• Google finally allows users to change their Gmail usernames after two decades
• Changing usernames may increase risks of impersonation and phishing attacks
• Experts urge users to adopt privacy-first habits for better email security

Pascal Oparada is a journalist with Legit.ng, covering technology, energy, stocks, investment, and the economy for over a decade.

After more than two decades, Google has finally unlocked a long-requested feature: the ability to change your primary Gmail username. No more being stuck with that cringeworthy address you created in 2004.

But while the update sounds liberating, it comes with a stark warning—most of Gmail’s two billion users may still need an entirely new email strategy.

The big announcement that sparked a Furore

Google CEO Sundar Pichai personally hyped the change on X (formerly Twitter).

“2004 was a good year,” he posted, “but your Gmail address doesn’t need to be stuck in it. Say goodbye to v0t3f0rp3dr02004@gmail.com or mrbrightside416@gmail.com.”

According to a report by Forbes, users in the U.S. can now head to their Google Account settings, select a new available @gmail.com username, and make the switch.

Your old address remains active as an alias—emails sent to it still land in your inbox, and you can sign in with either. Data, photos, Drive files, and messages stay untouched.

You can change your username up to three times (four total, including the original), but only once per year, with limits on reverting.

On the surface, it solves an embarrassing problem for millions who have carried teenage or college-era handles into professional life.

Yet cybersecurity experts say this “huge shift in how identity works online” fails to address the deeper, more dangerous flaws in modern email.

The real problem Gmail still won’t fix

Once an email address enters the wild, whether created in 2004, 2014, or even 2024, it quickly ends up in marketing databases, breach lists, and scammers’ toolkits. Changing your visible username doesn’t erase that history.

Your old address keeps working as an alias, meaning spam and phishing attempts targeted at it continue arriving.

Worse, security researcher Jake Moore from ESET warns that the change could actually increase risks. Old addresses functioning as permanent aliases “potentially increase impersonation and phishing attacks.”

Attackers could exploit the confusion between primary and alias addresses to impersonate you or trick recipients.

Even more concerning, some users are already reporting sudden surges in spam after the rollout.

Security analysts note that many email providers rely heavily on the address itself for blocking filters.

Renaming your account essentially gives it a “fresh start” in the eyes of those filters, allowing previously blocked malicious senders to slip through again until new blocks are built.

Attackers who get blocked can also rename their own sending addresses to reset the cycle.

What Google missed: A true privacy shield

Apple users have long enjoyed “Hide My Email,” a feature that generates random, disposable addresses for sign-ups and checkouts.

These are forwarded to your real inbox but can be deleted instantly, preventing your primary address from ever being stored in third-party databases. You control forwarding or shut it off completely.

Google has reportedly been developing something similar—sometimes called Shielded Email, but it remains unavailable to most users.

Without this “hide my email” equivalent, simply swapping one Gmail address for another offers limited protection.

As soon as you start using the new address for logins, shopping, or newsletters, the exposure clock resets.

Experts recommend creating a completely separate email account for high-risk or frequent sign-ups, reserving your main Gmail (or new changed address) for trusted contacts only.

You wouldn’t hand out your phone number to every website—your primary email deserves the same caution.

Hidden dangers when making the switch

If you decide to change your Gmail address, stay vigilant. Phishing campaigns are already leveraging the news, sending fake “update your Gmail” emails with malicious links that lead to credential-stealing pages.

These scams appeared in earlier rollouts in other markets and are now targeting U.S. users.

Additionally, the alias system means your inbox could become more cluttered, not less.

Old spam routes remain open, and the temporary reset of spam filters could flood your inbox before protections catch up.

The bottom line: Time for a fresh start

Google’s update is a welcome step for cleaning up outdated identities, but it doesn’t solve email’s core vulnerability: once leaked, an address stays compromised forever.

For real control, consider adopting privacy-first habits—use alias services where available, create dedicated secondary accounts, and treat your primary email like a closely guarded phone number.

Apple users already have stronger tools, though even “Hide My Email” has limits: law enforcement can still request the underlying real address from Apple if needed.

In the end, after 22 years, Google has given users more flexibility—but true email privacy still requires proactive steps beyond what any single provider currently offers.

If your inbox feels overwhelming or your address has been circulating for years, now might be the perfect time to build a cleaner, more secure setup from the ground up.

FBI reveals dangerous apps iPhone users must delete

Legit.ng earlier reported that the Federal Bureau of Investigation (FBI) has issued a fresh warning to smartphone users, urging caution when downloading mobile applications.

While many of these apps rank among the most popular globally, authorities say some may pose serious data security risks, especially those developed by foreign companies.

According to a Public Service Announcement, the agency stated that a significant number of top-performing apps in the United States, and by extension, worldwide, are owned or maintained by firms based in China.

Source: Legit.ng