Cybersecurity: Unknown Google device

Q. I have a Google business account I use for my business email, and one of the security features provides a list of devices that currently or have recently accessed my Google account. In a recent review of this list, I noticed a BlackBerry device I can’t identify had accessed my account. Worried about this unidentified access, I changed my Google account password, but even after changing the password, the unknown BlackBerry device continues to attempt to sync with my Gmail account. Do you have any suggestions as to how I can remove this device, and do you think this represents a security threat?

A. The presence of an unrecognized device attempting to access your Google account could be a serious threat; I recommend you remove the unknown device and change your password immediately. (I also recommend that you upgrade your Google account security to two-factor authentication, if you have not already done so.) Devices connected to your Google account can be removed only by logging into your Google account on an Android or Apple device, and then accessing the Connected device list, selecting the device, and clicking the Remove Access button. (To clarify, Windows computers do allow you to see your Google connected devices, but the Remove or Remove Access button appears only for Android and Apple devices.)

To access the Google connected devices list, go to myaccount.google.com, log in to your Google account, and go to the Security Checkup section. In the Check your recovery information section, click the Done button to advance the screen to the Check your connected devices section, as pictured below.

This list displays all of the devices that have either accessed or attempted to access your Google account in the preceding 28 days. As you can see in the example screenshot above, I, too, had an unknown device attempt to access my Google account (which I purposely caused by attempting to access the account from another device using an incorrect password). Clicking a listed device launches a window containing more information about when and where the access was last attempted. As long as the message indicates that Google prevented the unknown device from accessing your account, you are fine. However, if the message indicates that an unknown device has indeed accessed your account, your Google account could have been breached. Some of the safe reasons you might see an unfamiliar device listed are:

• You’ve previously synced a device to your Google email, calendar, or other apps, and that device is still trying to maintain the sync;
• You’ve signed in to your account from a friend’s computer or on a public computer at an internet cafe, library, or another location.
• You have an emulator tool installed on your computer (such as BlueStacks), which can cause a connected device to appear in your Google connected device list.

If none of these situations applies, then the activity is suspicious and you should take immediate action to prevent any future tampering. Specifically, you should click the Something looks wrong button (located at the bottom of the connected device list pictured below), which warns Google of the suspicious activity and displays a Change password button, which you should then use to change your password. (Note that once you change your password, you will need to reconnect to your Google account from all devices using your new password.) If you are logged in on an Android or Apple device, click the Remove Access button to delete the device from the connected device list.

About the author

J. Carlton Collins (carlton@asaresearch.com) is a technology consultant, a CPE instructor, and a JofA contributing editor.

Note: Instructions for Microsoft Office in “Technology Q&A” refer to the 2007 through 2016 versions, unless otherwise specified.

Submit a question

Do you have technology questions for this column? Or, after reading an answer, do you have a better solution? Send them to jofatech@aicpa.org. We regret being unable to individually answer all submitted questions.