I think it may be a bug in Google authentication mechanism. If you changed Gmail password, enabled two-step verification then all authentication tokens previously created for mobile devices (paired with your Gmail account) should be invalidated. This apparently did not happen as the intruder(s) still use your account on Android. I suggest you should contact Google Security team in this regard.
Cheers PS. You can also check if the Android device is on the list of application-specific password (Google -> Account Settings -> Security -> Application-specific password) and remove it if you find on the list. Do you know how your gmail account was hacked? Are you sure the intruder currently does not control your PC (and does not use keylogger or other malware) or do not control your own Android phone paired with your Gmail account? Be adviced that once intruder hacks your gmail account he may easily take control over your Android phone (if you have such paired with gmail account) by installing any applications he wants remotely via Google Play web console. On Tuesday, December 11, 2012 10:39:21 PM UTC+1, Wolf P wrote: > > My Gmail account was hacked and an unauthorized device was added to "My > Devices." I was never locked out of Gmail, but it was accessed by people > other than me. > > The person or persons have been ordering free apps and media from Play > which appear on my account. I implemented two phase verification and > changed my Gmail password, and the device is still there and the apps are > still being added. After much research and contact with support at the Play > store, it appears that the unauthorized device can't be removed!!! > > Please - can a Google employee help to get this resolved? > -- You received this message because you are subscribed to the Google Groups "Android Security Discussions" group. To view this discussion on the web visit https://groups.google.com/d/msg/android-security-discuss/-/wQTxJPMq8fgJ. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/android-security-discuss?hl=en.
