Fake Google emails: verify security alerts and protect Gmail
An email may claim someone has stolen your password, your account will be blocked or you must confirm your identity immediately. Some Google security alerts are real, but scammers copy their appearance, logo and urgent tone.
What just happened?
Choose the situation that applies. Receiving a suspicious email is different from entering a password or approving a sign-in.
I only received a suspicious email
You opened the message but did not follow a link or approve anything.
See the steps →I clicked a link but entered nothing
The fake page opened, but you did not submit your password or other information.
See the steps →I entered a password or verification code
Your sign-in details may have reached a scammer.
See urgent steps →I approved a sign-in or see unfamiliar activity
Someone may be actively misusing the account or may already have changed its settings.
Secure the account →How phishing impersonating Google works
The attacker creates the impression of a real security incident and directs you to a copy of the sign-in page.
An alert arrives
The email claims someone signed in or your account is at risk.
Time pressure builds
“Your account will be blocked”, “your password expires” or “confirm immediately”.
The link leads elsewhere
The button opens a page imitating Google sign-in.
You enter a password
The credentials may immediately be forwarded to the attacker.
The page requests another check
It may ask for a code, a phone approval or another security detail.
Account takeover attempt
The attacker tries to sign in, change security settings or use Gmail for further attacks.
You do not have to judge the email. Verify the event outside it.
Google does send security alerts about events such as new sign-ins or suspicious activity. Scammers therefore copy subjects that can also be legitimate.
What a genuine alert may concern
- A new sign-in to the account.
- Suspicious or unusual activity.
- A security settings change.
- Device, time or approximate location information.
- A request to review account security.
What to do even if the message looks genuine
- Do not use the email link to verify the event.
- Open a new tab or the app yourself.
- Go directly to your Google Account.
- Review security events and devices.
- Act on information found in the account.
myaccount.google.comand check security / recent security activity.Address and authentication help, but are not the whole decision
Technical clues can reveal a fake message. The safest approach remains bypassing the email and checking the event directly in your account.
Display name
“Google Security” or “Google Admin” may simply be a freely chosen name.
Actual address
Expand the sender details and examine the complete email address.
Mailed by / Signed by
Gmail may show sender authentication information. This alone does not guarantee safe content.
Link destination
Check where a button really leads before clicking. Do not open a suspicious address merely to investigate it.
The scammer wants action before verification
Common tactics include urgency, panic, false authority and a prominent button leading to a fake page.
Time pressure
You are told to act immediately or within a short deadline.
Creating panic
The message claims your account is compromised, blocked or about to be lost.
False authority
The design imitates Google, an administrator or a security team.
Call to action
A prominent button is meant to take you to the fraudulent page.
The subject can sound realistic. Verify outside the email.
“Your password has expired”
You are told to renew it immediately using the attached button.
“Someone signed in to your account”
Fear of an intruder is used to trigger a quick click.
“Your account will be blocked”
The message threatens restrictions on Gmail or the whole Google Account.
“Confirm your identity”
You are asked to enter credentials into a copy of Google sign-in.
“Google Cloud / Workspace Admin”
The scam can target business and work accounts too.
“Your storage or service will be disabled”
It threatens lost files or a service restriction.
Taking over your main email can open a route to other services
Access to Gmail does not automatically mean control of every account, but it can make password resets and further abuse much easier.
Resetting other passwords
Email is often the route used for a password reset.
Email correspondence
An attacker may read messages or gather more information.
Cloud documents
Depending on account settings, related services and files may be accessible.
Google services
One account may connect to several Google services.
Scamming your contacts
Messages sent from a compromised account can appear more trustworthy.
Other connected accounts
Services using Gmail as a recovery address may become another target.
How to reduce the risk of Google Account takeover
Avoid handing over credentials through email links, and protect the account so a stolen password alone is not enough.
A unique password
Do not reuse your Google Account password on other services.
Two-step verification
Add another layer of protection and never approve a sign-in you did not initiate.
Passkey or security key
Phishing-resistant sign-in methods help protect against attacks that steal passwords or one-time codes. Still check unexpected prompts carefully.
Check through a known route, not through the email
The principle is the same whatever the message looks like: bypass the email, reach your Google Account independently and review the event there.
Close the email
Do not use its buttons to verify anything.
Open the account independently
Use a new tab, the app or a known address entered manually.
Review security
Check events, devices, sessions and settings changes.
Act on account information
If you cannot find the event, do not follow the email instructions. Use official Google Help if you remain unsure.
What to do based on what has happened
Stop entering information. If you submitted a password, deal with the account directly through Google’s official account tools, using a trusted device.
I only received a suspicious email
- Do not reply.
- Do not click buttons or links.
- Open your Google Account directly and review security activity.
- Report the suspicious message as phishing in Gmail.
- Preserve any evidence you need before deleting the message.
I clicked a link but entered nothing
- Close the fake page.
- Do not download files or extensions.
- Do not continue through more buttons.
- Open your Google Account entirely independently.
- Review security activity and devices. If you downloaded or ran something, follow the malware response steps too.
I entered a password or verification code
- Change your password immediately through your official Google Account, using a trusted device.
- Change the password anywhere else you reused it.
- Review security events and signed-in devices.
- Sign out unfamiliar sessions.
- Check your recovery phone and email address.
- Enable or review two-step verification; check unfamiliar access methods and third-party app access.
I approved a sign-in or already see unfamiliar activity
- Secure the account using Google’s official tools. If you cannot sign in, use Google’s official account recovery process.
- Sign out unfamiliar devices and sessions.
- Check changes to your password, recovery phone and recovery email.
- Review Gmail forwarding rules, filters, delegation and other unfamiliar settings or app access.
- Change reused or similar passwords on other services.
- For financial loss or further misuse, also follow the urgent first-aid steps.
If the account may be compromised, do not wait for another email
Secure it through Google’s official interface. Do not use links in the original suspicious message.
What to keep
Preserve the basic information needed to assess the message before deleting it.
The complete email
Subject, text, date and time.
Sender address
The full email address, not just the display name.
Link destination
Only if you can obtain it safely without visiting the suspicious page.
Screenshot
The message, warnings and any fake sign-in page already displayed; do not reopen it just for evidence.
Security alerts
Unfamiliar sign-ins, devices or phone approvals.
Timeline
When the email arrived, when you clicked and when account changes occurred.
Fake Google emails – FAQ
Does Google really send security alerts?
Yes. Google reports events such as new sign-ins or suspicious activity. The email subject alone therefore cannot distinguish a scam.
How can I check whether the alert was genuine?
Do not verify it through the email link. Open your Google Account independently and review recent security activity and devices.
Can an email look exactly like one from Google?
Yes. Logos, colours, text and display names can be copied. Independent verification matters more than appearance.
Is checking the sender address enough?
It is useful but not sufficient. Verify a suspicious event directly in the account rather than through a message link.
What if I only clicked the link?
Close the page, enter and download nothing, then open your account independently and review security activity. If you installed or ran anything, also follow malware response advice.
What if I entered my password?
Change it immediately through your official Google Account on a trusted device. Review devices and sessions, and change the same password on any other service where you used it.
What if I approved a sign-in on my phone?
Review security events, sign out unfamiliar devices and secure the account. Approving someone else’s sign-in can let an attacker get past an additional security check.
How do I report phishing in Gmail?
Open the individual message menu in Gmail and select Report phishing where available. For loss or further misuse, also take the steps appropriate to the incident.
Found a suspicious email claiming to be from Google?
Keep the message, sender details, links and security alerts. Reporting to DPP does not replace securing your Google Account or responding to any resulting harm.