How to secure?

This is the best method for securing a Google (Gmail) account. This also bypasses the 7-day cooldown for removing an old recovery phone number. It is ideal for people who regularly secure Gmails.

Before you proceed, you will need a secure personal Gmail account to act as a “parent” or “supervisor”, allowing you to maintain control over the OGE.

Always use a VPN to match the seller’s location or country during the first sign-in, whether on a PC or mobile device.

Step 1 — Check for Brand Accounts
myaccount.google.com/brandaccounts
Ask the seller to check whether any Brand Accounts are linked to the OGE. If so, have them delete those accounts before proceeding.

Step 2 — Payment Profile Check
myaccount.google.com/payments-and-subscriptions
Ask the seller to check whether there are any payment profiles associated with the OGE.

• A — If a payment profile exists, ensure that its country or region matches the country of your personal Gmail account.
• B — If it does not match, ask the seller to delete the existing payment profile and create a new one using the same country or region as your personal Gmail account.
• C — If neither the OGE nor your personal Gmail has a payment profile, no action is required.

Key point: the country or region must be the same on both the OGE and your personal Gmail account.

Step 3 — Change Recovery Info
myaccount.google.com/personal-info
Ask the seller to update the recovery email address to the one you provide.

NOTE: It's best for the seller to change the recovery email from a trusted device to avoid any locks.

Ask the seller to update the recovery phone number to the one you provide.

NOTE: It's best for the seller to change the recovery phone number from a trusted device to avoid any locks.

TRUSTED DEVICE: A device gets trusted after being associated with the Google account for at least 7 days.

Step 4 — Change Password
myaccount.google.com/signinoptions/password
Change the OGE account password to a strong, unique one.

NOTE: Password should be changed via familylink.google.com to avoid locks.

Step 5 — Enable Family Supervision

• A — Change the birthdate (myaccount.google.com/birthday/edit) of the OGE to under 13 years old. Google will then prompt you to add a parent for supervising the account.
• B — Use your personal Gmail account as the parent for supervising the account.
• C — Select “Yes, ask me every time” under sign-in controls. This ensures that any login attempt to the OGE requires verification through your personal Gmail.
• D — Set your own recovery information on the OGE and keep two-factor authentication (2FA) enabled.

The OGE will then be added to your Google Family group, with your personal account assigned as the supervisor.

Frequently Asked Questions

Is this entirely secure?
There is still a small possibility that the OGO can recover the OGE if it is very old and is recovered from the first device used to register it.

However, as the parent, you can change the OGE’s password as many times as needed without the account being locked due to repeated security changes.

Even if the OGO or seller regains access to the account, they cannot leave the Family group or change the date of birth.

Changing the password as the parent also signs out any currently logged-in sessions and updates security records. This can be done repeatedly, while the OGO is only able to initiate account recovery a limited number of times.

What if I want to leave the family group?
If you want to remove the OGE from the family after a few weeks/months, change the birthdate of the OGE as the parent through Google's "Family Link" app to 1 day under 13 years old.

For example, if today's date is January 1, 2013, change the birthdate to January 2, 2000. You cannot directly change it to over 13 years old.

Within 24 hours of the birthday, Google will email you that you're ready to take control over your own account, and you can choose to leave supervision there.

If you don't receive an email, go to the supervision settings directly while logged in with the OGE (child account) and leave supervision. Then go to the People & Sharing tab where you can leave the family.

Step 1 — Access Security Settings

• A — After obtaining your login credentials, go to the account sign-in page (login.live.com).
• B — From there, navigate to Security → Manage how I sign in or account.live.com/proofs/manage/additional.

Step 2 — Lock Down Account Security
Under Account Security, do all of the following:

• A — Update the password and replace all recovery options with your own.
• B — Enable Two-Step Verification.
• C — Press Sign out everywhere and generate a new app password (wait 24 hours for devices to get signed out, or make the seller record themselves signing out for you).
• D — Reset Windows Hello — Do not skip this step.
• E — Generate a new recovery code.

