User suspended due to Payment Fraud Hijacking

Problem

Unable to access user account due to being suspended.

Environment

  • Google Workspace
  • Domain type is Non-GDR
  • It's a super admin without 2SV enabled

Solution

  1. Log in with the affected account where a Google Account disabled due to suspicious activity page is displayed.
  2. Click on the Having trouble signing in link and then select the option I'm having other problems signing in
  3. Enter the email address of the affected account and the last password you remember.
  4. You will be prompted to verify that you own the domain by adding a CNAME record in your domain host's control panel. Follow the instructions provided in adding the CNAME record. Once added, do not forget to go back to the list of steps and click on I have completed these steps in order to initiate the verification process.
  5. After verifying your domain via CNAME, you will receive a link to a set of questions about your Google Workspace account. Once we verify that you own the account through your answers, you will be directed to a password reset link.
  6. Resetting the password will restore the suspended super admin account.