Deepak Gupta

Is this Google security alert real? How to check without clicking

Don't use the links in the message. Type myaccount.google.com/notifications into your browser and check Recent security activity. If the alert is real, the same event shows there. Gmail won't ever ask for your password by email, and Google says it never calls you about your account security.

Do these 3 things now

1Don't click any link or button in the message. Type myaccount.google.com/notifications into your browser instead.Read to them:“Don't click any link or button in the message. Type myaccount.google.com/notifications into your browser instead.”
2Don't reply, call any number, or read out a code to anyone who contacts you about the alert. Google never calls about account security.Read to them:“Don't reply, call any number, or read out a code to anyone who contacts you about the alert. Google never calls about account security.”
3If you see activity that isn't yours, change your Google password right away.Read to them:“If you see activity that isn't yours, change your Google password right away.”

Check Recent security activity

Official link: myaccount.google.com

I am helping someone else

Helper mode: each step is written for you to read aloud. Let them tap and type on their own device; never ask them to send you a code. Send them this first.

01Is this you?

An email or text says there was a new sign-in or suspicious activity on your Google Account.
It asks you to click a link, sign in, call a number, or confirm a code.
Someone phoned saying they are from Google about your account.

Not quite? Someone already changed my password · I can't sign in at all · Someone offered to recover my account for a fee

02Official recovery path

Type myaccount.google.com/notifications into your browser and sign in. This is your Recent security activity page.Read to them:“Type myaccount.google.com/notifications into your browser and sign in. This is your Recent security activity page.”source
Look for sign-ins and security changes you don't recognize. Check the device type, time, and location of each one.Read to them:“Look for sign-ins and security changes you don't recognize. Check the device type, time, and location of each one.”source
If you opened the alert from inside your Google Account: select Yes if it was you, or No, secure account if it wasn't.Read to them:“If you opened the alert from inside your Google Account: select Yes if it was you, or No, secure account if it wasn't.”source
If something is unfamiliar, select Secure your account and follow the prompts to change your password.Read to them:“If something is unfamiliar, select Secure your account and follow the prompts to change your password.”source
Report the message in Gmail. Open it, click More next to Reply, then click Report phishing.Read to them:“Report the message in Gmail. Open it, click More next to Reply, then click Report phishing.”source
If you already typed your password into a link from the message, change your password now and sign out devices you don't know.Read to them:“If you already typed your password into a link from the message, change your password now and sign out devices you don't know.”source

Did that get you back in?

Yes

Lock it down now. Change the password, turn on two-step, sign out other devices. It takes about 15 minutes.

No

A.If someone called you: hang up. Don't share codes or passwords, and don't approve any sign-in prompt. Then check your account yourself through Security Checkup.Read to them:“If someone called you: hang up. Don't share codes or passwords, and don't approve any sign-in prompt. Then check your account yourself through Security Checkup.”source
B.Check that the sender's name and address match. On a computer, hover over links before clicking. These checks help, but going to your account directly is safer.Read to them:“Check that the sender's name and address match. On a computer, hover over links before clicking. These checks help, but going to your account directly is safer.”source
C.If Google flagged the message with a warning, don't click links, open attachments, or enter information.Read to them:“If Google flagged the message with a warning, don't click links, open attachments, or enter information.”source

Then: how long it takes

03How long it takes

No published timeline

Checking your account takes a few minutes. Google does not publish a timeline for reviewing phishing reports.

04Warn your contacts

Send this from another account or by text, so nobody falls for messages sent in your name.

Heads up: I got a fake "Google security alert" asking me to click a link and sign in. If you get one, don't click it. Open your Google Account directly and check Recent security activity instead. Google never calls about account security.

More templates: email, followers, customers

05Watch out for recovery scams

People who just lost an account are the main target of fake helpers. Only Google Account and Gmail's own app or website can restore your account.

Scam calls from "Google". Google warns that scammers spoof caller ID and even open real Google support cases tied to your account so the story looks real. How it works
Requests to approve a sign-in prompt on your phone. Google never asks for device approvals over the phone. How it works
Fake "Google support" phone numbers in search results and ads. Google says you can't call Google for help to sign in to your account. How it works

