Prompted to enter new password for Gmail on Android for no apparent reason

Question

In just one of multiple Gmail accounts on my cell phone, I noticed that an outgoing email sent while away from home (probably over 4G) got stuck on the Outbox without being sent. At first I attributed it to cell phone data coverage issues in the area I was in, but even after connecting to WIFI it didn't send.

When I tried to sort out what was going on with that account, it prompted me to verify it, and didn't recognize the password, having to enter a new one after typing the one that I thought was still valid to verify my ownership of the account. After that everything was good until it happened again twelve hours later (and again, everything went back to normal after changing the password, which at this point, I have changed multiple times from a PC to try and avoid being tracked).

None of the interfaces seemed out of the ordinary within standard routines within Google. The other email accounts worked without a glitch on the same phone.

I don't use 2-step verification for this particular account.

I looked for any POP or forwarding, or other sharing settings that could show that the account was compromised, but everything was fine. And I looked under the account activity, and all the changed password events were done by me.

There was only one thing unexpected under the Access tab: an address from out-of-state that I couldn't reverse ID:

Mobile United States (PA) (2600:1002:b117:ccd7:e506:e318:fc5c:a2cf)

I don't recognize this address, but it doesn't show like there was any password change done by this address, and there were no emails sent or received during that time. Critically, I did not received any notification of an unrecognized new device logging on to my account, and all the devices listed as having accessed my account are mine (under a separate tab in the Settings - not in the list of recent activity, where this IP address appear). In terms of the time, I could have accessed the account from my phone, and only from my phone, which appears elsewhere but not in that entry. One option is that the IP address changes when not using the home network WIFI - so it was possibly my activity using cell data. But that doesn't explain why I was prompted to enter a new password.

I checked my android for malware with no returned flags.

What could be going on? If the account was compromised, how can I prove it, and how can I find out what sort of access the intruder could have gained? And are the steps I took good enough?

Answer 1

I have all but confirmed through toggling my cell phone from Wi-Fi to 4G that the long address is indeed the network IP address (Verizon service) that my phone used to access my Gmail address when I was in transit (outside the Wi-Fi boundaries).

Although this is a partial reply to the question, and in truth I still can't figure out why I was prompted to enter a different password, there has been zero strange activity that I could detect, or that Google recorded on any tracking or notification system.

So what did I learn:

1. Cell tower IP addresses may not match the State you are connecting from under the Last account activity at the bottom of the Inbox on the Gmail display on a laptop.
2. Confirm this by going to Settings on Android, selecting System, About phone, Network, and watching the IP address change as the phone is switched from Wi-Fi to 4G.
3. On Android, go to Manage your Google Account under Settings, then Security, and check Recent security activity to make sure any password changes were legit, and there were no new devices signed in. Also check Your devices under the same tab to make sure all devices are recognized.
4. If not your phone (for 2-step verification) it is at least worthwhile to link the account to some other Google account, since the absence of notifications as to any attempt at logging onto the account by an unrecognized device is reassuring.