A security expert says scammers are sending fake Google login emails through Google's own systems, so a real sender name no longer proves a message is safe.
A security expert is warning that fake Google login emails are now being sent through Google's own systems. That makes them harder to spot, because the message can really come from Google and still be a trap.
Jameson Lopp, co-founder and Chief Security Officer of Casa, a service that helps people hold their own crypto, posted the warning on X on October 29. He said attackers are abusing Google's own infrastructure to send the emails. Each one holds a goo.gl link. Clicking it sends you to a fake login page. Lopp included a screenshot of the email.
Replies to his post added more. Some users said they had reported similar emails to Google more than once and heard nothing back. Others said the trick is sometimes paired with a phone call, where the caller ID is faked to look like Google.
Anyone with a Google account could get one of these, including Gmail users. Crypto holders are common targets of such scams. A familiar sender or a Google caller ID proves nothing. The alert box above lists what to do, including what to do if you already typed your password.
Several things are not known yet. The posts do not explain how attackers get Google's systems to send the emails, how many people are affected, or whether Google has responded.
Never type your Google password after clicking a link in a message, even one that appears to come from Google.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
