Is This Google Security Alert Real? How to Check

“Critical security alert.” “Someone has your password.” “Suspicious sign-in prevented.” Google really does send emails like these — and so do scammers copying them. The safe way to check is never the email itself: it’s your Google Account, opened by you. This guide shows how, plus what Google says it doesn’t ask for and what to do if you already clicked.

Quick check: paste the sender’s address into Is this Google email real?

Check the alert in your Google Account, not the email

1. Don’t use the email’s buttons or links. Open a new browser tab and type myaccount.google.com/notifications yourself. Google’s Gmail Help points there to see your account’s recent security activity.
2. Look for the same event. A genuine alert matches something listed there. For a “suspicious sign-in prevented” email, Google’s steps are: go to your Google Account, select Security, then on the Recent security events panel click Review security events.
3. Not there? Treat the email as phishing and report it.
4. There and not you? Select No, it wasn’t me for the activity and follow the steps in If you clicked or signed in.

Google’s own advice on suspicious-activity emails is to check your account this way and change your password if you notice anything unfamiliar.

Which address do Google security alerts come from?

Google doesn’t publish the sending address for its account security alerts in the help pages we checked — so an article claiming “real alerts always come from address X” isn’t something Google itself says. Two related facts Google does publish:

• Google Ads emails come from @google.com or @ads.google.com, in both the From address and the Return-Path.
• Gmail can show you whether a message is authenticated. A question mark next to the sender’s name means Gmail can’t confirm who sent it. In the Gmail Android app, open the message and tap View details → View security details to see Mailed by and Signed by.

Because a From address can be forged, the reliable test is authentication: copy the headers (More → Show original in Gmail) into the Email Header Analyzer and check that DMARC passed for a Google domain.

What Google says it doesn’t ask for

• Google Ads Help: Google doesn’t send unsolicited messages asking for your password or other sensitive information, by email or through a link.
• Google Voice Help, about the verification code sent when you set up Google Voice: “Google employees will never ask for this code,” and you shouldn’t reply to requests for it.
• Gmail Help’s general rule: if a link asks for your password, don’t enter it — go directly to the website you want to use.

Signs the alert is fake

• The sender’s name says Google but the address doesn’t match — a Gmail-style address, or a domain like google-account-recovery.com (see more look-alikes).
• A link whose real address, when you hover over it, isn’t on a Google domain.
• It asks you to sign in, enter a code, or download something to “secure” your account.
• Pressure: act now or lose your account.

If you clicked or signed in

Google’s steps to secure a compromised account:

1. Change your password straight away. Can’t sign in? Use Google’s account recovery page and answer the questions as best you can.
2. Review your account activity and select No, it wasn’t me for anything you didn’t do.
3. Check for devices you don’t recognise.
4. Remove labels, filters or forwarding rules you didn’t set up.
5. Correct your recovery phone number and email if they’ve changed.
6. Review the apps with access to your account.
7. Change the password on other sites that contact you through that Gmail address.

Turning on 2-Step Verification protects your account in case your password is stolen, as Google notes.

Report it

In Gmail on a computer, open the message, click More next to Reply, then Report phishing. More places to report: how to report phishing.

More help

• Is this Google email real? — check any sender against what Google publishes, with look-alike examples.
• How to spot phishing emails — the warning signs and tricks, for any company.
• How to check if an email is real — the headers and DMARC, app by app.
• Clicked a phishing link or gave your password? — what to do, step by step.
• How to report phishing emails — every place worth telling.