3

So I had an Android phone stolen - nearly two years ago now. When it was taken, I immediately reset my Google account password (and most others). I have 2-factor auth on my Google account. I have changed my password multiple times since then too.

However, today, I was doing my Google security review, and it's still showing up on my account, and still showing up as logging in - recently!

enter image description here

What?!!?

I can't remove the device from my account - it is deselected in Google Play Devices. It also does not show up in Android Device Manager (and never has from the moment it was stolen) - even when I enable it again in Google Play Devices.

What is going on here?

  • @beeshyams I'm still concerned by the "Last sync" though. This information does not tally with what it says in GPD, which shows the last time my account was accessed was just before it was stolen. – fredley Feb 9 '16 at 9:52
1

This may explain : from Google Play help forum

Joe Ellet in his post dated 3/18/15 says

There are two lists. One is your active devices. That one should be up-to-date. The other is the record of all devices you have used to make a purchase on Google Play. That list has nothing to do with your current inventory and cannot be used for any sort of malicious purpose. It is kept because all Play Store purchases are kept as transactions and every transaction includes the device it was made from. That is to protect you so that if you bought something at a reduced price or free you can later download the same content onto a new device without having to pay for it again.

Bottom line, don't worry about the second list.

The distinction between two lists seems to have been eroded, and now you have a single list showing both. Can't find a reference to this though.

I would think that your stolen device (or my sold device) figures on the list for Google Play transaction audit as mentioned above. The fact that you can't select to delete this device further adds weight to this

Edit: As a normal practice, I changed my Google account password about 10 days ago. I just checked Sign in and Security page of my account and do not see my sold device accessing my account, though Google shows it is connected to my account

As a next step to confirm that my old phone was not accessing my account, I went to the Android Device Manager and saw that only my current phone is registered there. If my old or stolen phone was able to access my account, surely I should be able to wipe it! This should put to rest your concern that your stolen phone is accessing your account

An interesting read that explains how Google interacts with devices based on their ID is Will wipe request from Android Device Manager affect replacement device?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.