you to obtain that code through an existing form of access to the account.
Section 3: What are the available options for account recovery when this happens
If Google requires a verification code to be sent to the same Google Account that you are trying to recover, the first thing to do is check whether another verification method is available.
Try another verification method
On the recovery screen, look for options such as "Try another way" or "More ways to verify." Selecting one of these options may present another verification method that is already configured or otherwise available for the account.
The methods offered will depend on the account and the circumstances of the recovery attempt. If an alternative method is available, follow the instructions provided by Google.
If no suitable alternative is offered, there are still some things worth checking before assuming that the account cannot be recovered.
Check for pre-configured ways of accessing the incoming message
If the verification code is being sent to the Google Account itself, consider whether you have previously configured another way to access incoming messages from that account.
Email forwarding
Check whether messages received by the account are being automatically forwarded to another email address. If forwarding was already configured, the verification message may also be delivered to the forwarding address.
Mail delegation or other mail access
If the account was previously configured to allow another Google Account or email application to access its messages, that existing access may provide a way to retrieve the verification code.
Depending on what was configured previously, this could include Gmail delegation or access through a mail application using a supported mail-access method.
The important point is that these options must have been configured before you lost access to the account. They cannot normally be set up after the recovery process has already begun because doing so would itself require access to the account.
Check for an existing signed-in session
If you have used the Google Account on other devices, browsers, tablets, or mail applications, check them carefully.
An old phone, tablet, computer, or browser profile may still have an active session for the account. If you find one, do not immediately sign out or remove the account.
Instead, check whether you can open the account's incoming mail from that existing session. If you can access the verification message, you may be able to retrieve the code and enter it into the recovery process.
This is particularly important after a device has been lost, replaced, repaired, or reset. You may still have access to the account somewhere else without realizing it.
Look for a saved copy of the password
If no active session or alternate access to incoming mail is available, another possibility is that the password has been saved on one of your devices or in a password manager.
Check any secure offline records where you may have stored your passwords. You can also check password managers that you have previously used.
For example, depending on the devices and browsers you use, you may find saved credentials in:
Mozilla Firefox Password Manager
Apple Safari Passwords
Microsoft Edge Password Manager
Google Password Manager
If you find the correct password, return to the normal Google Account sign-in process and try signing in with it. Depending on the account's security settings and the circumstances of the sign-in, Google may still require additional verification.
Limitations of the Google Account recovery process
There is no legitimate method for bypassing Google's account-recovery verification requirements. If Google does not offer another verification method and you have no existing access to the account from which you can retrieve the verification code, your remaining options may be limited.
This is an intentional security measure. The same restrictions that can make recovery difficult for the legitimate owner also help prevent someone who does not own the account from using partial information to take control of it.
For that reason, it is worth checking every device, browser, mail application, forwarding arrangement, delegated-access arrangement, and password manager that may still provide legitimate access before concluding that there is no way forward.
Imagine seeing a security-related notification or prompt about activity involving your Gmail or your Google Account. As part of checking what has happened, you should look for additional information that can help you understand the activity.
When the activity relates to your Gmail, one way to find out more is to click Details next to Last account activity. This opens the Activity Information window, where Gmail provides information about recent activity or access, particularly access related to your Gmail.
The Details link next to Last account activity at the bottom of the Gmail Inbox opens the Activity Information window.
You may visit this window while investigating a particular activity, or simply because you have decided to review your Gmail activity as part of your own periodic security checks. It is worth noting that this is a separate check from the Google Account Security Checkup. The Security Checkup takes you through a series of security-related checks as part of a single guided process, but it does not, as part of that process, direct you to review the Details information available through Last account activity in Gmail.
Once you open the window, however, you may find that the information is quite diverse and can include a considerable amount of technical detail. You may see entries such as Browser, POP3, Authorized Application, Mobile, or Unknown, without it being immediately obvious what each entry represents or how the information should be interpreted.
The Gmail Activity Information window showing recent activity entries and the information associated with them.
This is particularly worth understanding because the Activity Information window is not something most users encounter as a routine part of reviewing their Google Account security. Consequently, even someone who regularly checks their account security may find themselves looking at these entries without much context for interpreting them.
