The scam that arrives in a real Google security alert
A new phishing trick gets Google itself to send you the bait. Here's how it works, how to spot it, and the one habit that beats it.
This morning I got a Google security alert telling me an app password had been created and a "new Linux device" needed signing out. It came from [email protected]. It passed every authentication check. The link in it pointed at a google.com address. And it was a scam. I've spent over a decade in IT support and this one made me look twice — so here's how it works, before it lands in your inbox.
How the trick works
The scammer never touches your account. Instead, they create a throwaway Gmail account of their own and list your email address as its recovery address. That one setting means Google now sends you a copy of every security alert for their account.
Then they create an "app password" on their account. App passwords let you type in any name you want — so they name it something like "If you didn't do this, sign out the new device at sites.google.com/view/…". Google dutifully generates a security alert and pastes that name right into the email. The result is a genuine Google email, from a genuine Google address, carrying the scammer's instructions in the middle of it.
The link goes to a Google Sites page. Google Sites is a free website builder anyone can use, so the address really is google.com — but the page on it belongs to the scammer, and it's built to collect your Google password and two-factor code.
Why it gets past careful people
Most phishing advice boils down to "check the sender" and "check the link." This scam passes both. The sender is really Google. The email has Google's real formatting and footer. The link really is on a google.com domain. Spam filters let it through because, technically, it's a legitimate message.
How to spot it
- Read the very first line. Copies of alerts for someone else's account start with "This is a copy of a security alert sent to [address]." If that address isn't yours, the alert isn't about you.
- Check where the link goes. Real Google account pages live on accounts.google.com or myaccount.google.com — never on sites.google.com.
- Watch for wording that doesn't sound like Google. Google's own alerts don't tell you to visit a website to "sign out a device" or nudge you toward a button with urgent instructions.
- Notice anything about an account you've never heard of. A random string of letters @gmail.com listing you as its recovery email is a setup, not a coincidence.
The one habit that beats it
Never act on a link inside a security email — any security email, from anyone. Open a new tab, type myaccount.google.com yourself, and check Security → Recent security activity. If something's genuinely wrong with your account, it'll be there. If it isn't there, the email wasn't about you.
If you already clicked
- Clicking alone usually isn't the problem — typing your password or a code into the page is.
- If you entered anything, change your Google password right away from myaccount.google.com.
- Under Security → Your devices, sign out anything you don't recognize.
- Check Security → Third-party connections and remove apps you didn't add.
- Turn on two-step verification if it isn't already on — ideally with a passkey or an authenticator app rather than text messages.
To stop getting alerts for the scammer's account, use the "remove it" link at the top of the alert (it goes to accounts.google.com) to tell Google you don't recognize that account. And if an email ever has you second-guessing, send it my way — I'll take a look before you click anything.