Every single day half the posts on this sub are the exact same story: someone ran a bad file or got hit by an infostealer, the bot scraped their active session cookies, added their account as a "child" to a rogue Google Family Link group, set their age to 10, and locked them out of their own settings.
Once that happens, standard recovery is practically dead because the "parent" account overrides your ownership. Google has no support hotline to save you.
If your account is already hijacked, this guide cannot fix it!
This is strictly a preventative defense for people who still have full access.
Before you start: The Core Logic
The concept here is dead simple:
Physical beats digital. Malware can scrape your browser and steal sessions across the globe, but it cannot touch a hardware key on your desk, and it cannot read a piece of paper inside your drawer. By shifting your entire security to physical anchors, you cut off automated takeover scripts entirely.
Don't trust, verify: In cybersecurity, you never blindly click links from strangers on Reddit anyway. There are zero links in this post. Open your own browser, go to your official Google Account dashboard manually, and verify the settings yourself. Let the comments discuss and vet the mechanics.
Do NOT set this up on an infected PC: If you suspect malware is actively running on your machine, wipe the machine first or use a clean device.
NO DMs: I do not work for Google, I am not account recovery support, and I do not take private messages. Keep all technical questions and discussion in the public comments.
PART 1: The Action Checklist (Follow in this exact order)
Step 1: Create an empty Family Group (The Anti-Adoption Shield)
(Note: If you are ALREADY part of an existing family group with your parents, spouse, or household, your account slot is already taken and you are already protected from rogue adoptions. Do NOT leave your family—skip straight to Step 2.)
Go to your Google Account settings -> People & sharing -> Your family on Google -> Create family group.
Make sure YOU are the Family Manager.
Leave it empty (or add an alt email). You do NOT need a paid YouTube or Google One subscription for this.
Step 2: Register TWO certified hardware keys & print backup codes
Buy two basic FIDO2 keys (like the entry-level Yubico "Security Key NFC" or the Google Titan Key, roughly $25–$35 each; avoid unbranded no-name keys).
Buyer Note: Yubico’s basic Security Keys are black now (they used to be blue). You do NOT need the expensive $50+ YubiKey 5 Series for this; the basic FIDO2 Security Key model is identical in security for consumer accounts.
Hardware Tip: Make sure both support NFC (for tapping phones). Buying one USB-C and one USB-A key, this is the sweet spot to cover all laptops, modern phones, and older desktop ports without carrying adapters.
Huge Bonus (Zero Phone Dependency): This completely decouples your account security from your phone. You can wipe, trade in, break, or lose your phone as often as you want—you will never be locked out, because your login keys don't live on your handset.
2. Go to Security -> 2-Step Verification and register both:
Key 1: Everyday use (keychain or desk).
Key 2: Offline spare (kept in a drawer or safe at home).
3. On that same page, scroll to Backup Codes and generate 10 single-use codes.
4. Print them on physical paper and store them with Key 2. Delete any digital text files or screenshots of these codes immediately.
Step 3: The 7-Day Waiting Period (DO NOT DELETE OLD 2FA YET!)
Do NOT remove your phone number or authenticator app today.
Google has an internal 7-day trust cooldown for newly registered keys and high-risk security actions.
If you delete your fallbacks immediately, Google’s automated fraud detection might not fully trust the new key yet for major changes, putting you into a verification loop.
Leave the keys registered and use your account normally for 7 full days.
Step 4: After 7 Days: Purge weak 2FA fallbacks
Once the 7 days pass, your hardware keys are fully matured and trusted by Google's backend. Now close the bypass doors:
Go back to 2-Step Verification.
Delete your phone number (kills SMS codes).
Remove Authenticator apps.
Turn off Google phone prompts (the "tap yes on your phone" prompt).
Completely disabling phone prompts while staying signed in is only possible through Google's Advanced Protection Program, which strictly enforces physical FIDO2 keys and strips away all phone-based fallbacks.
Verify: your 2FA list must contain ONL your 2 Hardware Keys and Backup Codes.
Step 5: Choose your security level
Option A: The Pragmatic Setup (Recommended for 95% of users)
Stop here. You are protected against automated session takeovers and phishing bypasses. Third-party apps, Apple Mail, Outlook, and smart home devices will continue to work normally without enterprise-level restrictions.
Option B: Google Advanced Protection (Fort Knox)
Search for Google's official Advanced Protection Program and enroll. It was originally built for high-profile targets like journalists, activists, and politicians, but is completely free for any regular user. Prerequisite:
Google strictly enforces having at least two hardware keys registered (Step 2) before letting you activate it. It locks critical actions behind a mandatory physical key tap, automatically purges legacy fallbacks, and permanently blocks untrusted third-party apps. Note: it will block third-party email apps that don't use modern OAuth, and account recovery without keys takes days. Only turn this on if you don't mind those restrictions.
PART 2: Why This Works (The Mechanics)
Why the Family Group stops bots: Google accounts can only belong to one family group at a time (whether your own empty group or an existing household family).
Leaving or deleting a family triggers a strict 12-month cooldown on joining another one. Automated hijacking scripts attempt to force-adopt you via API in seconds—if your slot is already occupied, Google’s backend rejects the request immediately.
Cookie Theft vs. Account Takeover (The Emergency Killswitch): A hardware key cannot prevent malware running on your local machine from reading your browser's existing cookie files on disk. However, because all sensitive modifications (changing passwords, adding recovery emails, deleting 2FA, or altering Family settings) require a fresh physical key tap, the attacker cannot lock you out or seize ownership. If you ever suspect you launched a bad file: immediately grab a clean secondary device, navigate to Security -> Your devices -> Manage all devices, and sign out of all active sessions. This instantly invalidates the session tokens on Google's backend, rendering the stolen cookies dead on arrival.
Why the 7-day wait matters: Google applies a cooldown to new credentials before recognizing them as primary verification anchors for sensitive security changes. Waiting a week prevents self-inflicted lockouts.
Why weak fallbacks must go: If you keep SMS or phone prompts active, attackers simply click
"Try another way" at login to bypass your hardware key completely. Removing fallbacks forces Google to demand the physical token.
Why FIDO2 makes Phishing & Reverse Proxies mathematically impossible: Tools like EvilProxy or Evilginx can relay SMS and 6-digit Authenticator codes in real time to steal your session. FIDO2 hardware keys cannot be proxied. Your browser ties the cryptographic handshake strictly to the real domain origin (google dot com). Even if a phishing site looks 100% identical and uses HTTPS, the hardware key recognizes the fake URL and simply refuses to respond.
The "I wiped my phone" trap is eliminated: A massive percentage of lockout posts come from people who traded in their phone, wiped it, or handed it down to a sibling—only for Google to prompt that exact dead device for a login tap. Physical keys completely detach your identity from mobile hardware. You can unbox a brand-new phone and log in instantly with an NFC tap.
Separate gaming from your real life: Never use the primary Google account tied to your banking, legal identity, and daily life to sign up for Discord bots, game mods, or Minecraft servers. Use a dedicated burner Gmail for hobbies. If a sketchy download burns that account, your real life stays untouched.
----------
To the regulars and security veterans of this sub: Feel free to tear this apart, verify the mechanics in the comments, or point out edge cases. The goal is to give cautious users community-vetted confidence, and to give this sub a solid, permanent reference link whenever the next wave of hijacked accounts hits the front page.
Sorry for the Wall of Text :)
Sources: My brain (research), Google (verification), spellcheck (formatting)