How to Spot the New Google Scam That Looks Legit – and Stay Safe

A convincing phishing campaign that impersonates Google has been making the rounds. According to a recent report from Reader’s Digest, the scam uses official-looking emails and login pages to trick people into handing over their credentials. If you use Gmail, Google Drive, or any other Google service, this is one you need to know about.

What’s Happening

The scam typically arrives as an email that appears to come from Google. It might warn you about unusual activity on your account, ask you to verify your identity, or notify you of a security issue. The design is realistic enough to fool many people—Google’s logo, official fonts, and even the familiar blue buttons are all there.

The email contains a link that leads to a fake Google sign-in page. If you enter your email and password, the attackers steal them. From there, they can access your personal data, send emails from your account, or try to reset passwords for other services.

Reader’s Digest notes that this particular variant is more polished than typical phishing attempts. The fake login page looks almost identical to the real one, making it harder to spot at a glance.

Why It Matters

Google accounts are central to many people’s digital lives. A compromised account can give scammers access to your email, contacts, documents, photos, and linked services like YouTube or Google Pay. They can also impersonate you to trick your friends or family.

This kind of attack is especially dangerous because it preys on trust. You get a message that seems urgent and official, and your instinct is to act quickly. But once you hand over your password, the damage can spread fast.

Even if you think you’re careful, these scams get better every year. A momentary lapse—reading an email on your phone while distracted—is enough.

What You Can Do

The good news is that you can protect yourself with a few simple habits. Here’s what to do if you suspect you’ve received this scam, and how to avoid it altogether.

1. Don’t click links in unexpected emails. If you get a message about your Google account, do not click any link inside it. Instead, open a new browser tab and go directly to myaccount.google.com or mail.google.com. Check there for any real alerts.

2. Look for red flags. Hover your mouse over any link (without clicking) to see the real destination. Scam URLs often look like “accounts-google-security.com” or something similar. Genuine Google URLs will end with “google.com” or a subdomain like “accounts.google.com”. Also watch for:

  • Urgent language (“Your account will be suspended in 24 hours”)
  • Poor grammar or odd phrasing (though some scams now read perfectly)
  • Requests for personal information that Google would never ask for by email

3. Enable two-factor authentication (2FA). Even if a scammer gets your password, 2FA can stop them. The best option is a physical security key (like a YubiKey), but app-based codes or Google Prompts are much better than nothing. Go to your Google Account security settings and turn it on.

4. Use Google’s own security checkup. Navigate to myaccount.google.com/security-checkup. It will show you which devices are signed in, recent activity, and any security issues. Run this regularly.

5. Report the scam. If you receive a phishing email, forward it to Google at [email protected]. You can also report it to the FTC at reportfraud.ftc.gov. Your report helps others stay protected.

6. If you already clicked. Change your password immediately. Go to your Google Account, sign out of all other sessions, and remove any unfamiliar devices or apps. Run the security checkup. If you used the same password anywhere else, change those too.

Sources

  • Reader’s Digest, “Warning! This New Google Scam Looks Totally Legit—But Whatever You Do, Don’t Click on It” (April 2026)
  • FTC, “How to Recognize and Avoid Phishing Scams”
  • Google Safety Center, “Phishing and Suspicious Emails”