A convincing Gmail scam is tricking users into giving away personal data — here is how to spot and avoid it.
If you’ve received an email from the unsuspicious no-reply@google.com claiming to be from Google, urging you to “verify your account activity” or risk your Gmail being deactivated — don’t panic, and definitely don’t click on it. A new scam targeting Gmail users is doing the rounds, and it’s worryingly convincing. The email looks like it comes straight from Google. It was first spotted and reported by X user Nick Johnson. “Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google’s infrastructure” he said in a post.
The phishing email uses the company’s branding, has the correct logo, and includes language that sounds official. “The first thing to note is that this is a valid, signed email – it really was sent from no-reply@google.com. It passes the DKIM signature check, and GMail displays it without any warnings – it even puts it in the same conversation as other, legitimate security alerts,” Johnson wrote in a post. But make no mistake — this is a phishing attack designed to steal your personal data.
The phishing email warns that your Gmail account is being reviewed due to recent activity. It asks you to verify your account by clicking on a “Review Activity” button. The message creates urgency, saying that failure to act will result in account suspension within 24 hours.
India Today Tech also reached out to Google to understand how many people had the attack affected, if someone faced loss of funds or any other severe consequence of the attack. We will update the story with the responses soon.
At the time of writing the story, Johnson has confirmed that Google has acknowledged the issue and will be fixing the bug. “Google has reconsidered and will be fixing the oAuth bug!”
What makes this scam particularly dangerous is how authentic it looks. The sender’s name is displayed as “Google,” and at a glance, the email address may even appear legitimate. But when you look closely, the email is not from a genuine Google domain. Instead, it’s sent from a strange-looking address with random characters — a common red flag in phishing attempts.
The goal of such phishing emails is definitely to trick users into entering their Gmail login details on a fake website that looks exactly like the real thing. Once scammers get hold of your credentials, they can access your emails, steal personal data, and even use your account to send more phishing emails to your contacts.
“From there, presumably, they harvest your login credentials and use them to compromise your account; I haven’t gone further to check. So how did they do it – especially the valid email? This is due to two vulnerabilities in Google’s infra that they have declined to fix.”
In some cases, these scams go a step further — prompting users to enter their recovery email, phone number, and even two-factor authentication codes. That gives scammers full control of your account, locking you out completely.
First, do not click on any links. If you’re unsure whether the message is real, open Gmail in a new tab and go directly to your account settings — don’t rely on links in the email. Check your account activity and security settings from there. Second, report the email. Gmail has a built-in feature to report phishing — simply click on the three-dot menu in the top right corner of the message and select “Report phishing.” This helps Google identify and block similar scams in the future.
