Why would someone use my email address in his Gmail registration?

Question

I got an email from Google no-reply@accounts.google.com saying the following about the gmail address of an acquaintance that is supposedly connected to a non-gmail account I use:

> The password for your Google Account - &&&&&&(changed)&&&&&@gmail.com
> - was recently changed.  If you made this change, you don't need to do anything more. 
> 
> If you didn't change your password, your account might have been
> hijacked. To get back into your account, you'll need to reset your
> password. 
> 
> Sincerely, The Google Accounts team    This email can't receive replies.
> For more information, visit the Google Accounts Help Center.   If
> &&&&&&(changed)&&&&&@gmail.com isn't your Google Account, click here to
> disconnect your email address from this account.

As you can see, gmail is giving me the option of disconnecting my email from his gmail account, but before I do and without asking him I am wondering what earthly reason he could have for giving my address to gmail as his own.

Is this some kind of technique to build history to eventually hack into my gmail? I don't see how.

Answer 1

TL;DR: It's probably exactly what it purports to be.

I got a Gmail address during the beta, so mine matches my (very common) name. I routinely get messages from Google saying that some account has been created and my address used as an alternate contact. I routinely click the "unlink this account" link and am never bothered by that address again.

Why? Well, in a small number of cases I think people really are too clueless to know their own email addresses. More likely the person creating the account is up to something, not necessarily extremely bad, but requiring anonymity. In the alternate address field, they put a plausible but (to them) fake address that turns out to be mine. That could be the case with your acquaintance.

What to do? Examine the "click to unlink this account" link very carefully by viewing the message source. A real link from Google looks like this:

https://accounts.google.com/AccountDisavow?adt=AOX8kir9Wk1MCXKhmJxH-rEC[redacted]

If so, click the link; problem gone. (I removed a part of the opaque token from the example link, but I probably didn't need to. Even if someone navigated to my example link, it would just try to disconnect an account that's already disconnected.)

I didn't really understand the "acquaintance" part of your message. If you are telling us that you recognize the alternate address as that of someone you know, disconnect it anyway because your account should not be connected to one you don't control. Then ask your friend what's going on. It might be as innocent as your friend wanting your help if he ever locks himself out of his account. But he (or she) should have asked you first.

It is possible that this is a phishing attempt and the sender wants to steer you to a particular link. Looking at the link should tell you. In any case, real Google "disconnect" links just tell you that the address has been disconnected and tell how to undo that if it was a mistake. They do not ask for authentication. So, never, ever supply authentication information like a password after clicking such a link.

Answer 2

As Ulkoma pointed out, there is a high chance that this mail is a fake to trick you into clicking the link which allegedly allows you to remove your mail address. Mocking the sender address is easy in SMTP. The link target could be a phishing and/or malware distribution site. So you should not click on it. If you hover over the link the target should be shown in the footer of your browser window. Fake sites usually reside on look alike domains - for example google.com.tld (tld being an arbitrary top level domain).

However if you are using a popular ISP (Gmail, MSN, Yahoo, ...) it could be that someone misspelled his own mailadress. Or it is a burner account and someone entered a random address.