New Google Scam Alert: How to Spot a Fake Login Page (and What to Do If You Clicked)

A convincing new phishing scam is making the rounds, and it specifically targets anyone who uses a Google account. According to a recent report from Reader’s Digest, the attack arrives as an email or text message that looks exactly like an official security notification from Google. It claims there’s been a suspicious login attempt on your account and urges you to click a link to verify or secure it.

The problem is that the link leads to a fake Google login page designed to steal your email address, password, and sometimes your phone number. The page is nearly identical to the real thing, which makes it especially dangerous for people who are not in the habit of double-checking URLs.

What Happened

The scam works like this: you receive an alert that appears to come from Google. The subject line might say something like “Suspicious sign-in prevented” or “Security alert”. The message includes a prominent button or link that says “Review activity” or “Secure your account”. Tapping or clicking it takes you to a page that looks like the Google sign-in screen but is actually hosted on a fraudulent domain.

In many cases, the fake page even mimics Google’s design down to the logo and font, and it uses an HTTPS padlock icon (though the domain name will be off, like go0gle-security.com or accounts-google-login.xyz). If you enter your credentials, they are sent directly to the scammer, who can then access your real Google account and any services tied to it—Gmail, Drive, YouTube, Google Pay, and more.

Why It Matters

This scam is particularly effective because it preys on a real anxiety: the fear that someone else is breaking into your account. By using official-sounding language and creating a sense of urgency, scammers lower your guard. And because the fake login page looks so professional, even careful users can be fooled.

Once the attacker gains access to your Google account, they can:

  • Read your emails and send phishing messages to your contacts.
  • Reset passwords for other services that use your Gmail address for recovery.
  • Access stored documents, photos, and payment methods.
  • Use your account to commit fraud or spread malware.

Given the number of people who rely on Google accounts for work, school, and personal communication, the potential fallout is substantial.

What You Can Do

Spot the red flags before you click

  • Check the sender’s email address or phone number. Official Google security alerts will come from [email protected] or similar verified addresses. Any variation (like [email protected] or a generic Gmail address) is a red flag.
  • Hover over any link in the message without clicking. Look at the URL displayed. The real Google login page is always https://accounts.google.com. Anything else—especially if it uses a different domain or adds odd characters—is fake.
  • Look for grammatical errors, awkward phrasing, or excessive urgency. Scam messages often say “Immediate action required” or “Your account will be suspended” to pressure you.
  • Be suspicious of unsolicited alerts that ask you to log in. Google rarely sends links in emails for you to click in order to sign in; instead, they advise going directly to the website.

If you clicked and entered your password

Act fast. Here’s the sequence:

  1. Change your Google password immediately. Go directly to https://accounts.google.com (type it in your browser, don’t use a link). Choose a strong, unique password you haven’t used elsewhere.
  2. Enable two-factor authentication (2FA). Go to your Google Account settings, then Security, and turn on 2-step verification using an authenticator app or a hardware key. This prevents the scammer from logging in even if they have your password.
  3. Sign out of all other sessions. In your Google Account dashboard, under “Manage devices”, click the option to sign out of all other sessions. This will log out the attacker if they are still active.
  4. Run the Google Security Checkup. Visit https://myaccount.google.com/security-checkup and review recent activity, linked devices, and recovery information. Remove anything you don’t recognize.
  5. Report the phishing message. Forward the email or text to Google’s phishing team at [email protected] or use the built-in reporting tools in Gmail.

Staying Safe Going Forward

The best long-term defense is to never click links in unsolicited emails or texts when it comes to account security. Instead, open your browser, go directly to the service’s website, and log in from there. If there really is an issue, you’ll see a notification once you’re signed in.

Also consider using a password manager. It won’t auto-fill your credentials on a fake login page because the URL won’t match your saved entry for Google—so it serves as an extra layer of protection.

Finally, keep an eye on accounts you rarely use. Even if you think you’d never fall for a phishing page, a tired moment or a well-timed alert can trip anyone up. The steps above are simple and worth doing now, before a scam finds you.

Sources: Reader’s Digest, “Warning! This New Google Scam Looks Totally Legit—But Whatever You Do, Don’t Click on It” (April 2026). Additional guidance from Google’s official Security Checkup and phishing reporting tools.