Even at Google's scale, they cannot afford to provide high-touch tech support for 1.5 billion users. The fact Gmail is possible is partially due to their ability to scale low-touch tech support for free by supplementing the cost from other sources and, sometimes, just providing best-effort support.
(Remember, the cost isn't "How do we field calls from a fraction of our 1.5 billion users," it's "How do we tell whether that phone call is an actual user, or just an attacker treating our phone service as yet another attack vector?")
Keep in mind that all three of these companies provide support primarily to customers who have paid them. If you are on the phone with Apple about being locked out of an account, you have likely spent at least several hundred dollars buying their devices.
Apple has a full order of magnitude fewer iPhone users than Gmail accounts. I'm pretty sure, unless I have misunderstood, that acquiring an iCloud email account requires ownership of a physical Apple device... If you're suggesting we should back-stop this problem of marginalized users losing access to Gmail by subsidizing the homeless or elderly to own iPhones, I don't think it will work.
Amazon is similarly an order of magnitude fewer users than Gmail accounts (and tends to address this issue by pushing the hard-to-address auth problems onto the seller... There are known exploits for just pushing exorbitant costs onto the seller via buyer fraud). Amazon has a couple hundred million customers... Gmail is in the billions.
I am, perhaps, just simply old enough to remember when not everyone could have a Gmail account. Low touch customer service that works 99 plus percent of the time was necessary to open the floodgates for free. I have never seen a practical explanation of how to scale providing the service otherwise. There's room for improvement, but (a) every simplification of authentication must be balanced against how it can be abused to steal accounts, and (b) I cannot conceive of a solution that would rival high touch customer service, and that scales to the billions. If one exists, I look forward to being extremely pleasantly surprised (having myself been on the receiving end of losing my phone while away from home for an important event: yes, it really sucks, Google's trust model is they trust you zero without some corroboration if all you show up with is the password). But I've watched them hammer at the problem long enough to suspect it's uncrackable at the billions-scale.
That's a pretty [citation needed] assertion. Again, we're talking a risk surface stretched across 1.5 billion users. There are few architectures of that scale in existence today; we're talking Chinese government, every-bank-on-Earth numbers.
I'd be interested to see a workable solution but, to-date, I never have.
I remember being *stunned* in a positive way by Google's out of the box thinking back when they *invented* "self-service" account management, aka "no phone support provided". I thought that it was a brilliant move and that this little search company was really going places.
I hope I might be forgiven for failing to anticipate the consequences for our least affluent sisters and brothers.
I am now of the opinion (for many, many reasons) that human-interactive customer support is a mandatory cost of doing business when your business is materially important in the lives of the customers (both paying and not paying customers).
That Gmail is "materially important" is well established already, yes?
There are legal requirements of banks carrying enough PII on a person to reliably unwind an auth attack (and also to send the cops after them if they are the ones who commit fraud).
This would be one solution. But it would require Google to hold significantly more PII, explicitly, on every Gmail user than they do right now (and make the process of opening a Gmail account take a bit of time, like it does at a bank). This is one of the better suggestions I've heard, though it would threaten the integrity of the existing 1.5 billion accounts unless Google grandfathered them into a "low-identification" status.
(Remember, the cost isn't "How do we field calls from a fraction of our 1.5 billion users," it's "How do we tell whether that phone call is an actual user, or just an attacker treating our phone service as yet another attack vector?")