Is this security alert from Google a scam?
Tech companies like Google are impersonated with fake security-alert, account-locked and subscription-renewal scams. A text, email or pop-up alert that looks like it's from Google can be genuine — but it can just as easily be a scam built to look identical. The good news: a few quick checks almost always tell a real Google message from a fake.
Genuine Google links only ever go to google.com, accounts.google.com, gmail.com. Below is exactly what a real Google message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real Google message looks like
Genuine messages from Google only ever link to google.com, accounts.google.com, gmail.com.
- Genuine Google emails about account security or Gmail come only from addresses ending in @google.com or @gmail.com.
- Real Google security notifications never ask you to click a link; they direct you to sign in at myaccount.google.com or accounts.google.com yourself.
- Legitimate Google emails about unusual sign-in attempts include the city and device type that matched Google's own records.
- Google never sends SMS messages from short codes claiming to be an urgent account warning.
- Google Account emails display the correct sender name and never contain urgent threats about immediate account closure.
Crucially, Google will never ask for your password or a verification code, or demand remote access to 'fix' or 'secure' your account.
Common Google scams
- Emails claiming your Google Account has been accessed from overseas and urging you to 'secure' it by clicking a link that leads to a lookalike login page.
- Messages pretending to be from Gmail warning that your storage is full and directing you to a fake site to 'verify' your account.
- Phishing emails that copy Google's logo and layout but arrive from addresses such as support@google-secure-login.com and ask for your password.
Red flags to watch for
- The message contains a shortened link or a domain such as accounts-google-login.com instead of accounts.google.com.
- The email creates urgency by claiming your account will be deleted within hours unless you act immediately.
- It asks you to enter your Google password or two-factor code on the linked page.
- The sender address shows a slight misspelling such as noreply@googIe.com (capital i instead of lowercase L).
- The email references a recent login from a city you have never visited, but still pressures you to click rather than check myaccount.google.com directly.
Scam text examples
Here's a real example of a scam message impersonating Google, with the tell-tale red flags highlighted. Compare it against anything you've received.
Subject: Unusual sign-in blocked We stopped a sign-in attempt to your Google Account from Lagos, Nigeria. To prevent your account from being locked, verify your details now: https://accounts-google-secure.com/verify
What gives it away:
- The message contains a shortened link or a domain such as accounts-google-login.com instead of accounts.google.com.
- The email creates urgency by claiming your account will be deleted within hours unless you act immediately.
- It asks you to enter your Google password or two-factor code on the linked page.
- The sender address shows a slight misspelling such as noreply@googIe.com (capital i instead of lowercase L).
- The email references a recent login from a city you have never visited, but still pressures you to click rather than check myaccount.google.com directly.
Not sure about your message?
Paste the suspicious Google text or email and get an instant scam verdict, free.
How to verify a message from Google
- Type myaccount.google.com or accounts.google.com directly into your browser and sign in to review security activity.
- Open the official Gmail or Google app on your phone and check notifications inside the app rather than clicking email links.
Where to report a scam impersonating Google
Received — or fell for — a message impersonating Google? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Report scam texts and spam SMS or calls.
- Forward to 7226 (SPAM) — Forward the scam SMS to short code 7226 so your carrier can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Frequently asked questions
I received an email saying my Google Account was accessed from overseas — is it a scam?
Sign in yourself at myaccount.google.com/security and review recent activity. Real Google alerts never ask you to click a link to fix the issue.
Can Google send me a text message about a security problem?
Google does not use SMS for urgent account warnings. Any text claiming to be from Google is almost certainly fake.
How do I check if a link in a Google email is legitimate?
Hover over or long-press the link and confirm it leads only to accounts.google.com or myaccount.google.com. Any other domain is a scam.
What should I do if I clicked a suspicious Google login link?
Change your password immediately at myaccount.google.com, enable 2-Step Verification, and report the message at scamwatch.gov.au.
Related scam types
Scams impersonating Google usually fit one of these patterns. Learn how each works:
Related brands
Other tech names scammers impersonate — check a message from one:
This guide is general information, not legal or financial advice — always verify with Google through an official channel.