Way back in 2015, I became a beta tester for Google’s “Project Fi.” I had been using AT&T for my cellular phone service, and switching to Fi as my cellular carrier dropped my bills from nearly $200/month to around $30/month. In addition, it was a lot of fun: Google sent us presents and a lot of friendly, supportive emails and implemented features that were pretty darned cool.
I stuck with Project Fi (now “Google Fi Wireless”) until the end of 2025, when I switched carriers because the coverage on the island was really spotty, and completely nonexistent in my neighborhood. But back in the day, when my teenage son got his first mobile phone, I signed him up with Fi. At the time, you couldn’t add additional lines to your account, so I had to create a new Google account just for that purpose, but it had to be in my name because he was too young.
It just worked, and well enough that we just kept everything as it was when he went away to college, then grad school, then thousands of miles away to his first job. I moved thousands of miles in the other direction to live on the island compound, and still all was well.
A few days ago, he lost his phone. He got a new phone, and tried to activate it with Google. No go. The account still belonged to me. He sent me an email, but my spam filters thought it was a SIM-swapping attack and bounced his mail.
He became the first person in history to ever actually read and appropriately respond to my bounce message, and sent another message that just said “you rejected my email as spam.” Naturally, I immediately allow-listed him. Then I tried to get his phone activated from 4,000 miles away.
The next glitch was that the Google account I’d created had a very old phone number associated with it. In the years since I had created the account, Google has implemented multi-factor authentication (MFA), but that ancient number doesn’t accept texts. Fortunately, they’d put in an override that will call instead of texting, so I was able to sign in to the account and change the phone number to my current one.
I sent the credentials to my son, who was able to sign into the account when I forwarded the MFA code (that had come to my current number) to him when I received it. When he tried again to activate the phone, however, Google sent another verification text message to the old number that doesn’t accept texts. This time there was no option to make a voice call, and no other option to bypass the MFA. He tried all kinds of workarounds, that eventually resulted in having all his Google accounts locked for four hours. Supposedly, though, he’d already created a passkey for signing in and they were supposedly updating the phone number.
When the hours had passed, he tried again. Once again, though, Google texted the authentication code to the ancient old phone number that doesn’t accept texts.
In a fit of desperation, I asked Google’s AI chatbot Gemini for help. Gemini was quite apologetic, but walked us through a number of turning-it-off-and-on-again steps. Eventually, my son got to the point where it sent the activation text to my current number. At last! I emailed the code to him, and he got the activation process going until…
“There’s been an error. Try again in a few minutes.” Repeatedly.
Gemini apologized for the fifth or sixth time, and suggested using a different WiFi. Since he was headed home, my son said he’d try again when he got to his home WiFi. At this point, we’ve send and received 65 emails. We’ve been working at it for two days. Gemini tells us we “have a good plan” and will be there for us if the problem isn’t resolved when my son tries his home Wifi.
Given the problems that can be wrought by sim swapping attacks, I’m glad that Google has some tight security around activating new phones on an old number. On the other hand, hanging on to a ten-year-old number and unilaterally deciding to start using it for SMS MFA without notice and then failing to change it even when the main account number changes seems to be a serious failing.
—2p