CybersecuritySmall-business IT

A Real Google Security Email Can Still Be a Scam. Here's How to Check

Scammers are slipping fake invoices and phone numbers into real Google security alerts. How a small business checks an alert safely and what to do after a call.

By Cybercave Technologies, LLC · Nov 1, 2026

Tall stacks of brown paper envelopes filling the frame — Stacks of paper envelopes. Illustration only, not real mail or a real Google alert. Credit: Photo by serdar barış via Pexels (Pexels License).

Short answer: Yes, an email that really comes from Google can still carry a scam. Scammers are typing their own message, such as a fake invoice and a phone number, into a Google account setting so that Google's own alert repeats it. Don't call any number in a security email. Open myaccount.google.com yourself and check your recent security activity there.

Key points

The University of Michigan's Safe Computing team flagged a version on Oct. 6, 2026: a genuine Google "app password" alert that showed a fake $399 McAfee invoice and a phone number to call.
Switzerland's National Cyber Security Centre described a similar trick in September 2026, followed by a phone call from a fake "Google support" agent.
Because Google sends the email, it can pass the usual sender checks. The words inside it are the scammer's.
Google says it won't ever phone you about account security, and that any message claiming to confirm a caller's identity is a scam, even one sent from a real Google address.

What to do this week: tell everyone who handles your business email one rule: never call a phone number from a security alert. Check alerts only by typing myaccount.google.com into a new tab.

What is the Google security-alert scam?

It's a phone scam that borrows Google's credibility. The email looks like a normal Google security alert because it is one, but part of the text was written by the scammer, and that text pushes you to call a number.

The University of Michigan's Safe Computing team posted an example on Oct. 6, 2026, after people at the university reported it. The alert said an app password had been created and carried a fake $399 invoice using McAfee's name, plus a support number. U-M said no university account or system was compromised; the goal was to get the reader on the phone, where the real scam happens.

How can a genuine Google email carry a scammer's message?

Scammers abuse a label field. An app password is a special 16-digit code that lets an older app or device sign in to a Google account, and Google's help page says you can only create one when 2-Step Verification is on. When you make one, you give it a name. Scammers type their message into that name.

The Swiss National Cyber Security Centre (NCSC) laid out the steps in a Sept. 22, 2026 report: the scammers opened their own Google account, entered the victim's email address as that account's recovery address, then created an app password named with a fake case number. Google's system then emailed an official security warning to the victim's address, with the scammer's text inside. In the case U-M described, the alert first went to an address the scammer controlled and was forwarded on through a compromised school email system.

Why doesn't the email look fake?

Because the usual checks pass. U-M said the message carried valid Google and Microsoft email signatures, so it passed all of the university's email gateway checks. Advice like "check the sender address" doesn't help when the sender really is Google.

The links don't help either. U-M said the real Google buttons in the email just open the reader's own, clean account page, which shows nothing wrong. That dead end is on purpose: it leaves the phone number as the only thing left to try. In a related version documented by the cloud storage company MEGA, the link went to a fake sign-in page hosted on Google Sites, which sits on a real google.com address.

How do I check whether a Google security alert is real?

Go around the email, not through it. Gmail's help center advises skipping the email and opening myaccount.google.com/notifications directly, where your account's latest security events are listed.

Don't call, click or reply. Leave the email open if you want to compare, but don't act on anything in it.
Type the address yourself. Open a new tab and go to myaccount.google.com, then look at recent security activity. If the alert describes something that isn't listed there, treat the email as a scam.
Read the alert closely. If an "app name" or "device name" reads like an invoice, a case number or an instruction to call someone, that text came from a stranger, not from Google.
Hang up on "Google support." Google says it doesn't make calls about account security, and that it won't ask you over the phone to read out a verification code or approve a sign-in.
Report it. In Gmail, open the message, choose More next to Reply, then Report phishing. You can also report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.

What if someone already called the number or typed in a password?

Act the same day, and do it from myaccount.google.com, not from the email. The Swiss NCSC recommends these steps after an attack:

Change the account password.
Sign out of active sessions and remove any device you don't recognize.
Under Security, open App passwords and delete every entry there.
Check the account's recovery email addresses and any automatic forwarding rules in the mailbox.

If anyone gave out a card number or let a caller onto a computer, call your bank using the number on your card, and have the computer checked before anyone logs in to business accounts on it again.

What does this mean for a small business in Southwest Michigan?

If your office runs on Gmail or Google Workspace, the person who reads the security alerts may also be the person who pays the bills. Take a hypothetical Kalamazoo bookkeeping office: an alert shows up saying a $399 charge was approved, with a number to dispute it. A worried employee calls. That one call is what the scammer was after.

Our view: a written rule beats spotting tricks. "We never call numbers from security emails" protects your team even when the next version of this scam looks different.

What should you tell your IT provider?

Ask them to confirm three things on your business Google accounts: that no one has app passwords they don't need, that recovery email addresses and mail-forwarding rules are ones you recognize, and that staff know how to report a suspicious message. Google's help page notes app passwords aren't recommended in most cases, and some work accounts don't offer them at all.

What should you do this week?

Share the one-line rule with your team: never call a phone number from a security alert, and check alerts only at myaccount.google.com. Then take a minute to open your own account's recent security activity so everyone knows what the real page looks like.

For more, see our guides to spotting phishing aimed at your business logins, stopping impostor calls and payment fraud, and moving your team to stronger sign-ins.

FAQ

Can a scam email really be sent by Google? Yes. In the cases described by U-M and the Swiss NCSC, Google's own system sent the email, but a scammer wrote part of the text by naming an app password.

Does this mean my Google account was hacked? Not by itself. U-M said no account was compromised in the case it saw; the alert was bait to get people to call. Check your recent security activity at myaccount.google.com to be sure.

Will Google ever call me about a security problem? No. Google says it never calls about account security, and any message claiming to confirm a caller's identity is fraudulent.

What is an app password? A 16-digit code that lets an older app or device sign in to a Google account that has 2-Step Verification. Google recommends using "Sign in with Google" instead where possible.

Disclosure: No company named in this article paid for it, reviewed it or saw it before publication. MEGA, cited for its documented example, sells cloud storage and password tools. Details are as published by each source and were checked on Nov. 1, 2026. Not sponsored.