Scam library

Real alert, fake link inside

A genuine security email from Google or another big company carries a scammer's text and link, slipped into a field the scammer controls.

What it looks like

Fictional example: From no-reply@accounts.google.com. "This is a copy of a security alert sent to someone.else@gmail.com. you@example.com is the recovery email for this account. App password created: If you didn't generate this password, secure your account at sites.google.com/view/account-check (copy the link to your browser)."

Fictional example: A real invoice email from a payment company whose note field says "Charge of $499 not made by you? Call 1-800-000-0000 to cancel."

How it works

The scammer opens their own account and puts your email address in as its recovery address, which needs no permission from you. Then they do something that makes the company send a security alert, like creating an app password, and they type their bait into the name field. The company copies that name into its own alert and sends a copy to you. Because the email really comes from the company, sender checks say it's genuine. The link goes to a page anyone can make on the company's free tools, such as sites.google.com, where a fake sign-in page waits for your password and code.

Warning signs

It says it's a copy of an alert for an account that isn't yours.
A security email contains a link to sites.google.com, docs.google.com, forms.gle or another page anyone can publish.
It tells you to copy the link into your browser.
The odd sentence sits where a device, app or item name normally goes, and its grammar doesn't match the rest of the email.

If you got one of these

Don't open the link or call any number in the alert.
Check your own account by typing myaccount.google.com (or the company's site) yourself. Your account is fine unless you entered your password on the fake page.
If you want off that stranger's account, use the remove link in the alert only after checking it goes to accounts.google.com, or just delete the email.
Report the fake page at safebrowsing.google.com/safebrowsing/report_phish.

If you already paid or shared something

If you typed your password into the page, change it now from myaccount.google.com, then sign out of all other sessions.
If you also gave a sign-in code, check recovery email, phone and app passwords for anything you didn't add, and remove it.

Who gets targeted

Anyone whose email address is public. Scammers use it because people are told to trust emails that really come from the company.

Also read: I got a real Google security alert, but it has a strange link in it. Is it safe?

Got one? Paste it in