Google Docs comment phishing: how to tell if a "mentioned you" email is safe

"Jane Miller mentioned you in a comment in the following document." Google Docs sends emails like this every day, and attackers have learned to send them too. Some of these emails are fakes copied from Google's design; others are real Google notifications that a stranger triggered by typing your email address into a comment on their own document. This guide shows how both versions work, how to check a comment in under a minute, and what Google Workspace admins can do.

What is Google Docs comment phishing?

Google Docs comment phishing is a phishing attack that arrives as a "mentioned you in a comment" or "assigned you an action item" notification. The comment contains a link to a fake sign-in page, a malware download or a payment request. Because the email looks like routine collaboration, people click without thinking.

It comes in two forms:

1. A real notification, abused. The attacker creates a Google Doc, Sheet or Slides file, writes a comment containing a link and @mentions your email address. Google's own help confirms the mechanism: you type "@" and a name or email address in a comment, and the person "will receive an email notification with your comment" (Google Docs Editors Help). The person doesn't need access to the file first. Google says if you mention someone who doesn't have permission, "they can ask you to share the file."
2. A fake notification. The attacker sends an email that copies Google's comment layout, from a domain that isn't Google's, with an "Open" or "Reply" button that leads to a fake Google or Microsoft sign-in page.

The first form is harder to spot because it really comes from Google. It's the same trick as file-sharing notification phishing, where attackers share real files from real services, and part of the wider problem of phishing links on trusted cloud services.

Real notification vs fake notification

Why do these emails get past spam filters?

Real comment notifications are sent by Google's mail systems, so they would normally authenticate as Google and come from a sender with a very good reputation. A filter can't block Google Docs notifications as a category without blocking every real collaboration email. Our guide to checking whether an email passed SPF, DKIM and DMARC explains why a pass only proves which service sent the message, not that its content is safe.

Google added a safeguard in 2022. Its Workspace Updates blog said: "we are adding the commenter's email address to the email notification", so users can "feel more confident that you're receiving a legitimate notification". The change rolled out from March 3, 2022, to Google Workspace customers and personal Google accounts, and Google said "There is no admin control for this feature" (Google Workspace Updates). The commenter's display name can still be anything the attacker likes; the email address is what tells you who they are.

Example of a phishing comment notification

This is an example written for this guide. It is not a real Google email.

From: Google Docs
Subject: Q4 Payroll Adjustments - New comment

Jane Miller (jmiller.payroll.dept@gmail.com) mentioned
you in a comment in the following document:

  Q4 Payroll Adjustments

  "@you Please review your updated salary details
  before Friday. Secure copy here:
  https://payroll-review-portal.example/view"

[ Open ]   [ Reply ]

The tells: a "colleague" name over a free webmail address, a pay or invoice topic, a deadline, and a link in the comment text that leads off Google entirely. Everything else in the email may be genuine Google formatting.

How do I check if a Google Docs comment is safe?

Check the person and the request, not the template. Follow these steps for any unexpected mention or action item.

1. Read the commenter's email address. If you don't recognize it, or the name claims a colleague but the address is outside your organization, stop.
2. Don't use the email's buttons. Open docs.google.com or Google Drive yourself and look for the file under Shared with me or in your recent files.
3. Ask yourself what the comment wants. A real colleague's comment asks you to read or edit text in the document. A phishing comment wants you to follow a link, sign in, download a file or pay something.
4. Never sign in from a comment link. If a page asks for your Google or Microsoft password after you followed a comment, close it. Our guide to checking if a link is safe explains how to read a URL before clicking.
5. Confirm with the person through another channel if the name is someone you know: a phone call or a new message you start, not a reply to the comment.
6. Report the email and the file. See below.

If you'd like to confirm whether an email is a real Google notification or a fake, paste its headers into the free Email Header Analyzer, which runs in your browser and shows the sending domain and authentication results. Remember that a real Google notification can still carry an attacker's comment.

Why do attackers use Google Docs comments?

