Let me tell you a story, a horrifying story. Like all really good scary stories, this one begins innocently enough. Way back in 2018, I was starting the accounting program at Western Dakota Technical University in Rapid City, South Dakota. We students were creating new email accounts so we could communicate with our instructors. I was surprised to find out that the email name I wanted was actually available. It was simple, super easy to remember and seemed perfect for that time in my life. I became “AllNewSue”. It. Was. Perfect.
Over the next twenty-two years, I kept emails from every bank, every cell phone company, every friend and family member I had. I emailed myself pictures, recipes, legal documents and other things I wanted to save. I had a timeline of every doctor’s visit, vet visit, bank deposit and job application. It was THE electronic representation of more than two decades my life. I am not at all exaggerating when I say I accessed my email account multiple times a day, almost every single day, for over eight thousand days.
WHAT DO YOU MEAN YOU CAN’T VERIFY ME?!
One day this year, April 9th, actually, I was logging into my laptop to check email like I do every morning. It was a normal Saturday, just like any other. Oddly, I found that I had been signed out of my account. There was a message that said something like, “You have been signed out of all devices as a security measure”. That’s not the exact wording, but it did specifically say I had been signed out of everything. So, like I had done many, many times before, I casually entered my email and password, sipping coffee and ready to read up. But now I was being asked for my eight-digit backup code. Wow, I vaguely remember getting a list of six different back up codes and saving them…. somewhere. Of course, that had been four cities, three states and one country ago.
At this point, I refilled my coffee and began looking for those codes. I couldn’t find them easily so I clicked the option to “Try another way”. Interestingly, the ‘other way’ being offered was to send a verification email…to the email address I was trying to get into in the first place.
Wait, I have a backup email address on this account. Why isn’t the verification email being sent there? That’s odd. Since I had no access to this account or the backup codes, I began the account recovery process. I answered a whole bunch of questions like the approximate date I created this account, my last password as best I could remember, my security question and the square root of purple (or something like that). I sent that in, knowing I had answered correctly, and moving on to other activities while waiting for my request to process.
We are unable to verify this account belongs to you.
That’s what the responding message said. Well, that’s just ridiculous, I thought. Of course, you can verify me. I gave you all the information you asked for and I answered all the questions correctly. What in the heck? So, I searched the internet for suggestions. The first suggestion was to try logging into the account from a different device where I had already been logged in before. It’s a great thought, but unfortunately, since Google logged me out of all devices, I was hitting the exact same roadblock. After trying three phones, a tablet and even hubs’ laptop, I was at a standstill.
I feel sick.
I can remember feeling the heat in my face, the sweat on my brow and my heart dropping into my stomach like it was jumping off the top of an eighty-four-story building. This absolutely cannot be happening, I thought. I was not going to accept that this was real. I backtracked to the eight-digit backup codes… I knew I had them somewhere at some point on some computer. I can vividly remember seeing those codes on my screen and recording them somewhere. Was it a file on my laptop? Was it on this laptop or the one before or the one before that? A picture on my phone? Did I write it down and stash it somewhere?
The search is on.
I was on a mission. I searched every desk drawer, every file folder (electronic and hard copy), and even my firesafe. I searched the internet for any hacks or cheats or keys or decoder rings that might be of help. When I posted about my issue in the support pages, I got several offers from very generous and kind-hearted hackers who were willing to take a stab at it. I humbly declined their gracious offers. In my desperate state, I briefly considered inviting hackers into my laptop. However, using my vivid imagination I could see having my identity stolen by some hacker I had invited into my electronic safe space, and having to explain to the authorities that I really wasn´t normally that foolish. Nope. Never mind.
A friend sent over her favorite computer expert and within twenty minutes he confirmed my worst fears. This account was dead, beyond the reach of modern technology. I was going to have to rebuild my electronic life from scratch. I paid the kind gentleman for his time, and planned a funeral for my twenty-some year-old email account.
Accepting my fate.
While I hated to do it, I realized I couldn’t put this off any longer. I created a new email account. I liked the new name. Just like the one before it, this fit the current circumstances of my life. And there was something refreshing about having a completely empty email account. I could start over knowing what I know now. For instance, I am a lot more selective about who I sign up with to get their emails. I am also backing up my email accounts onto a jump drive, just in case. I have made sure all my personal information is updated and I have created a fabulously difficult password that is saved in my spanking new password management software.
I have a spreadsheet that lists all of my electronic accounts, everything from banks and social media to online clothing stores and healthcare apps. I had over 200 online accounts. And probably 75% of them used the now defunct email address, either for a login ID or for verification emails. Most of these accounts were very easy to update. A few required an email or special request to make the needed changes. And a handful could not be updated at all and had to be forsaken for new accounts created with the updated email.
The first three days after I created my new email address, I spent most of the daylight hours making these updates. It was a painful reminder of how much of my life had become entangled in electronic identification. It was also a lesson in online security I was not likely to forget anytime soon.
It’s a cruel joke.
It was three weeks to the day after I had been locked out of my account. I had updated most of my accounts. I was back to my routine of drinking my morning coffee while skimming through emails. When I opened my email account, I had an email from Google that said my old account had been deactivated in error and I was welcome to try logging in again. Despite the hopeful lurch I felt in my heart, I refused to believe this was going to work. It would be just like some heartless techno-bureaucracy to tease me like that, wouldn’t it?
I tried logging in and was immediately notified I needed to pass two-step verification by entering one of my backup codes. Ugh! Didn’t I already beat my head against this proverbial wall? Yes, yes I had. I clicked the link to try another way and once again, the verification email would be sent to the account I was already unable to access. I clicked the account recovery button and this time, it asked me for an email address I could still access. When I submitted that info, the auto-response said, in effect, give us 48 hours to review. I moved on with my life. I had already been told in no uncertain terms I could not ever access this account again.
Surprise, Surprise.
Two days later, I received an email stating that the account recovery request had been approved and two-step verification had been removed. I reread the email at least a dozen times, looking for the tiny print, the disclaimer, the loophole that inevitably block my access. I couldn’t find any. So, I gingerly and carefully typed in my login and password. I could not believe my eyes when my email page suddenly appeared. There were some cobwebs and almost 300 emails in my inbox, but I was in.
To heck with the emails, I thought. I needed to make sure this door never locks on me again. I immediately updated all my information. Even though it is not recommended, I shut off two-step verification, for the time being. In my mind, it’s the electronic version of blocking the door open until I can make sure I’ve got everything out (or in) that I need.
The moral of the story.
I feel more than a little sheepish about my previous lack of concern and diligence when it came to keeping my contact information up to date. But rather than waste time beating myself up for past mistakes, I’m learning from the experience and putting those learnings into practice. This experience was very much like moving from the US to Mexico in that I had to clean out and clean up over twenty years’ worth of messy electronic accumulation. When I regained access to my original account, I was able to look at my collection with a much more critical eye, and as a result I have been able to get rid of a lot of electronic clutter. I have implemented tools to prevent this situation from happening again. And I have been sharing my experience freely in hopes of saving someone else from having to go through this, too.
