Study: adding a recovery phone number to a Google Account can stop up to 100% of bot hijacking attempts, 96% of bulk phishing attacks, 76% of targeted attacks
Every day, we protect users from hundreds of thousands of account hijacking attempts. Most attacks stem from automated bots …
Context & Ripple Effects
This study lands two years after Google and UC Berkeley quantified the threat pool: an earlier Google-UCB study counted 788K credentials taken by keyloggers, 12M by phishing, and 3.3B exposed via third-party breaches in a single year. The new numbers answer the natural follow-up — how much protection does the cheapest possible defense buy? The answer is tiered: near-total against automated bots, high against bulk phishing, and notably weaker (76%) against targeted attacks.
First-order effects
- Users who add a recovery phone number get an immediate, measurable drop in hijack risk across all three attack classes, with the weakest coverage exactly where losses are costliest — targeted attacks.
- Google gains a low-friction onboarding lever: the study gives its prompts and security checkups concrete efficacy claims to drive recovery-info adoption at scale.
Second-order effects
- Because a phone number still leaves 24% of targeted attacks open, the findings funnel high-risk users toward stronger factors — the same logic behind Google's internal shift to physical Security Keys, after which it reported zero successful phishings among its 85,000+ employees.
- Rival consumer platforms face pressure to make recovery verification a default rather than an opt-in, since a free setting that blocks most bot hijacking becomes table stakes for account security marketing.
Third-order effects
- The progression from optional recovery data to hardware keys to the 400M+ accounts now using passkeys traces a structural path: each study narrows the case for passwords themselves, pushing the industry toward phish-resistant authentication as the default rather than the upgrade.
The trend: Account authentication is ratcheting upward — from optional recovery information to mandatory second factors to passwordless passkeys — with each Google efficacy study supplying the evidence for the next step.