The Google Security Alert Scam is a phishing and tech support scam that uses fear to make victims believe their Google account has been hacked. The message may arrive by text, email, phone notification, pop-up, or even a fake website pretending to be a Google security page.
The goal is simple: push you to click, call, share codes, install remote access software, or hand over sensitive information.
Scam Overview
A real Google security alert is designed to protect your account. Google may notify users about suspicious activity, unfamiliar sign-ins, new devices, changed recovery details, or account behavior that looks unusual. Google’s own help pages explain that these alerts are meant to help prevent other people from using or abusing your account.
The scam version copies that same idea but twists it into a trap.
Instead of directing you to safely review your account from inside your Google Account settings, the fake alert creates panic and pushes you toward a risky action. It may tell you to call a “Google support” number, click a verification link, install a security app, confirm your password, or speak with a supposed fraud specialist.
The message usually sounds urgent:
“Google Security Alert: New login detected from an unrecognized device.”
“Your Google account was accessed from Windows, Chicago.”
“Suspicious sign-in blocked. Call support immediately.”
“Your account will be disabled unless you verify now.”
“Unauthorized recovery number added. Contact Google Security.”
The scam works because the fear is believable. A Google account can contain Gmail, photos, saved passwords, YouTube access, Google Drive files, Android backups, business accounts, payment details, browser sync data, and recovery access for other services. Losing control of it can feel serious.
Scammers know that. They use the Google name because people trust it. They add technical details like a city, device type, IP address, browser name, or operating system to make the alert feel more realistic. Then they create a deadline or warning to make the victim act quickly.
The most dangerous version of this scam leads to fake tech support. A victim calls the number in the message and reaches someone pretending to be from Google Security, Google Support, Gmail Protection, or an account recovery department. From there, the scammer claims the victim’s device is infected, the account is hacked, or someone is stealing money through connected accounts.
The fake support agent may then ask the victim to install AnyDesk, TeamViewer, UltraViewer, Zoho Assist, or another remote access tool. The FTC warns that tech support scammers commonly ask for remote access, send victims to spoofed websites, and push them to enter banking or card information under the excuse of support or refunds.
Once connected remotely, the scammer can watch the screen, guide the victim through banking pages, see private information, manipulate what appears on the device, or pressure the victim into making payments. They may claim they need to “secure” the account, “remove hackers,” “refund fraudulent charges,” or “move money to a safe account.”
Another common ending is the gift card demand. The scammer may tell the victim to buy Google Play, Apple, Steam, Target, Walmart, or other gift cards and read the codes over the phone. The FTC specifically warns that scammers often impersonate tech support and ask for remote access or gift card payments, and that gift cards should not be used as payment to fix a computer or account issue.
This is why the Google Security Alert Scam should not be treated as a harmless spam message. It can lead to full account takeover, stolen banking information, unauthorized transfers, identity theft, gift card loss, crypto theft, or malware installation.
How the Google Security Alert Scam Works
1. The Victim Receives a Fake Security Alert
The scam begins with a message that appears to come from Google. It may arrive as an SMS, email, browser pop-up, phone notification, or fake login page.
Common subject lines and text examples include:
- “Google Security Alert”
- “Critical Security Alert”
- “Suspicious Sign-In Prevented”
- “New Login From Unknown Device”
- “Your Google Account Was Accessed”
- “Account Verification Required”
- “Recovery Phone Number Changed”
- “Your Gmail Account Will Be Disabled”
Some fake alerts are very simple. Others are designed to look like official Google emails, with logos, buttons, warning colors, and security language.
2. The Message Creates Panic
The scammer wants the victim to feel that something bad is already happening. The fake alert may claim:
- Someone logged in from another city or country
- A hacker changed the recovery phone number
- A suspicious device was added
- Gmail was accessed from a new browser
- The account will be suspended
- The device is infected
- Payment or banking information is at risk
- Google detected unauthorized activity
The message often uses urgent wording such as “immediately,” “final warning,” “act now,” “account locked,” or “if this was not you.”
That urgency is intentional. The scammer does not want the victim to calmly open Google Account settings and check the alert safely.
3. The Victim Is Pushed to Call or Click
This is the main trap.
A legitimate security check should be handled through your actual Google Account, not through a random phone number, suspicious link, or pop-up. Google’s account recovery guidance tells users to review recent security events from their Google Account and follow the on-screen steps if they see activity they do not recognize.
The fake alert avoids that safe path.
Instead, it may say:
- “Call Google Security at this number.”
- “Click here to verify your identity.”
- “Download this security tool.”
- “Confirm your account before it is disabled.”
- “Contact support within 24 hours.”
If the scam is a phone-based version, calling the number connects the victim to a fake tech support center.
4. A Fake Google Agent Takes Over the Conversation
The scammer may sound professional. They may use scripts, background call center noise, fake employee names, and technical language to appear legitimate.
They may say:
- “Your account has been compromised.”
- “Hackers are connected to your Gmail.”
- “Your IP address is showing suspicious activity.”
- “Your phone has malware.”
- “Your bank account may be exposed.”
- “We need to secure your device now.”
- “Do not log out or the hackers may regain control.”
At this stage, the scammer is building authority. They want the victim to stop questioning and start following instructions.
5. The Scammer Requests Remote Access
The fake support agent may ask the victim to install remote access software. They may describe the app as a “Google security tool,” “support connection,” “verification tool,” or “screen sharing app.”
This is a major red flag.
