Gmail scams
Last updated September 18, 2026
The short answer
Gmail is both a target and the delivery route for nearly everything else. The scams aimed at Gmail itself are fake "unusual sign-in" alerts and storage-full warnings designed to capture your password. Your email account is the master key to every other account, so it deserves the strongest protection you have.
Almost every scam in this wiki arrives in an inbox, and for most people that inbox is Gmail. That makes this page slightly different from the others: it is partly about attacks on Gmail, and partly about the fact that your email account is the recovery route for your bank, your payment apps and your social accounts. Whoever controls it can reset everything else. This is the single account where two-factor authentication is not optional.
How Gmail scams work
- 1
Fake security alerts
An email or text warns of a sign-in from an unfamiliar device or country and links to "secure your account". The link goes to a copy of the Google sign-in page. Ironically, the alert convinces you to do exactly what it warns about.
- 2
Storage-full warnings
A message says your account will be deleted or mail will stop arriving unless you upgrade or verify, linking to a fake login or a card-capture page.
- 3
Recovery-hijack via phone code
Someone contacts you — often as a buyer on a marketplace — and asks you to read back a code. The code is a Google account recovery code, and reading it out hands over the account.
- 4
Mail rules after a takeover
Once inside, the attacker adds a forwarding rule or a filter that archives specific messages, so password resets to your bank happen without you seeing them. This is why a takeover often continues after a password change.
Warning signs
- A security alert arrives by text or from a non-Google address
- You are asked to read back a verification code for any reason
- A message says your account will be deleted unless you act today
- A sign-in page is not on accounts.google.com — check the address bar
- Your sent folder contains messages you did not send
- Emails you expect stop arriving (a filter may be deleting them)
- Contacts report messages from you that you did not write
Examples
The alert that caused the breach
A text warns of a sign-in from Lagos and links to "secure your account". The page is a perfect copy of the Google login. The password is entered, then the code on the following screen is relayed live to the real site. The attacker adds a forwarding rule and resets two bank logins within the hour.
The marketplace code
A buyer for a sofa asks the seller to confirm they are real by reading back a code. The code is a Google account recovery code. The account is taken over, along with the photo library and the password manager backup stored in it.
What to do
- Turn on two-factor authentication — ideally a passkey or a hardware key, not SMS.
- Never read a verification code to anyone, for any reason.
- Check real alerts at myaccount.google.com/security rather than through a link.
- After any suspected compromise, check filters, forwarding rules and connected apps, not just the password.
- Use Google's Security Checkup to review devices and app access.
- Consider Advanced Protection if you are a higher-risk target.
Report it to Gmail
Report phishing from inside Gmail (the three-dot menu on the message), and recover a compromised account at g.co/recover.
Getting your money back
Recover the account at g.co/recover, then do the part most people skip: check Settings for forwarding addresses and filters, review connected apps and third-party access, and sign out of all other sessions. A forwarding rule left in place means the attacker keeps receiving your password resets no matter how many times you change the password. Then reset the accounts that use this email for recovery — bank, payment apps, social — because they are what the takeover was for. Turn on two-factor with a passkey or hardware key before you finish.
Frequently asked questions
Why does my email account matter more than my bank password?
Because it can reset the bank password. Email is the recovery channel for nearly every other account, which makes it the master key — an attacker who controls it does not need any of your other passwords. Protect it accordingly, with a passkey or hardware key rather than SMS codes.
I changed my password but the account still seems compromised. Why?
Almost certainly a mail rule. Attackers add forwarding addresses or filters that auto-archive security emails, and those survive a password change. Check Settings for forwarding and filters, revoke third-party app access, and sign out of all sessions.
Google sent me a security alert. How do I know it is real?
Do not use the link. Go to myaccount.google.com/security yourself and look at recent security activity — anything genuine appears there. Real Google alerts also never ask you to enter your password on a page you reached from a text message.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Gmail, these are the guides worth reading next.