I was a bit worried when I saw the title of the article because I have one of these accounts but geez he made some bad choices. Deleting all phone numbers and the recovery and swapping to a new authentication method and then accessing from a different country??? No wonder it got flagged.

I probably wouldn't believe him either. Google should have an option to revert to the last trusted config after some verification method. Google support is bad, I'll give him that.

All this to avoid roaming charges? And then refusing to share a personal email in this scenario and missing meetings because of that.

I'd argue that changing the MX to fastmail or Microsoft would be much faster than a postfix+dovecot solution on a VPS but I think he's just refusing any solution based on his principals.

That's what I didn't get either. And you don't even need to configure a VPS, there's Fastmail, Protonmail, Zoho, Kolabnow, Purely mail, Migadu and so much more.

Why victim blame him for removing the phone number? He had a logical reason for doing so, and with Google supporting many forms of authentication it's perfectly reasonable to think that removing one wouldn't jeopardize the other methods.

Recently I cleaned up a SMB client's Workspace users after archiving their data (former employee accounts that had been languishing). In the space of a day or two I did the following for half the ~20 total accounts:

  - Moved to no 2FA sub-organization
  - Reset password
  - Disabled security check for ten minutes
  - Logged in as the user in a fresh browser profile
  - Exported data with Takeout
  - Deleted the account in the admin console

I fully expected to hit some kind of roadblock or delay or for alarm bells to go off for the other admins, but nope, I literally "absconded" with hundreds of gigabytes of data and nuked half the org in short order.

There is a Workspace Admin option to export users' data but it warns of an automatic 48 hour delay to let "other admins take action" if something is amiss. The client wanted the task done before getting hit with the full monthly license fees again so I had to go the manual route.

Granted, out of paranoia, I was using the client's office VPN as my traffic egress so maybe that helped.

people who travel shouldn't trigger account abuse