That is the purpose of this guide.
It explains the different types of entries you may encounter in the Activity Information window, what they generally represent, and—just as importantly—what they do not necessarily tell you. The aim is to provide the additional context you may need when reviewing this information, whether you arrived here because something caught your attention or simply as part of your own periodic security checks.
Gmail provides an official Help Center article, "Last account activity", which explains the information available through this feature and provides Google's guidance about activity that you do not recognize.
This guide is intended to complement, rather than replace, that Gmail Help Center article.
The Gmail Help Center provides Google's official product information and security guidance. This guide takes a more practical approach, focusing on the entries you may actually encounter and providing additional context to help you understand what you are seeing.
Before interpreting an entry
Before looking at the individual entries, there is an important point to keep in mind.
The information shown in the Activity Information window describes activity or access that Gmail has recorded. Depending on the type of activity, however, the information displayed may not identify the exact device, application, person, or action that produced the entry.
An entry that you do not immediately recognize therefore does not automatically mean that someone else has accessed your account.
At the same time, an unfamiliar entry should not simply be dismissed. If you cannot explain an activity, you should investigate it and consider the circumstances in which it was recorded.
In other words, unfamiliar and unauthorized are not necessarily the same thing.
Understanding that distinction is important when interpreting the entries described below.
Browser
A Browser entry indicates access to Gmail through a web browser.
This is the type of access you would normally expect when you open Gmail in a browser and use the Gmail web interface. Examples include Firefox, Chrome, Safari, and Microsoft Edge (Chromium).
Depending on the information displayed, the entry may also provide information about the browser being used.
A Browser entry in the Gmail Activity Information window.
A Browser entry, however, should not be interpreted as identifying a particular physical computer or the person using it. It tells you about the type of access Gmail recorded, rather than providing a complete description of who was using the browser.
If the date and time correspond to a time when you were using Gmail in a browser, the entry will generally have a straightforward explanation.
If they do not, you should look at the other information associated with the entry before deciding what it means.
POP3
A POP3 entry indicates access to Gmail using the POP (Post Office Protocol).
POP is a method used by mail applications (email clients) to retrieve messages from a Gmail account. Unlike accessing Gmail through a web browser, where you interact directly with the Gmail web interface, a POP connection allows another mail application or service to retrieve messages from your Gmail account.
Examples of email clients that can be configured to access Gmail using POP include Microsoft Outlook, Apple Mail, and Thunderbird.
For example, if you have configured an email client to retrieve messages from Gmail using POP, that activity can appear as a POP3 entry in the Activity Information window.
Gmail's Mail Fetcher feature can also be relevant when interpreting a POP3 entry. Mail Fetcher allows Gmail to retrieve messages from another mail account, rather than you accessing that other account directly through its own web interface.
Consequently, seeing a POP3 entry does not, by itself, mean that someone has installed an unfamiliar email client or is accessing your Gmail from an unknown computer.
If you use an email client or a Gmail feature that involves retrieving mail through POP, consider whether that could explain the entry.
You can also check the Forwarding and POP/IMAP tab in Gmail's settings for information that may help corroborate what you are seeing. In particular, check whether POP access has been enabled and whether the settings are consistent with the way you use Gmail. This can provide additional context when you are trying to determine whether a POP3 entry has an expected explanation.
A POP3 entry in the Gmail Activity Information window.
A POP3 entry associated with Gmail retrieving messages through POP3.
As with the other types of activity shown in this window, the date and time, IP address, and approximate location can provide additional information when you are trying to understand a particular POP3 entry. Those details should, however, be considered together rather than interpreted in isolation.
Authorized Application
An Authorized Application entry indicates activity associated with an application or program that has been authorized to access your Google Account, particularly Gmail.
This is different from simply signing in to Gmail through a web browser. An application or service may have been granted permission to interact with your Google Account, and activity associated with that authorization can be reflected in the Gmail Activity Information window.
The important point is that an Authorized Application entry does not, by itself, mean that an unknown third-party application has accessed your account.
