google workspace user suspended for suspicious activity: appeal steps

TL;DR

Google auto-suspends accounts showing suspicious activity, sometimes a real compromise, sometimes a false positive from travel or a new device. Verify the activity with the user, appeal the suspension in the admin console, then re-secure the account.

The query

google workspace user suspended for suspicious activity: appeal steps

Use this when

• user suspended for suspicious activity and claims innocence
• suspension after travel or a new device
• security wants the login evidence

Not for

• suspensions for terms violations you uphold
• appealing someone else's personal account
• skipping the re-securing step

Steps

1. In the admin console, open the user's security events and note the suspicious logins. Expected output: the triggering activity identified
2. Ask the user whether the activity was theirs: travel, new device, new app. Expected output: user confirms or denies
3. If legitimate, restore the user from the suspension in the admin console. Expected output: account restored
4. Force a password reset and review the user's sessions and app passwords. Expected output: account re-secured
5. Enforce 2-step verification if it was not on. Expected output: MFA active
6. If the activity was not the user's, treat it as a compromise: revoke sessions and investigate. Expected output: incident handled

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_skjEqsu9MVDy90Lfd3NMVg