Updated on Jan. 18 with a new warning for Gmail users as an attack is confirmed underway, tricking users into changing their email addresses to hijack accounts.
Google has just changed Gmail after twenty years. In among countless AI upgrades — including “personalized AI” that gives Gemini access to all your data in Gmail, Photos and more, comes a surprising decision. You can now change your primary Gmail address for the first time ever. You shouldn’t hesitate to do so.
This new option is good — but it’s not perfect. And per 9to5Google, “Google also notes this can only be done once every 12 months, up to 3 times, so make this one count.”
Yes, you should change your email address. But only as the first part of a two-part strategy. It’s an opportunity to freshen your digital footprint. Change the address in Gmail and then change the email address in all your key accounts to the new one.
If you do that fully, you isolate the old address to accounts you no longer or rarely use and databases beloved of marketeers and breaches beloved of fraudsters.
At least for now.
You will then have options to filter emails sent to the old address, deprioritizing if not ignoring all that traffic. Google does a good job of filtering spam and scams. But it’s not good enough to relax your guard. Too much still gets through.
What you really need — arguably more than this change — is the promised but as yet undelivered shielded email update to Gmail. That gives you the option to provide temporary, throw-away aliases at the tap or click of a button when asked for your email address. That update alongside the Gmail address change update would be perfect.
Google has just told users eagerly awaiting this address change update that “the ability to change your Google Account email is gradually rolling out to all users and this option may not be available to you yet.” So, don’t be alarmed if you don’t see it yet.
Email needs a rethink. For decades we have given away our primary email addresses to almost anyone that asks without much thought. And yet we use those same addresses as the unique identifier to most accounts and services as well. This a welcome opportunity to tidy up your digital footprint — don’t waste it.
Meanwhile, a timely new warning has just been issued for Gmail users, as attackers are caught using the new address change feature as a lure to attack and hijack accounts.
Security researchers warn that “cybercriminals have begun exploiting a forthcoming address‑change functionality. By sending fabricated ‘address‑change confirmation’ emails, they bypass spam filters because the messages appear to be system‑generated notifications.” This leverages all the news coverage to trick users into engaging.
The new messages are AI generated and personalized. “The content is so realistic that users often cannot distinguish it from genuine communications.” This may come at you by email, but it also may be sent via a WhatsApp message with a link.
You must never log into your Google account via any form of link, whoever it seems sent that to you. Always access your account the usual way. You must also add two-step verification (an authenticator app not SMS) and a passkey to your account. You can change your Gmail address directly within your account settings when enabled.