You may have authorized the application yourself, possibly some time ago, and may no longer remember doing so. You may also have authorized an application or service for a particular purpose without realizing that activity associated with that authorization could subsequently appear in your Gmail activity information.
An Authorized Application entry associated with a mobile email application.
An Authorized Application entry associated with an IMAP mail client.
An Authorized Application entry associated with activity involving another Google service.
An Authorized Application entry associated with an external service retrieving messages from Gmail.
If you encounter an Authorized Application entry that you do not recognize, you should investigate the applications and services that have access to your Google Account. You can review the list of third-party apps and services with access to your Google Account—and the Google products they can access—on the "Third-party apps & services" page. The information there may help you corroborate whether an application or service you have previously authorized could provide an explanation for the activity shown in the Gmail Activity Information window.
However, the Activity Information entry by itself is not sufficient to identify the particular application involved, the exact action that took place, or whether the activity was authorized by you.
As with the other entries, consider the date and time, IP address, approximate location, and anything you were doing with your Google Account around that time. These details may help you put the entry into context.
Authorized Application ()
You may also encounter an entry displayed as:
Authorized Application ()
Note that the parentheses are empty.
This can be particularly confusing because the entry appears to identify an authorized application while providing no information between the parentheses.
There is, however, a useful observation that you can reproduce for yourself. An Authorized Application () entry can appear in connection with activity involving Security Checkup.
To reproduce this:
Open Gmail and click Details next to Last account activity.
This opens the Activity Information window.
In the Activity Information window, click Visit Security Checkup for more details.
Review or complete the relevant activity in Security Checkup.
Return to the Activity Information window and look at the entries listed there.
You may see an entry displayed as Authorized Application ().
Selecting Show details does not necessarily provide any additional information inside the parentheses.
An Authorized Application () entry with the Show details option.
The entry may subsequently disappear after a few minutes.
Refreshing the relevant information can cause the Authorized Application () entry to appear again.
The Authorized Application () entry after its details have been hidden.
Being able to reproduce the entry in this way is significant because it shows that Authorized Application () does not, merely because the parentheses are empty, mean that an unidentified third-party application has gained access to the account.
It is important, however, not to take this observation too far. The fact that the entry can be reproduced in connection with Security Checkup does not mean that every Authorized Application () entry is caused by Security Checkup. A similar entry encountered under different circumstances should still be investigated rather than automatically attributed to Security Checkup.
If you encounter an Authorized Application () entry, consider the date and time and what you were doing with your Google Account around that time. You can also review the list of third-party apps and services with access to your Google Account on the "Third-party apps & services" page. The information there may help you corroborate or rule out a possible explanation for the entry.
The important distinction is between what can be observed and what can be concluded from that observation. The empty parentheses do not, by themselves, show which application was involved or that the activity was unauthorized.
The reproducible Security Checkup observation gives you one possible explanation for this otherwise puzzling entry, but it should be treated as an example of how the entry can occur—not as a universal explanation for every occurrence.
Mobile
A Mobile entry indicates activity associated with mobile access to Gmail.
This can include access from a mobile device, including access through a mobile browser.
A Mobile entry in the Gmail Activity Information window.
It is important to be careful when interpreting the location associated with mobile activity.
Your mobile carrier or Internet service provider may route traffic through infrastructure that is geographically distant from the device you are actually using. Consequently, an approximate location shown for a Mobile entry may be somewhere other than your actual physical location.
This means that an unfamiliar location does not automatically indicate that somebody else was using your Gmail.
When reviewing a Mobile entry, consider the date and time, the connection you were using, the carrier or service provider information, and the other information displayed in the Activity Information window.
Location information can be useful when investigating activity, but it should not necessarily be taken as showing the exact physical location of the device.
Unknown
When you see an entry marked Unknown, it can look unusual because it does not immediately tell you what type of activity Gmail has recorded.
You may naturally wonder why the entry is described as Unknown when other entries in the Activity Information window are more specific about the type of activity involved. You may also wonder whether an Unknown entry means that someone else has accessed your account.
Not necessarily.
