Fake Google Security Alert Emails: How to Check a Sign-In Warning Without Clicking It

You get an email from Google. The sender is no-reply@accounts.google.com. The subject line is something like "Security alert." It tells you someone just signed into your account from an unknown device, and there's a blue button waiting for you to click.

Here's the problem: that email might not be from Google at all.

Fake Google security alert emails are one of the more unsettling phishing tactics in circulation right now. They're written to trigger the exact response a real warning would: urgency, concern, and the instinct to click immediately. And they've gotten good enough that even careful users get tripped up.

The good news is that you don't need to click anything to find out whether a Google sign-in alert is real. Here's how to check.

What does a fake Google security alert look like?

A convincing fake Google security alert looks almost identical to the real thing: the Google logo, the right color scheme, a sender address that reads no-reply@accounts.google.com, and a message that tells you someone accessed your account from an unfamiliar location or device.

What makes newer versions so effective is that some of them actually pass Gmail's own authentication checks. In April 2025, ENS lead developer Nick Johnson documented a phishing email that passed Google’s DKIM check. Attackers abused the name field of a Google OAuth app to make Google itself send the alert, then forwarded the signed message to victims. The link inside pointed to a fake support page hosted on sites.google.com, a domain that’s legitimately part of Google’s infrastructure, as The Hacker News reported. Google initially called it intended behavior, then said it had rolled out protections.

That's the part that catches people off guard. When the link looks like google.com and the sender looks like Google, the usual advice doesn't hold.

The message often creates a sense of urgency, asking you to "review activity" or "secure your account" before something bad happens. That urgency is intentional. It’s meant to shortcut your judgment.

Why the usual checks don't always work

Most phishing advice tells you to look at the sender address, hover over links to inspect them, and watch for spelling errors. Those checks are still worth doing. They just don't tell the whole story anymore.

Here's why:

• The sender address can look legitimate. Attackers have exploited Google's own infrastructure to send alerts that appear to come from real Google addresses, including no-reply@accounts.google.com.
• The link domain can also look legitimate. sites.google.com is a real Google domain used for Google Sites, a website builder anyone with a Google account can access. A phishing page hosted there still sits on a Google URL.
• Autofill can mislead you. Some password managers match saved logins by base domain by default, so one may offer a saved Google login on other google.com subdomains, including pages anyone can create on sites.google.com. An autofill prompt is not confirmation that the page is safe, so check the full address before you let it fill.

Google and Microsoft are among the most impersonated brands in phishing campaigns. Cyble’s brand impersonation research lists both among the most spoofed enterprise services globally. More broadly, the FTC says people in the US reported losing $3.5 billion to imposter scams in 2025. Guardio’s own data shows Microsoft took the top spot in Q4 2025 as scammers shifted focus to account credentials and year-end subscription renewals.

Checking the sender and the link is still a reasonable first step. It's just not the last one.

How to check a Google sign-in warning without clicking it

This is the part that matters. You can verify any Google security alert directly through your account, without touching a single link in the email.

Step 1: Open a new browser tab and go to myaccount.google.com directly.

Type the address yourself. Don't click any link in the email, don't use a bookmark that an email prompted you to create. Just type it.

Step 2: Sign in and go to "Security."

Once you're in your Google Account, click on "Security" in the left sidebar. This is where all your recent account activity lives.

Step 3: Look under "Recent security activity."

Recent security activity shows security-related events from the past 28 days, such as sign-ins on new devices and password or recovery-info changes. If the alert in your email is real, it should show up in this list. If nothing matches, the alert may be fake, and you shouldn’t click anything in it.

Step 4: Check "Your devices."

Scroll down to see every device currently signed in to your Google account. If you spot one you don't recognize, you can remove it from here.

Step 5: If anything looks wrong, change your password from this page.

Do it from myaccount.google.com, not from a link in the email. That distinction matters most.

This process usually takes only a couple of minutes and tells you what the email was trying to get you to find out, without handing your credentials to anyone.

Red flags that suggest the email is fake

Even before you check your account, a few signals in the email itself can tell you something is off.

• Urgency that feels disproportionate. Real Google alerts typically explain what happened and give you options. Be wary of messages that demand immediate action or threaten to lock your account.
• A "mailed-by" or "signed-by" field that doesn't match Google. In Gmail, open the message and view its security details. In the Gmail app, tap “View details,” then “View security details.” If the mailed-by field shows a third-party domain like fwd-04-1.fwd.privateemail.com, the email was routed through an external server. The signed-by field can still show Google on a forwarded fake, so mailed-by is the one to watch. That's a red flag even if the "from" address looks right.
• A link that goes somewhere unexpected. Even if the URL contains google.com, hover before clicking. If the destination is something like sites.google.com/view/account-recovery-12345/, that's a user-created page, not an official Google destination.
• A layout that differs from what you usually see. Real Google security alerts follow a consistent design. If the button placement, formatting, or text structure looks slightly off, trust that instinct.
• The email asks for your password. Google says Gmail won’t ever ask for your password over email.

What to do if you already clicked

If you clicked a link and didn't enter any information, you're likely fine. Close the tab and don’t enter anything on it. If you’re unsure, check your account directly using the steps below.

If you entered your Google password on a page you reached through a suspicious email, act quickly:

1. Go to myaccount.google.com directly and change your password immediately.
2. Review “Recent security activity” and “Your devices” for anything you don’t recognize, and check which apps have access to your account.
3. Check that your recovery email and phone number haven't been changed.
4. Turn on two-factor authentication (2FA) if it isn’t already on. A stolen password alone isn’t enough to get in, though codes can still be tricked out of you on a fake page. Google says passkeys and security keys protect your account from phishing attacks.
5. In Gmail on a computer, report the email by selecting More (the three dots) next to Reply, then Report phishing.

The FBI’s Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025, with reported losses of about $215.8 million. The damage from credential theft extends well beyond one compromised account, especially if you reuse passwords across services, so change it anywhere else you used it.

The one rule that makes all of this simpler

If you get an email that says something is wrong with your Google account, don't respond to it directly. Go to myaccount.google.com on your own and look.

That one habit closes off most fake Google alert attacks. The phishing email only works if you follow its link. Remove that step and the attack fails.

Conclusion

Fake Google security alerts work because they borrow Google’s look and, sometimes, its own infrastructure. The reliable defense isn’t spotting every flaw in the email. It’s skipping the link and checking your account yourself.

Guardio doesn’t replace that habit, but it adds a layer. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.