## TL;DR
Google auto-suspends accounts showing suspicious activity, sometimes a real compromise, sometimes a false positive from travel or a new device. Verify the activity with the user, appeal the suspension in the admin console, then re-secure the account.

## The query
```text
google workspace user suspended for suspicious activity: appeal steps
```

## Use this when
- user suspended for suspicious activity and claims innocence
- suspension after travel or a new device
- security wants the login evidence

## Not for
- suspensions for terms violations you uphold
- appealing someone else's personal account
- skipping the re-securing step

## Steps
1. In the admin console, open the user's security events and note the suspicious logins. Expected output: the triggering activity identified
2. Ask the user whether the activity was theirs: travel, new device, new app. Expected output: user confirms or denies
3. If legitimate, restore the user from the suspension in the admin console. Expected output: account restored
4. Force a password reset and review the user's sessions and app passwords. Expected output: account re-secured
5. Enforce 2-step verification if it was not on. Expected output: MFA active
6. If the activity was not the user's, treat it as a compromise: revoke sessions and investigate. Expected output: incident handled

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_skjEqsu9MVDy90Lfd3NMVg