The term Unknown describes how Gmail classified the activity. It does not, by itself, identify the person or device responsible for the activity, nor does it establish that the activity was unauthorized.
An Unknown entry can occur in circumstances where you are actively using Google services.
For example, when multiple Google Accounts are signed in within the same browser, activity involving one account can sometimes result in an Unknown entry being recorded in another account's Gmail Activity Information.
An Unknown entry in the Gmail Activity Information window.
This is useful to keep in mind because it shows that the mere presence of an Unknown entry does not necessarily mean that somebody else has accessed your account.
That does not mean that every Unknown entry should simply be ignored.
If you see an Unknown entry that you cannot explain, consider the date and time, the IP address and approximate location, what you were doing with your Google Accounts at the time, and whether other activity around the same time provides a possible explanation.
If the activity remains unexplained and you have reason to believe that somebody else may have access to your account, follow Google's recommended account-security procedures.
The appropriate response is therefore neither to assume that an Unknown entry is harmless nor to assume that it represents unauthorized access.
It is an entry that needs to be considered in context.
Looking at information as a whole
The individual entry type is only one part of the information available in the Activity Information window.
When trying to understand an entry, it is useful to consider several pieces of information together:
Date and time — Did the activity occur when you were using Gmail or another Google service?
Access type — Was it Browser, POP3, Authorized Application, Mobile, or Unknown?
IP address — Does it correspond to a network or connection you recognize?
Approximate location — Is the location reasonably consistent with the network or service you were using?
Your own activity — Were you using another device, mail application, or Google service around that time?
Other Google Accounts — Were you signed in to more than one Google Account in the same browser?
Authorized applications and services — Have you previously granted access to an application or service that could account for the activity?
Looking at these details together is generally more useful than focusing on one word in the Activity Information window.
For example, an unfamiliar location may initially look concerning. If the activity occurred while you were using a mobile connection, however, the location may be explained by the way your carrier or Internet service routes traffic.
Similarly, an Unknown entry may look alarming until you consider what you were doing with multiple Google Accounts in the same browser at that time.
The Activity Information window should therefore be viewed as a collection of information that can help you investigate activity involving your Gmail, rather than as a simple “safe” or “unsafe” indicator.
When should you be concerned?
An unfamiliar entry deserves attention, but there is an important difference between investigating an entry and assuming that your account has been compromised.
If you can account for the activity after considering the date, time, access type, IP address, your devices, applications, and what you were doing at the time, the entry may have a perfectly ordinary explanation.
On the other hand, if you find activity that you genuinely cannot account for, particularly if there are other indications that somebody may have access to your account, you should take the situation seriously.
Google's official guidance should be followed in that situation. Depending on the circumstances, this can include changing your password and reviewing your account-security information.
It is also worth remembering that the Activity Information window is not intended to provide a complete forensic record of every action performed on a Google Account.
It is one source of information that can help you understand activity or access associated with Gmail.
In conclusion
The Gmail Activity Information window can be useful when you are investigating activity that has caught your attention, but it can also be useful as part of a routine review of your Gmail activity.
The different entries describe different types of activity or access, but they should not necessarily be interpreted on their own. A Browser entry can reflect access through a web browser, while POP3 can be associated with mail applications or Gmail's Mail Fetcher. An Authorized Application entry can relate to an application or program authorized to access your Google Account, while Authorized Application () can appear without identifying information inside the parentheses. Mobile activity can be affected by the way mobile networks route connections, and an Unknown entry does not necessarily mean that somebody else has accessed your account.
The information accompanying an entry—such as the date, time, IP address, approximate location, and the activity you were carrying out at the time—can provide additional context. In some cases, checking related information elsewhere in your Google Account can also help you corroborate a possible explanation.
The important point is not to treat an unfamiliar entry as either automatically harmless or automatically suspicious. Instead, consider the information available, look for a reasonable explanation, and investigate further when you cannot account for the activity.
Understanding both what these entries can tell you and what they cannot tell you can make the Gmail Activity Information window much more useful when you are trying to understand activity involving your Gmail.
