Is this security alert from Google a scam?

Genuine messages from Google link to google.com, accounts.google.com, gmail.com. Treat a link to any other address as a warning sign.

• Google Account security activity can be checked by signing in at myaccount.google.com or accounts.google.com yourself, so check there instead of trusting a sender name, address or link
• A sender address can be faked, so an email that appears to come from a google.com or gmail.com address isn't proof of anything on its own
• A city or device named in an alert isn't proof, because scammers choose alarming details; check your recent security activity by signing in yourself
• A text claiming to be an urgent Google account warning can't be verified by its sender name or number, because both can be faked; sign in yourself to check
• A sender name that looks right isn't proof, and an urgent threat of immediate account closure is a warning sign; sign in at myaccount.google.com yourself

What a genuine Google contact shouldn't do

• Ask you to click a link to fix a security problem; you can check security activity by signing in at myaccount.google.com or accounts.google.com yourself
• Ask you to act on an urgent account warning through a link in a text; sign in yourself to check
• Ask you to enter your password or two-factor code on a page reached through an email link; no legitimate provider harvests credentials that way
• Threaten that your account will be deleted or closed within hours unless you act immediately
• Call you out of the blue about your Google Account or Gmail; no legitimate tech company cold-calls about account problems

• Emails claiming your Google Account has been accessed from overseas and urging you to 'secure' it by clicking a link that leads to a lookalike login page.
• Messages pretending to be from Gmail warning that your storage is full and directing you to a fake site to 'verify' your account.
• Phishing emails that copy Google's logo and layout but arrive from addresses such as support@google-secure-login[.]example and ask for your password.

• The message contains a shortened link or a domain such as accounts-google-login[.]example instead of accounts.google.com.
• The email creates urgency by claiming your account will be deleted within hours unless you act immediately.
• It asks you to enter your Google password or two-factor code on the linked page.
• The sender address shows a slight misspelling such as noreply@googIe[.]example (capital i instead of lowercase L).
• The email references a recent login from a city you have never visited, but still pressures you to click rather than check myaccount.google.com directly.

These composed examples show how scams impersonating Google typically read, with the tells that give each one away. Compare them against anything you've received.

Google's real website is google.com and the official app is the Google app. Reach Google through those channels, never through the details inside a message you're unsure about.

1. 1Don't click the link, reply, or enter your password anywhere the message sends you
2. 2Type myaccount.google.com or accounts.google.com into your browser yourself and review your recent security activity; any genuine alert will be recorded there
3. 3Check notifications inside the official Gmail or Google app on your phone rather than trusting an email or text
4. 4If the message claims your storage is full, confirm it by signing in directly; the real figure is always visible in your account

Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.

1. 1Change your Google password immediately at myaccount.google.com, ideally from a device you trust, and turn on 2-Step Verification
2. 2Review your account's recent security activity and signed-in devices, and sign out anything you don't recognise
3. 3Change the same password on every other site where you reused it; a stolen Gmail login is often the key to your other accounts
4. 4If identity documents or card details went through the fake page, call your bank about the card and contact IDCARE (idcare.org) for identity support
5. 5Report the scam to Scamwatch and ReportCyber using the links below, and forward any scam SMS to 7226 (spells SCAM)

Received — or fell for — a message impersonating Google? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.

• Scamwatch — Report the scam to the ACCC's national scam service.
• ReportCyber — Report cybercrime and financial loss to the police.
• ACMA — Complain about scam texts and spam SMS, email or calls.
• Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
• IDCARE — Free identity and cyber support if your details were taken.

Current Google impersonation runs on two engines: security fear and storage panic. Fake 'critical security alert' emails claim your account was accessed from overseas and will be disabled unless you verify through their link, while fake Gmail messages insist your storage is full and mail is bouncing. Both funnel you to lookalike sign-in pages built to capture your password and two-factor code, which then unlock your email, and through it, everything else. What recurs is the link. You can resolve everything by signing in at myaccount.google.com yourself, so type it, review your security activity there, and leave the emailed link unclicked.

• Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
• Account or identity takeover scams (Scamwatch (National Anti-Scam Centre))
• IDCARE: free identity and cyber support for Australians (IDCARE)