How to Spot and Avoid the Latest Google Scam (It Looks Legitimate)

A new phishing campaign targeting Google users has been circulating, and it’s unusually convincing. The emails and fake login pages replicate Google’s branding nearly perfectly, making it easy to mistake them for the real thing. Here’s what’s happening, why it works, and how to keep your account safe.

What the scam looks like

The scam typically arrives as an email with a subject line like “Security alert: Unusual sign-in detected” or “Your account has been compromised.” The email uses Google’s official logo, fonts, and layout. It contains a button or link that says “Review activity” or “Secure your account.” Clicking takes you to a page that appears to be the Google sign-in screen.

But the URL is wrong. Instead of https://accounts.google.com, it might be https://accounts-google.com or https://google.security-alert.com. The page asks for your email address and password. If you enter them, the scammers capture your credentials and can access your Google account, including Gmail, Drive, Photos, and any linked services.

Some variants also pressure you by claiming that your account will be suspended if you don’t act immediately—a common fear-tactic.

Why it’s effective

Scammers have gotten better at copying Google’s interface. Many people don’t inspect URLs carefully, especially when they’re already worried about security. The email might even come from an address that looks legitimate, like [email protected], but the actual sender is a spoofed domain that visually mimics it.

Google itself never sends emails asking you to click a link and enter your password. Any such message should be treated as suspicious. Yet the combination of realistic design and urgent language trips up even cautious users.

How to spot the red flags

Before you click anything, check these signs:

  • The sender address. In Gmail, open the email and look at the full email address. If it doesn’t end in @google.com (or a very specific subdomain like @accounts.google.com), it’s fake.
  • The link URL. Hover your mouse over any button or link without clicking. The URL that appears should start with https://accounts.google.com. If it looks off (misspellings, extra words, a different top-level domain), do not click.
  • Grammar and tone. Phishing emails often contain minor errors—odd phrasing, inconsistent capitalization, or a generic greeting like “Dear Google user” instead of your name.
  • Unexpected requests. Google will never ask for your password in an email or over the phone. If you get an unsolicited request to “verify” your password, it’s a scam.

Steps to protect yourself

If you haven’t clicked anything yet, here’s how to stay safe:

  1. Enable two-factor authentication (2FA). This adds a second step to log in, usually a code sent to your phone. Even if a scammer gets your password, they can’t access your account without that code. Google’s Authenticator app or a hardware key are more secure than SMS, but any 2FA is better than none.
  2. Use a password manager. A good password manager will auto-fill your credentials only on the legitimate site. If you visit a fake page, the manager won’t offer to fill in your password—a clear warning.
  3. Bookmark the real Google sign-in page. That way you always go to the correct URL instead of relying on links in emails.
  4. Report the scam. If you receive a suspicious email claiming to be from Google, forward it to [email protected]. You can also report it to the FTC at ReportFraud.ftc.gov.

What to do if you already clicked

If you entered your password on a fake page, act immediately:

  • Change your Google password from a trusted device. Go directly to https://myaccount.google.com and update your password. Make it strong and unique.
  • Sign out of all sessions. In your Google Account settings, find “Manage your devices” and sign out every session you don’t recognize. Under “Security,” also sign out of all other sessions.
  • Enable 2FA now.
  • Run a security check. Use Google’s Security Checkup tool at https://myaccount.google.com/security-checkup.
  • Scan your computer for malware. Run a full scan with your antivirus software in case the phishing page also tried to download something.
  • Monitor your accounts. Keep an eye on your Gmail sent folder for unusual emails, check your Google Drive for files you didn’t add, and look for unauthorized account changes.

Sources

This article draws on information from a recent report by Reader’s Digest (“Warning! This New Google Scam Looks Totally Legit—But Whatever You Do, Don’t Click on It”) and general security guidance from Google’s official phishing and scam prevention pages. For more details, visit Google’s security advice.