Question TCL 50 pro NxtPaper showing up in google as two instances

[Saint]

I recently purchased this phone. A week ago my gmail was compromised by a hacker so everything has been put in place to sort it, password , new authenticator etc, but no factory reset as of yet.
However, every time I log in to google with my phone two instances still appear within an hour of logging in, (sometimes with a minute). The phone is a TCL 50 Nxt paper pro and the 2nd instance that logs in is named as T805D which is the model number of the TCL 50.
My concern is that the phone could have been emulated but it is a Dual sim phone one of which is an esim, (only using the physical sim at the moment), and I wondered if this could be the reason that I am seeing two phones connected i.e both devices are the same phone.

TCL support say it is because google doesn't detect the phone name straight away so uses the model number.

I am still not convinced of this though because when I sign out the TCL 50 Nxt paper pro in the google manager the T805D connection remains connected until i sign it out.
The TCL 50 instance never appears unless the TCL 50 Nxt paper pro logs in which is either because it's the same phone or my phone has been emulated/spoofed or the esim has been compromised.


Has anyone encountered anything like this before and can you help?
Thank you,
Ian

 

[Saint]

Anyone got any thoughts on this; i'm considering returning the phone but only have a few days.

 

[B. Diddy]

Welcome to Android Central! You mentioned no factory reset as of yet. Are you planning to try that?

What kind of hack did you experience? Are you saying that you changed your Google account password and instituted 2-factor authentication for it?

 

[Saint]

Thank you for the response B.Diddy, really appreciated. I did read that factory resetting can cause the duplication but that its identical and instant, (mine tends to be delayed), but i'm thinking of giving it a go.
However, I logged the TCL out and logged in with my old pixel 7 to gmail and changed the Authenticator. After 2hrs another Pixel 7 with slightly different wording showed as being connected.

The hack as far as i can see was he gained access to my Gmail account and got my passwords from the google manager. He compromised my Amazon, Steam, epic and roblox accounts extracting stuff from them. Luckily Amazon froze the account when they saw suspicious activity which drew it to my attention.

I changed the password, reset the 2-factor, new back up codes, changed the recovery tel number on google and changed around 100 passwords on various accounts and stopped the 'save to google password manager' option being offered.

There have been no compromises of any accounts since the 5th but i'm paranoid he's still in my phones and waiting to pounce

 

[B. Diddy]

It's tough for me to test this, because that would require changing my Google account sign-in and authenticator, which I'd rather not do.

Doing a factory reset can cause duplication, but that would show up as a prior instance that remains there until you remotely sign out of it in your Google account's Security page. I'm not quite sure why you're getting two instances that show up each time you sign into the phone. What happens if you remotely sign out of the instance with the slightly different wording? Does it kick you off your Google account on the phone, requiring you to sign back in?

 

[Saint]

No they seem to be two separate instances and each one has to be signed out individually
I have just deleted the esim data from the tcl to see if anything happened but the 2nd instance connected a few minutes later.

 

[B. Diddy]

Hmm. And you don't have multiple profiles set up on the phone, right?

 

[Saint]

No they seem to be two separate instances and each one has to be signed out individually
I have just deleted the esim data from the tcl to see if anything happened but the 2nd instance connected a few minutes later.

Hmm. And you don't have multiple profiles set up on the phone, right?

No just the one. On the TCL, the suspicious instance also states its on an android tablet and not an android phone. Also, I don't get any prompts of 'is this you Yes or No' I just get asked for an authenticator code. Does the authenticator override the yes/No prompts do you know?

 

[B. Diddy]

Where and when are the prompts you're referring to?

 

[Saint]

No just the one. On the TCL, the suspicious instance also states its on an android tablet and not an android phone. Also, I don't get any prompts of 'is this you Yes or No' I just get asked for an authenticator code. Does the authenticator override the yes/No prompts do you know?

I used to get a prompt on my mobile if , for example, I tried to log onto google with my PC, and the prompt would ask me to verify yes/no if it was me logging in but I don't get that anymore.

 

[B. Diddy]

Go to Settings>Apps, select Google Play Services, then Notifications. Is the toggle on for "Prompts for Sign-in"?