Google Security Alert Email: Real or a Phishing Scam?

The email calls itself a security alert, and the exact wording varies. Many people search for it as a critical security alert. It mentions a sign-in on a device you do not own, or says Google blocked something. There is a button to check activity. You want to know whether this is Google, or someone pretending to be Google.

You can find out without clicking anything in the email. Real alerts leave a record in your Google Account, and a fake one does not. Check there first, then act on what you find.

This guide covers why Google sends these alerts, a safe way to verify one, what each kind of alert means, and what to do if the alert was real and the activity was not yours. It applies to Gmail and any Google Account, including the one behind your YouTube channel or Android phone.

Last checked: 19 October 2026.

#Quick Answer

To check whether a Google security alert is real, do not use the links in the email. Type myaccount.google.com/notifications into your browser, sign in, and look for the same event. Google's own phishing guidance points to that page for security emails you are unsure about. If the event is there and was not you, secure the account. If it is not there, the email is probably phishing.

#Why Does Google Send Security Alerts?

Google's page on responding to security alerts says it sends them when it detects important actions, like a sign-in on a new device, when it detects suspicious activity, like an unusual number of emails being sent, and when it blocks someone from taking a sensitive action, like checking stored passwords. Alerts can arrive by email or on your phone.

So an alert on its own is not proof of a hack. Signing in on a new phone, a friend's laptop or a hotel computer can trigger one. The question is whether you recognise the activity it describes.

#How to Check Whether the Alert Is Real

Work through these checks. The first is the one that matters most.

1. Open a new browser tab and type myaccount.google.com/notifications yourself. Google's phishing help page says to go there directly if a security email that looks like it is from Google might be fake. Compare the device, time and place with the email.
2. Do not enter your password from a link in the email. The same Google page says that if you are signed in to an account, emails from Google will not ask you to enter the password for that account.
3. In Gmail on a computer, open the email and click the small arrow under the sender's name. Google's page on authenticated messages says a message is authenticated if you see a "Mailed by" header with the domain name and a "Signed by" header with the sending domain, so check that the domain is Google's own. A question mark next to the sender means the message is not authenticated.
4. Look for a Gmail warning banner. Google says it warns about dangerous messages, and if you see a warning you should not click links or enter details.
5. Hover over any button without clicking and read the web address in the corner of the browser. Google says that if the address of a link does not match the description of the link, it might be leading you to a phishing site.

The sender name proves nothing, because anyone can set a display name to "Google". Rely on the account page and the authentication lines instead.

#What Each Google Alert Usually Means

The blocked sign-in case deserves attention. Google's page on the blocked sign-in notification says this alert means the password was correct but Google did not recognise the device or the location. In plain words, someone may know your password. Reasons it could still be you include travelling, a new phone, a friend's computer or a public computer.

#If the Alert Is Real and It Was You

Google's alert page says to review the sign-in details, including device type, time and location, and choose "Yes" if the activity was yours. Nothing else is needed.

#If the Alert Is Real and It Was Not You

Act now while you can still sign in. The steps below follow Google's own guidance.

1. On the alert in your Google Account, choose "No, secure account" and follow the steps. Google says you may need to change your password.
2. Change the password to a strong one you use nowhere else.
3. Turn on 2-Step Verification if it is off. Google's 2-Step Verification page recommends Google prompts as the second step if you do not use a passkey, and says prompts can help protect against SIM swap and other phone number based hacks.
4. Check your recovery phone and recovery email. An attacker who adds their own can take the account back later.
5. In Gmail settings, follow Google's Gmail security tips: check forwarding, filters that forward or delete mail, Send mail as addresses, and Grant access to your account.
6. Review the devices signed in to your account and sign out of any you do not recognise.
7. Change the password of any other account that used the same password, starting with banking and social media.

If you can no longer sign in, our guide to recovering a hacked Gmail account covers Google's recovery form and what it asks for.

#If the Alert Was Fake

A fake alert is phishing. Do not click anything in it. In Gmail, use the three-dot menu and choose Report phishing, then delete it. If you already clicked and typed your password, change it straight away from myaccount.google.com, then follow our checklist for what to do after clicking a phishing link.

For a phishing email or fake Google login page with no money lost, you can report it to CyberSecurity Malaysia's Cyber999 service, which accepts incident reports by online form, email, phone or its mobile app.

#Why Your Google Account Matters for Everything Else

Your Gmail address is often the recovery email for Instagram, Facebook, TikTok, your bank and your phone's cloud backup. If someone controls it, they can reset those accounts one by one. That is why a real alert deserves your attention now, even if it turns out to be your own new phone.

#When a Case Review Makes Sense

Many alerts turn out to be your own activity and need no further action. A review helps when the alert was real, you were locked out before you could act, and the Gmail address protects other accounts such as a business Page, a YouTube channel or an ad account. SocialSafe by AwareXone, AwareXone's account recovery service, starts with a review of what happened and works only through official recovery routes. Our account security service explains the hardening work we do after an incident, and our Trust Center lists what we will never ask for, starting with passwords and verification codes.

#Frequently Asked Questions