Study: adding a recovery phone number to a Google Account can stop up to 100% of bot hijacking attempts, 96% of bulk phishing attacks, 76% of targeted attacks
Should You Provide It? Richard Lawler / Engadget : Google stats show how much a recovery number prevents phishing Patrick Howell O'Neill / Gizmodo : Here's the Best Way to Protect Your Accounts From Hacker Takeovers Abner Li / 9to5Google : Google shows how even adding a phone number can reduce account hijackings Tweets: @ohmdee : “Zero users that exclusively use security keys fell victim to targeted phishing during our investigation.” #U2F #Google https://twitter.com/... David Ruddock / @rdrv3 : Interesting security blog post by Google about 2FA. Long story short: almost nobody needs a physical security key - on-device prompts are essentially as effective, and don't require carrying an annoying dongle. https://security.googleblog.com/ ...
Context & Ripple Effects
This study is the consumer-facing middle step in a measurement lineage Google has been publishing for years. Its 2017 work with UC Berkeley quantified the threat — [[a:923944|788K credentials stolen via keyloggers, 12M via phishing, and 3.3B via third-party breaches]] over one year — and a 2018 report found none of Google's 85,000+ employees successfully phished since it mandated Security Keys in early 2017.
What changed in this post: Google applied the same before/after methodology to the controls ordinary users actually have — a recovery phone number and on-device prompts — and put block rates on them. The arc continues past it: by 2024, 400M+ Google Accounts had used passkeys, the password-free endpoint this research program was building toward.
First-order effects
- Users who add a recovery phone number get immediately measurable protection — up to 100% of bot hijacking attempts and 96% of bulk phishing blocked — while Google gains the efficacy data to justify nudging 2FA enrollment by default.
- The study also draws the tier line inside Google's own data: zero security-key users fell victim to targeted phishing, versus a 76% block rate for phone-based recovery, so the highest-risk accounts are pointed at hardware keys and on-device prompts rather than SMS.
Second-order effects
- SMS-based recovery's weaker showing against targeted attacks gives Google evidence to steer users up the ladder — from phone numbers to prompts to keys — shifting security-key vendors' market from enterprises toward consumer early adopters.
Third-order effects
- The study is a waypoint in Google's password-retirement path: the measurement discipline that quantified phone-based recovery is the same one later used to validate the passkey rollout, suggesting platform owners will keep replacing password add-ons with phishing-resistant defaults.
- If block-rate studies become routine, account security hardens into a measured, tiered product — cheap recovery for everyone, phishing-resistant keys for targeted users — rather than an all-or-nothing password choice.
The trend: Consumer authentication is moving from optional add-ons to phishing-resistant defaults, with Google publishing efficacy data at each step — recovery phones, security keys, then passkeys — to drive adoption.