u/jrev8

This can be done by going to Niantic’s ‘Help with Sign-in Issues’ clicking the chat bubble ->sign in help ->help with account access -> provide email -> provide trainer nickname -> your preferred sign in method -> My account has been compromised by an unauthorized user
And follow those steps.

After an awful week, I discovered that your pokemon go account can be recovered by an individual using only photos you’ve posted of the account, and no access to your original email or authentication methods.

You get a single human reviewed recovery that can work a single time, and an automated recovery system forwards all attempts through it to the original ticket. Meaning, whoever has access to that first automated request ticket can get access to your account permanently by getting more attempts than you. Once it’s made, only the original creator of that ticket can use the automated system to recover the account. That ticket doesn’t even need your email associated with the account.

My account was stolen via this automated system and while Niantic refuses to help me more than that first time, the malicious actor was able to recover it several times through that initial ticket.

This is a backend exploit on Niantics side and you reading this or anyone else whose uploaded photos of your account to a brag/achievement forum are not safe from this happening to you. Niantic needs to solve this problem, but probably won’t because they’re grossly incompetent. Do this in the mean time and flag that initial automated ticket response so you can be safe from this happening to you in the future while still being able to recover your account.

I cannot emphasize enough my credentials were not stolen or accessed by anyone but me. No Pokémon trainer club account. All two factor, all track logins, all show ip/location/info of any device to have accessed. Looked through all my networks and personal hosts, there is not a single evidence of unauthorized access to anything of mine. Not even sim spoofing or forwarding for 2 factor codes.