Fake Google account security alert emails: how to tell if one is real

"Critical security alert: someone just used your password to try to sign in." Google really does send emails like this, which is exactly why attackers copy them. A fake alert sends you to a page that looks like Google's sign-in and captures your password, and often your 2-Step Verification code. This guide shows how to check any Google alert in under a minute, what a fake looks like, and what Google Workspace admins should do after a click.

What is a fake Google account security alert?

A fake Google account security alert is a phishing email made to look like one of Google's genuine security notices, such as "Suspicious sign-in prevented", "Critical security alert" or "Your password was changed". It urges you to "Check activity" or "Secure your account" through a link that leads to a fake Google sign-in page. Whatever you type goes to the attacker.

Google acknowledges the problem directly. Its help page for the "suspicious sign in prevented" email says "sometimes hackers try to copy the 'suspicious sign in prevented' email to steal other people's account information", and asks you to "be wary of messages that ask for personal information like usernames, passwords".

For businesses on Google Workspace the stakes are higher. The same password usually unlocks Gmail, Drive, Calendar and every app that uses "Sign in with Google".

Common versions of the lure

Example of a fake Google security alert

This is an example written for this guide. It is not a real Google email.

From: Google <security-alert@accounts-google-verify.com>
Subject: Critical security alert for jane@yourcompany.com

Someone just used your password to try to sign in to your
account from a non-Google app. Google blocked them, but you
should check what happened.

Windows Device · Lagos, Nigeria · Today 03:12

[ Check activity ]

If you don't take action within 24 hours, your account
will be temporarily restricted.

You received this email to let you know about important
changes to your Google Account and services.

The tell-tale parts: a sender domain that isn't Google's, a deadline and a threat of restriction, and a button that leads off Google. But the checks below work even when the fake is perfect.

How do I check if a Google security alert is real?

Check your Google Account directly. Gmail Help says: "If you think a security email that looks like it's from Google might be fake, go directly to myaccount.google.com/notifications." On that page, it adds, you can check your Google Account's recent security activity (Gmail Help).

1. Open your account yourself. Type myaccount.google.com into the browser or use the Google app. Don't use any link in the email.
2. Select Security and review recent security activity. Google's help says to open Security, select Review security events in the Recent security events panel, look for unfamiliar locations or devices, and change your password if you see anything you don't recognize (Google Account Help). The suspicious activity guide points to your "Recent security activity" page for alerts about unusual activity.
3. Compare the alert with what's listed. Google doesn't spell out a matching rule, but the logic follows from its advice: an alert about a real event should correspond to an entry in your recent security activity, with a similar device, time and location. If you find nothing like it, treat the email as fake and delete it.
4. If the event is real, respond inside your account. Google's Respond to security alerts page says to select "Yes" if it was you, or "No, secure account" if it wasn't, and follow the steps, which may include changing your password.
5. Report the fake. In Gmail, open the message, select More and choose Report phishing (Google Account Help).

Why the sender address isn't proof

Google doesn't list its alert sender addresses on these help pages, and a sender check can mislead you either way. Display names are trivial to fake (see display name spoofing), and attackers have found ways to send through genuine Google services. Google's scam warning says that messages claiming to validate a caller's identity are fraudulent "even if sent from legitimate Google domains."

If you want to see where a message really came from, paste its headers into the Email Header Analyzer and check the SPF, DKIM and DMARC results. Our guide to checking whether an email passed SPF, DKIM and DMARC explains what a pass does and doesn't prove.

Does Google ever call you about account security?

No. Google is unusually direct on this point. Its help page on phone scams says "Google will never call you about your account security" and "Google also never sends emails to verify callers." It adds that "Scammers frequently spoof calls, posing as Google Account Security or Support."

The scam usually runs in two parts. A caller claims your account is under attack, then an email arrives "confirming" the case, then the caller asks you to approve a sign-in prompt or read out a code. Hang up and check your account yourself. Our guide to callback phishing covers the phone side in more depth.

Does 2-Step Verification stop fake Google alerts?

2-Step Verification helps a lot, but codes can still be stolen. A fake page can ask for your one-time code and pass it, with your password, to Google in real time. This is called adversary-in-the-middle phishing, and it's explained in our guide to AiTM phishing and MFA bypass.

Security keys and passkeys are tied to Google's real sign-in page, so they don't work on a lookalike. Google's admin guidance on compromised accounts says to "Enable 2-step verification for the domain, and enroll users with security keys" (Google Workspace Admin Help). Our guide to enforcing 2-Step Verification in Google Workspace shows how.

What should I do if I entered my password on a fake Google page?

If you're the user

1. Change your Google password now, from a trusted device, by typing the address yourself. Change it anywhere else you used it.
2. Tell IT straight away if it's a work account, and say whether you typed a code or approved a prompt.
3. Check your security settings. Google's suspicious activity guide says to correct unfamiliar changes to your recovery phone, recovery email and 2-Step Verification, remove unfamiliar devices, review apps with access to your account, and check Gmail's Automatic mail forwarding and Filters.

If you're the Google Workspace admin

Google's compromised account steps give the order:

1. Suspend the user. Google says "Suspending a user resets the user's sign-in cookies and OAuth tokens." If you don't suspend, go to Directory > Users, open the user, then Security > Sign-in cookies > Reset (Google Workspace Admin Help). Google notes that this "does not sign them out of apps, such as Gmail and Google Drive for desktop."
2. Investigate. Review user log events and email logs. Our guides to Google Workspace email log search and the security investigation tool cover both.
3. Revoke access. Reset the password, revoke OAuth 2.0 tokens and remove app passwords.
4. Restore carefully. Unsuspend, check filters and forwarding, update recovery options and enroll the user in 2-Step Verification.

Google also sends admins suspicious login alerts when a sign-in "doesn't match a user's normal behavior", such as one from an unusual location. Make sure someone reads them. For the general checklist, see what to do after clicking a phishing link.

How can a business keep fake Google alerts out of inboxes?

Google Workspace's built-in filtering stops a lot of phishing, and for many small teams it is enough when combined with 2-Step Verification and user training. Turn on the settings in our guide to Google Workspace advanced phishing and malware protection, and teach staff what Gmail warning banners mean.

Some fake alerts still get through, particularly ones sent from new lookalike domains or real cloud services. An MX-level filter in front of Google Workspace checks inbound mail for spam, phishing and spoofing before it reaches Gmail, and holds suspect messages in a quarantine each user can review. Our Google Workspace built-in vs gateway comparison lays out when that second layer is worth it.

Next steps

1. Tell staff the one rule: never act on a Google alert from the email; check myaccount.google.com and Security yourself.
2. Make sure every Workspace user is enrolled in 2-Step Verification, and move admins to security keys or passkeys first.
3. Confirm someone receives and reads Google's suspicious login alerts.
4. Run the free DMARC Checker on your domain, and if phishing keeps reaching Gmail, see how iBlockSpam works with Google Workspace.

Browse our other phishing and threat guides.