Gmail Username Changes Could Weaken Address-Based Spam and Phishing Blocks
Summary
Google lets users change their primary Gmail username while keeping the account and turning the old address into an alias. The author warns this could let spammers and phishers evade address-based blocks; Google limits changes to once per year, up to three times.
Key points
- Google allows users to change their primary Gmail username without losing the underlying account; the old address becomes an alias.
- The author warns that attackers could use renaming to evade recipient blocks based on email addresses, but the article provides no evidence of such abuse occurring.
- The author says attackers could retain email history and target lists rather than create new accounts.
- Google limits users to one rename every 12 months and three renames total, which the author says may constrain misuse.
Article Details
- Event Type
- Gmail username-renaming feature and potential abuse risk
- Impact
- Google allows users to change their primary Gmail username while retaining the account and converting the old address into an alias. The article warns that spammers and phishers could use renaming to evade address-based user blocks and resume campaigns, but reports no confirmed abuse. Google limits renames to once every 12 months and three times total.