In short
Most common fake: Phone call from 'Google support' about a hacked account.
Safest check: Hang up on anyone who calls saying they are from Google about your account.
Where to report it: In Gmail, open the message, select More next to Reply, then choose Report phishing.
What Google and Gmail says
Google says it will never call you about your account security, and it will not ask for your password, ask you to read out a verification code or ask you to approve a sign-in prompt. Gmail also says it will not ask for personal information such as your password by email. Source: Google (Gmail Help)
Common fake Google and Gmail messages
These are the 5 shapes a fake Google and Gmail message usually takes. They are listed in the order we see them most often, and none of them is something Google and Gmail itself does.
- Phone call from 'Google support' about a hacked account
- Email saying your storage is full and your files will be deleted
- Request to read out a verification code or approve a sign-in prompt
- Fake Google prize or lottery win
- Fake invoice for Google Ads or a Google Maps listing
Google and Gmail's real web addresses
Genuine Google and Gmail links and emails use these domains. Look at the part just before the first single slash: google.com is real, but google-support-center.com or google.com.account-check.top are not.
- google.com
- gmail.com
Scammers can also hide a fake link behind real-looking text. Learn how to read a web address.
How to check a Google and Gmail message safely
- Hang up on anyone who calls saying they are from Google about your account
- Never share a verification code or approve a sign-in you did not start
- Go to your Google Account yourself and run Security Checkup to review recent activity
- Hover over links to check where they really go before clicking
How to report a fake Google and Gmail message
- In Gmail, open the message, select More next to Reply, then choose Report phishing. Official details on support.google.com
- Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov. Official details on reportfraud.ftc.gov
Also report it to the official fraud service in your country. See the worldwide list.
If you clicked, paid or shared details
Act quickly. It makes a difference.
- If you entered card or bank details, call your bank now using the number on your card, and ask them to block the card.
- If you entered a password, change it at google.com, typed into your browser yourself, and turn on two-step verification. Do not use any link from the message.
- Expect follow-up calls or messages pretending to help, sometimes claiming to be from Google and Gmail security. Never share one-time codes and never move money to a "safe account".
- In Gmail, open the message, select More next to Reply, then choose Report phishing, then delete the message.
More help: Verification-code and account-takeover scams and what to do after a scam.
How to protect yourself next time
Turn on two-step verification, ideally with a security key
With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.
Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.
- YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.
Use a password manager
It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.
Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.
- NordPass Partner link Password manager with a free plan and a family plan for up to six people.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
Does Google and Gmail send messages asking for payment or personal details?
Google says it will never call you about your account security, and it will not ask for your password, ask you to read out a verification code or ask you to approve a sign-in prompt. Gmail also says it will not ask for personal information such as your password by email.
How can I check if a Google and Gmail message is real?
Hang up on anyone who calls saying they are from Google about your account. Never share a verification code or approve a sign-in you did not start. Go to your Google Account yourself and run Security Checkup to review recent activity. Hover over links to check where they really go before clicking.
How do I report a fake Google and Gmail message?
In Gmail, open the message, select More next to Reply, then choose Report phishing. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.
I clicked a link in a fake Google and Gmail message but did not enter anything. Am I at risk?
Opening a link is far less serious than filling one in. Close it, and if you need your account, reach it by typing google.com yourself. Clicking does tell the sender your number is live, so expect more messages for a while: in gmail, open the message, select more next to reply, then choose report phishing.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our pages against official advice from the organisations themselves and from government agencies.
- Avoid and report phishing emails (Google (Gmail Help))
- Google Account Security Scam via Phone Call (Google)
- Avoid and report scams (Google)