Attackers use comments because they turn Google into the sender. The attacker never has to build a convincing email or warm up a sending domain: they write a comment, type your address after an @ sign and let Google deliver it. The same trick works with action items, because Google's help says that when you assign an item with @ or + and an email address, "The person you assigned the action item to will get an email."

It's also cheap to repeat. A free Google account can create many documents, and each comment can mention a different target, with a different name in the display field. Users are used to collaboration notices, so the message feels like work rather than a threat. That's why the checks above focus on the person and the request, which the attacker can't hide, rather than on the email's design, which is genuine.

How do I report a phishing Google Docs comment?

Report it in two places: the email and the file.

• The email. In Gmail, open the message, click More next to Reply and choose Report phishing (Gmail Help). In Outlook, use the Report button. Our guide to reporting phishing emails covers other mail apps and the FTC and APWG addresses.
• The document. Open the file, select Help > Report, choose the type of abuse and click Submit report. Google notes that "Reports don't guarantee removal of the file or any other action on Google's part" (Google Docs Editors Help).

To stop more emails from that file, open it and go to Tools > Notification settings, then under Comments choose None. The other options are All comments and Comments for you, which covers @mentions and threads you're part of (Google Docs Editors Help). If the same stranger keeps sharing files with you, Google Drive also lets you block them; our file-sharing phishing guide explains how and its limits.

What should I do if I clicked a link in a Google Docs comment?

What you do depends on how far you got.

• You only opened the document. Close it, report it and delete the email. The risk in these attacks is what the document asks you to do next, so if you didn't follow a link, sign in or download anything, there's usually nothing more to do.
• You followed a link but typed nothing. Close the page and report it. Run your usual malware scan if a download started.
• You entered a password or code. Change the password at once from a trusted device by typing the real address, then check your account's recent security activity, recovery options, filters and forwarding. If it's a work account, tell IT immediately. Our checklist for what to do after clicking a phishing link has the full order.
• You opened a downloaded file. Disconnect from the network and call IT. Attachments and downloads are a common route for malware; see dangerous email attachment types.

Watch out for a follow-up. A comment lure may be followed by a fake Google security alert or a fake DocuSign request, using the same name.

What can Google Workspace admins do?

Admins can't turn off comment notifications for other people's files, but they can limit the damage and clean up quickly.

Investigate and remove

Use the security investigation tool, where your edition includes it, to find every copy of the notification by subject or by the document link, and delete it from mailboxes. Then check whether anyone signed in to a suspicious page: review login audit events and follow Google Workspace compromised account recovery for any user who entered a password.

Tighten Gmail and Drive settings

1. Turn on link protection under Apps > Google Workspace > Gmail > Safety, including the warning prompt for clicks on links to untrusted domains. See advanced phishing and malware protection.
2. Review external sharing. In Apps > Google Workspace > Drive and Docs > Sharing settings, Google's documentation explains the options for sharing outside your organization, including whether external content can be shared with your users (Google Workspace Admin Help). Restricting it suits teams that don't collaborate with outsiders, but test first, because it also affects legitimate partners.
3. Act on a known URL with a content compliance rule that quarantines messages containing it; see Google Workspace content compliance rules.

Train for this exact pattern

Tell staff two things: read the commenter's email address, not the name, and never sign in or pay from a comment link. Add a real-looking example to your security awareness training.

Filtering helps with the fake-lookalike version, which comes from domains a filter can judge. An MX-level filter in front of Google Workspace checks inbound mail for phishing and spoofing before it reaches Gmail; our Google Workspace built-in vs gateway comparison explains when a second layer is worth it. The real-notification version still needs the human checks above.

Next steps

1. Teach everyone the one rule: check the commenter's email address, and never sign in from a comment.
2. Report suspicious comments in both Gmail and the document itself.
3. If you're an admin, turn on Gmail link protection and review external Drive sharing.
4. Run the free Email Health Check on your domain, and see iBlockSpam for Google Workspace if lookalike notices keep reaching inboxes.