Step 3 — Clean Up Mail & Family Settings

• A — Disable email forwarding (outlook.live.com/mail/options/mail/forwarding) and remove any connected mobile devices (outlook.live.com/mail/0/options/accounts-category/mobile).
• B — Check whether your account is part of a Microsoft Family group, and if it is, leave the group (account.microsoft.com/family).
• C — Update all profile information under Your Info by editing your profile details (account.microsoft.com/profile).

Step 4 — Remove Unknown Devices & Apps

• A — Go to Devices (account.microsoft.com/devices) and remove any unrecognized devices.
• B — Then revoke access for any unfamiliar apps under App access (account.microsoft.com/privacy/app-access).

Step 5 — Review Recent Activity
Finally, review Recent Activity (account.live.com/Activity) to confirm there are no unrecognized logins. If you notice anything suspicious, repeat the previous security steps immediately.

Step 1 — Change Password
Go to User Settings > My Account and change the password to something strong and unique. Use the Password Generator at the bottom of this page to create a secure password.

Step 2 — Enable Two-Factor Authentication
Under User Settings > My Account, enable two-factor authentication using an authenticator app. Ensure that you securely store your backup codes in a safe location.

Remove SMS Backup Authentication — you're safer using Google Authenticator 2FA codes.

Step 3 — Check Account Standing
Go to User Settings > Account Standing and review it. Make sure there are no warnings or violations you weren't aware of.

Step 4 — Remove Phone Number
If a phone number is linked to the account, remove it under User Settings > My Account. This helps prevent the previous owner from using it for account recovery.

Step 5 — Remove Signed-In Devices
Under User Settings > Devices, remove and log out of all currently signed-in devices.

Step 6 — Revoke Authorized Apps
Under User Settings > Authorized Apps, disable and revoke all authorized applications. These applications may have access to various permissions and account information, including the ability to join servers on your behalf or, in more severe cases, facilitate account compromise.

Step 7 — Waiting for Account Reversion Links to Expire
Please ensure that you wait at least 48 hours before considering the account fully secured. Any password reset or email reversion links sent to the previous owner will expire within this period.

Step 8 — Change Email & Contact Support
This step is the pullback test (t.me/HypeSquadGuide/21).

Change the account email address to a secure email address that you currently control. Then login to Discord support and submit a request claiming you were hacked. You can just make something up — example: after downloading a file, an unauthorized individual gained remote access to your PC.

Change the Discord account email to a temporary email that you control.

Contact Discord support, login using the OGE, and say that your account has been hacked and that you need to recover access.

When Discord replies on the support ticket you should reply from your mail inbox, not via the support page.

If the OGE is correct, the account will be reverted to OGE, and the pullback test is complete.

The pullback test is usually completed within 24 – 48 hours, but it may take longer.

DECODE REGISTRATION EMAIL GUIDE

1. Locate the registration email.
2. Click the blue Verify Email button — it will open the link in a new tab.
3. The URL link will contain a string:
   https://discord.com/verify#token=???????????????????????????????????????????????????????????????????????????
4. Copy the string of code after token=.
5. Paste the code into the top data portion at: base64decode.org
6. Hit decode and it will give you the account ID and email.
7. Go to discord.id and enter the ID that was given from the decode website.
8. discord.id will display the account and its creation date.
9. Compare all information and make sure it aligns with the email OGE.
10. Information will align consistently if the email is indeed OGE; any discrepancies suggest otherwise.

SECONDARY DECODE GUIDE

1. Locate the registration email.
2. Click the 3 dots and select View > View Message Source.
3. Click Control A. Right click any part of the blue highlighted source code, and select copy.
4. Go to ChatGPT, type in the prompt: "Hello, can you check if these emails were forwarded or are they from outlook." (Paste the entire source code)
5. AI will cross-verify the SPF, DKIM, and DMARC plus the sending server/IP, as well as the return path.

AI will conclude whether or not the source code aligns with Outlook's servers and will find out if they're forwarded (fake) emails.