All recovery scams and how to spot them

06Once you're back in: lock it down

0 of 9 doneAbout 32 minutes total

Run Security Checkup5 minOpen myaccount.google.com/security-checkup and work through each item it flags.source
Change your password, and every reused one5 minChange your Google password. Then change it on any site that used the same password, or that lets you sign in with your Gmail. Check your passwords shows saved passwords that need fixing.source
Sign out devices you don't know3 minIn your Google Account, open Security & sign-in. In Your devices, select Manage all devices. Sign out of any device you don't recognize.source
Check Recent security activity2 minOpen myaccount.google.com/notifications and look for sign-ins or security changes you did not make.source
Fix your recovery phone and email3 minMake sure the recovery phone number and recovery email are yours and still work. Remove any you don't recognize.source
Create a passkey3 minGo to myaccount.google.com/signinoptions/passkeys and tap Create a passkey. Only do this on a device you own.source
Turn on 2-Step Verification5 minIn your Google Account, open Security & sign-in. Under How you sign in to Google, turn on 2-Step Verification and follow the steps.source
Print backup codes3 minUnder How you sign in to Google, select 2-Step Verification. Under Backup codes, use Get backup codes, then print or download them. Each code works once.source
Remove apps with access3 minOpen myaccount.google.com/linkedapps and remove access for any app you don't use or don't recognize.source

Then do the 24-hour cleanup.

Free toolExposure CheckSee what of yours is already public.Free toolPassword Breach CheckCheck if a password shows up in known leaks.ReadEmail hacked: 7 immediate steps

07How it probably happened

Most likely
A phishing email made to look like a Google alert
How this scam works
Also common
A fake sign-in page that passes your password and code to an attacker
How this scam works
Less common
A text message pretending to be a Google security alert
How this scam works

Account taken, recovery details swapped

08Report it

Avoid and report phishing emails (Gmail Help)

Lost money, being blackmailed, or someone is using your account to scam others? Report it to your country's cybercrime service too. If you are in danger, call your local emergency number.

United States

FBI Internet Crime Complaint Center (IC3)Report online crime, including account takeovers that led to money loss or extortion. The IC3 never contacts you first and never asks for money.
FTC ReportFraudReport the scam to the Federal Trade Commission.
IdentityTheft.govUse it if someone used your Social Security number or opened accounts in your name. You get a recovery plan.

United Kingdom

Report Fraud (England, Wales and Northern Ireland)Run by the City of London Police. It replaced Action Fraud on 4 December 2025. In Scotland, call Police Scotland on 101 instead.
Forward scam texts to 7726Free on most UK networks. Your provider can look into the sender and block it.
Report a scam email to the NCSCForward the email to report@phishing.gov.uk before you delete it.
Report Fraud: 0300 123 2040England, Wales and Northern Ireland. In Scotland, call Police Scotland on 101.

India

National Cyber Crime Reporting PortalRun by the Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs. Reports go to state and UT police.
Chakshu on Sanchar SaathiReport suspected fraud calls, SMS or WhatsApp messages to the Department of Telecommunications. It is not for money already lost: call 1930 for that.
National Cyber Crime Helpline: 1930Toll free, 24 hours. Call fast if money left your account: it can help freeze the transfer.

Canada

Canadian Anti-Fraud Centre: report onlineVictims and witnesses can report fraud or cybercrime online. Also contact your local police as soon as you can.
Canadian Anti-Fraud Centre: 1-888-495-8501Toll free. The CAFC does not contact people to ask for money.

Australia

ReportCyberReport cybercrime to police. Your report may go to your state or territory police or the AFP.
ScamwatchReport a scam, even if you lost no money. The AFP also points people worried about identity theft to IDCARE, a free support service.
ReportCyber phone line: 1300 292 371Report concerns about cybercrime or cyber security incidents. If life is at risk, call 000.

09Questions people ask

How do I know if a Google security alert is real?

Don't trust the message. Go to myaccount.google.com/notifications yourself and check Recent security activity. A real alert matches an event listed there.

Google called me about my account. Is it real?

No. Google says it never calls you about your account security, and any unsolicited call saying your account is hacked is a scam. Hang up and check your account yourself.

The email came from a real Google address. Can it still be a scam?

Yes. Google warns that scammers can open real support cases tied to your account, so real Google emails can be part of the story. Check your account directly.

Does Google ever ask for my password by email?

No. Google says Gmail won't ever ask you for personal information, like your password, over email, and its emails won't ask for the password to an account you're already signed in to.

I clicked and typed my password. What now?

Change your Google password now, then review devices and recent security events. If you're already locked out, use Google's account recovery page.

Sources and last check

Last verified: October 16, 2026. Steps checked against the platform's own help pages listed below. Device testing is ongoing; steps marked unconfirmed are still waiting for it.

Investigate suspicious activity on your account (read 2026-10-16)
Respond to security alerts (read 2026-10-16)
'Suspicious sign in prevented' email (read 2026-10-16)
Google Account Security Scam via Phone Call (read 2026-10-16)
Avoid & report phishing emails (Gmail Help) (read 2026-10-16)
Secure a hacked or compromised Google Account (read 2026-10-16)

Wrong step or changed screen? Report it. Never include passwords or codes.