Signing into multiple Google accounts from a browser is an efficient and convenient way to manage all of our Google accounts and as such, we do happen to receive very specific questions in both the Google Accounts and Gmail help communities related to this topic, such as:
In this article, we shall explore this process as well as learn about the answers to all the above questions. So, let's begin.
Note: For this blog, we would use three Google accounts.
The first account to be signed in to the session - s*****@gmail.com.
A second, Gmail account, to be added to the session - p*****@gmail.com.
A third, non-Gmail Google account, to be added to the session - s*****@outlook.com.
Q1: What's the default account for the session?
Simply put, it is the first account you sign into from the browser. In the context of signing into multiple Google accounts from a browser, it is identified as "authuser=0" or "/u/0".
Q2: How do I sign into multiple Google accounts from a browser?
You just need to click on the circular profile icon/picture of the default account for the session at the top-right of the screen and then click on the "Add another account" option
You'll then be shown a list of accounts. If you want to use one of the listed accounts, select that account. Otherwise, click on the "Use another account" option.
Thereafter, enter the username and password for the account you want to add to the session.
The next step is specifically for Chrome where the browser asks if you'd rather open that Google account through its own Chrome profile instead of the profile belonging to the default Google account for the session.
Since we do want to open that account under the Chrome profile of the default Google account, we click "Cancel" to proceed.
We already know that the default account for the session is identified as "/u/0" and those of the other accounts are in increasing numeric order of their addition to the session.
As this is the second account added to the session, it will have the identifier "authuser=1" or "/u/1".
Similarly, when we add a third account (a non-Gmail Google account) to the session, it gets the identifier "authuser=2" or "/u/2".
Q3: How do I identify the default account for the session?
There are two ways to identify the default account for the session.
By clicking on the circular profile picture icon at the top-right of the screen.
The first reference you see is that of the account you are viewing the details from, which in this case is my s*****@outlook.com non-Gmail Google account. The "Default" tag next to the s*****@gmail.com identifies it as the default account for the current session.
Note: If you do not see the default tag against any of the listed accounts, it means you are in the default account for the session.
By observing the URL, and in particular, the value after the "/u/" part.
For the default account, the value is always zero.
For a non-default account for the session, the value after the "/u/" part will always be a non-zero one.
Note: The steps to switch between accounts signed in from a browser session are also similar. You can either click on the circular profile icon and select the account from the list or you can simply edit the numeric value in the URL after the "/u/" part. For example, changing "/u/0" to "/u/2" will load the details belonging to the third account added for the session.
Q4: How do I change the default account for the session?
The easy answer is, you can't. You need to sign out of all accounts and thereafter, sign in first with the account you want to be the new default for the session.
Q5: How do I sign out of one such signed-in account?
You also can't sign out of individual accounts. In fact, the option to sign out of individual accounts is not even available. So, once you have signed into multiple Google accounts from a desktop browser, you can only sign out of all accounts at once.
Q6: Any additional detail I should be aware of?
A couple of details should always be kept in mind.
First, if you are using Chrome, be mindful that all the other accounts are added under the Chrome profile of the default account for the session. This also means that various Chrome-related activities would sync back to that one specific account. For more details on this topic, you may read this Chrome help article - https://support.google.com/chrome/answer/2364824?hl=en.
Second, if you have added a non-Gmail Google account, just be mindful while using Gmail. That's because, when you use a non-Gmail Google account, it can be used for all Google products and services except Gmail. So, if you click on your non-Gmail Google account while using Gmail -
- the system considers it as a request to add Gmail to your Google account and takes you to the screen shown below.
And why is this a concern? Because once you end up adding Gmail to a non-Gmail Google account, it is considered permanent the Gmail address then becomes the primary username for your Google account and the non-Gmail email address the Alternate email. While you can remove the Gmail service from such Google accounts, the permanency of adding Gmail to a non-Gmail Google account means the Gmail username remains attached to the Google account as an Alternate username and that can't be removed.
As always, feel free to leave your questions or clarifications related to this blog article below, as a comment. If you have an issue related to your Gmail or Google Accounts, be sure to post your question in the appropriate forum by clicking on the relevant link below.
