Google announced an update to their inactive account policies in May. Accounts that have been inactive for a period of two years or more will start being deleted in December 2023, at the earliest.
This policy change is meant to enhance security, as abandoned accounts are more likely to be compromised and 10x less likely to have multi-factor authentication enabled. The policy applies to content within Google Workspace (Gmail, Docs, Drive, Meet, Calendar) and Google Photos.
A few ways to keep an account status active include reading or sending an email, using Google Drive, watching a YouTube video, downloading an app on the Google Play Store, using Google Search and more. Google's announcement post gives more details around affected accounts, backup instructions, and more.
While account deletion isn't set to begin for several months, notification emails have started going out to account owners. We haven't seen them yet, but this is prime fodder for phishing attacks that impersonate Google. It's only a matter of time before cybercriminals use this news to scam people into going to malicious websites, where their Google account credentials can be harvested.
You should warn your users now to keep them aware of potential attacks. Any urgent account alert emails should be scrutinized closely. Instead of clicking a link in an email, it's best to go directly to Google accounts that could be affected by this policy change.
New-school security awareness training can give your employees a healthy sense of suspicion so they can avoid falling for social engineering attacks.
