Got an email with the subject “Security Alert” claiming suspicious activity on your Google account? Before you panic and click anything, you should know the Google security alert scam has become so convincing that it has, in at least one documented case, passed Google’s own email authentication checks. This article explains exactly how the scam works, walks through a real case that fooled a security researcher, and gives you the one official way to check whether your alert is genuine. See more app and account safety checks on our Apps reviews page.
What Is the Google Security Alert Scam?
The Google security alert scam is a phishing attack where criminals send an email, text, or even a phone notification designed to look exactly like a genuine Google security warning — claiming things like “new sign-in detected,” “suspicious activity blocked,” or “your account has been temporarily suspended.” The message creates urgency and pushes you toward a link that leads to a fake Google sign-in page built to steal your username, password, and sometimes your two-factor authentication code.
Google Security Alert Scam: A Case That Fooled Even the Experts
This isn’t a crude, easy-to-spot scam anymore. In a well-documented case covered by multiple security outlets, developer Nick Johnson received a phishing email with the subject line “Security alert,” sent from an address appearing to be no-reply@accounts.google.com and digitally signed by Google itself — meaning it passed Gmail’s own authentication checks and looked completely legitimate in his inbox. The email claimed a legal subpoena involved his Google account and linked to what appeared to be a Google Support page, hosted on Google’s own sites.google.com platform, before redirecting to a fake sign-in page designed to steal his credentials.
Security researchers identified this as a “replay attack” — scammers take a real, previously legitimate, digitally signed Google email and resend a modified version of it, with the original cryptographic signature still technically valid. This is exactly why the email passed through spam filters that would normally catch an obvious fake, and why even technically sophisticated users have been caught off guard by it.
More common versions of the scam don’t need this level of technical sophistication to work — they simply copy Google’s visual design closely enough, using fake sender addresses like google-security@account-alerts.com or noreply@google-mail-support.net, which look official at a glance but aren’t genuine Google domains at all.
How the Google Security Alert Scam Typically Works
- An urgent-sounding email or text arrives, claiming a new sign-in, suspicious activity, or an account suspension.
- A link invites you to “verify your identity” or “review account activity” immediately.
- Clicking it leads to a fake Google sign-in page, sometimes hosted on a Google-owned subdomain (like sites.google.com) to appear more convincing, before redirecting elsewhere.
- Entering your password, recovery email, phone number, or two-factor code hands this information directly to the attacker.
- In some versions, a phone number is provided instead, connecting victims to a fake tech-support call centre that extracts the same information over the phone.
How to Tell a Real Google Security Alert From a Fake One
There is one reliable, official way to check: go directly to your Google Account yourself (never through a link in the email) and open Security > Recent security activity. If Google genuinely detected suspicious activity, it will show up there. If the email describes an event that isn’t listed in your own account’s security activity, the email is fake.
| Signal | Genuine Google alert | Scam pattern |
|---|---|---|
| Where to verify | Shows up under Security > Recent security activity in your own account | Only exists in the email itself; nothing matches when you check your account directly |
| Pressure | Informational; never threatens immediate suspension demanding a click | Creates urgency: “act now,” “temporarily suspended,” “subpoena involved” |
| Link behaviour | You should never need to click a link to check your own security — go to your account directly | Pushes you to click through to a “verify” or “support” page |
| Sender detail | Even genuine-looking senders should be double-checked by going to your account directly instead | Addresses like google-security@account-alerts.com or similar unofficial domains |
What to Do If You Receive One
- Don’t click any link in the email. Open a new browser tab and go to your Google Account directly instead.
- Check Security > Recent security activity in your own account to see if anything genuinely unusual happened.
- Report the email to Google using Gmail’s “Report phishing” option, or forward it to phishing@google.com.
- If you already entered your password, change it immediately from your account settings and check which devices are currently signed in, removing any you don’t recognise.
- If you entered a two-factor code or recovery details, also review and update your account recovery phone number and email, since these can be used to regain access even after a password change.
- If financial loss or identity theft resulted, report it at cybercrime.gov.in or call the national cybercrime helpline, 1930.
Final Word on the Google Security Alert Scam
The Google security alert scam works precisely because it mimics something genuinely useful — real Google security alerts exist and matter. The one habit that defeats every version of this scam, even the most sophisticated “replay attack” cases: never click a link in a security email to check your account. Open a new tab, go to your Google Account directly, and check Security > Recent security activity yourself. Read our disclaimer for how we present safety information like this.
Want us to check another app or scam pattern? Request a review.
FAQs
How can I tell if a Google security alert email is real?
Don’t rely on the email itself. Go directly to your Google Account and check Security > Recent security activity. If nothing matches what the email describes, it’s fake.
Can a Google security alert scam email actually look 100% genuine?
Yes, in rare documented cases. A “replay attack” has been used to resend a real, digitally signed Google email with altered content, passing authentication checks that would normally catch a fake.
What should I do if I clicked the link and entered my password?
Change your Google password immediately from your account settings (not through the email), review your account’s connected devices and recovery details, and remove anything unfamiliar.
Where do I report a Google phishing email?
Use Gmail’s built-in “Report phishing” option, or forward the email to phishing@google.com.