Remote access tools can be legitimate when used by real IT professionals, but scammers abuse them to view or control the victim’s device. Once connected, they may open system screens, logs, warnings, or command windows and falsely claim these normal items prove the device is hacked.
They may also ask the victim to open Gmail, Google Account settings, online banking, PayPal, Cash App, Coinbase, or other sensitive accounts.
6. The Scam Becomes Financial
After the fake diagnosis, the scammer turns the conversation toward money.
They may claim:
- You need to buy security software
- You are owed a refund
- A hacker made unauthorized purchases
- Your bank account must be checked
- You need to transfer money to a “safe” account
- You must buy gift cards to complete verification
- You must pay to remove malware
- You must send crypto to protect your funds
A common trick is the fake refund scam. The scammer asks the victim to log in to online banking while remote access is active. Then they claim a refund was processed incorrectly or that too much money was returned. They pressure the victim to “send back” the difference, often through gift cards, wire transfer, crypto, or payment apps.
7. The Scammer May Try to Steal the Google Account
Not every version focuses on immediate money. Some scammers first try to take over the Google account itself.
They may ask for:
- Your Google password
- A two-step verification code
- A recovery code
- A backup code
- A password reset code
- Access to your Gmail
- Permission to approve a sign-in prompt
- A screenshot of your security settings
Never share one-time codes. A code that looks like a security step for you can be the final key the scammer needs to enter your account.
8. The Victim May Be Targeted Again
If the scammer gets money, account access, or personal data, the victim may be contacted again. The next caller may claim to be from Google, the bank, law enforcement, a refund department, or a recovery company.
These follow-up scams often target people who already lost money. The new scammer may claim they can recover the stolen funds for a fee. In many cases, that is simply another layer of fraud.
Common Google Security Alert Scam Examples
Below are examples of fake messages scammers may use. The exact phone numbers, links, locations, and wording can change.
1. Fake New Login Alert
“Google Security Alert: New login detected from Windows in Chicago. If this was not you, call support immediately at +1-XXX-XXX-XXXX.”
2. Fake Critical Security Alert
“Critical Security Alert: Suspicious activity detected on your Google account. Verify now to avoid suspension.”
3. Fake Gmail Access Warning
“Gmail Notice: Your account was accessed from an unknown browser. Contact Google Security if this was not you.”
4. Fake Account Lock Warning
“Google: Your account has been temporarily locked due to unusual activity. Call now to restore access.”
5. Fake Recovery Phone Change
“Google Alert: A new recovery phone number was added to your account. If you did not authorize this change, call immediately.”
6. Fake Device Infection Alert
“Google Security: Malware detected after suspicious login attempt. Speak to a support agent now.”
7. Fake Verification Request
“Google: Verification required after unusual sign-in. Confirm your identity now or your account may be disabled.”
8. Fake Banking Risk Alert
“Google Security Team: Your account may be linked to unauthorized banking activity. Call now to secure your device.”
9. Fake Password Reset Alert
“Google: Password reset requested from unknown location. If this was not you, contact account protection immediately.”
10. Fake Account Suspension Threat
“Final Notice: Your Google account will be suspended in 24 hours due to suspicious activity. Verify immediately.”
Red Flags of the Google Security Alert Scam
The alert is likely fake if:
- It tells you to call a random phone number
- It uses panic-driven language
- It threatens account suspension
- It asks you to click a shortened or strange link
- It asks for your password or verification code
- It asks you to install AnyDesk, TeamViewer, or another remote access app
- It asks you to open your bank account
- It claims your device is infected
- It asks for gift cards, crypto, wire transfers, or payment apps
- It has strange spelling, spacing, grammar, or formatting
- It comes from a suspicious email address or unknown sender
- It claims to be Google but sends you to a non-Google website
The biggest warning sign is this: scammers try to move you away from Google’s real account security tools and into their own phone call, link, or remote session.
What To Do If You Receive a Google Security Alert
Do not panic. Do not call the number in the message. Do not click the link. Do not reply.
Instead, check your account manually.
Open your browser or Google app yourself, go directly to your Google Account, and review your security settings. Google’s guidance says users can check recent security events and confirm whether suspicious activity was theirs or not.
Take these steps:
- Go directly to your Google Account.
- Open the Security section.
- Review recent security events.
- Check signed-in devices.
- Remove devices you do not recognize.
- Review your recovery phone and recovery email.
- Change your password if you see suspicious activity.
- Turn on two-step verification or passkeys.
- Check Gmail forwarding rules and filters.
- Block and report the scam message.
Google also recommends a Security Checkup to help protect an account, detect suspicious activity, and recover access if needed.
What To Do If You Called the Fake Google Support Number
If you called but did not share anything, hang up and block the number. Then check your Google Account directly.
If you followed instructions, take stronger action.
1. Disconnect Remote Access
If the scammer told you to install AnyDesk, TeamViewer, UltraViewer, Zoho Assist, or another remote access tool, disconnect from the internet immediately.
Turn off Wi-Fi, unplug Ethernet, or enable airplane mode.
2. Uninstall the Remote Access App
Remove any app the scammer asked you to install. Also check whether “unattended access” or automatic connection was enabled.
3. Change Passwords From a Clean Device
Use another device that the scammer never accessed. Change passwords for:
- Gmail
- Banking accounts
- PayPal
- Crypto accounts
- Shopping accounts
- Apple ID or Microsoft account
- Any account that uses the same password
4. Secure Your Google Account
Review recent security events, remove unknown devices, update recovery options, and turn on two-step verification or passkeys. Google advises users to review unfamiliar devices and suspicious account changes when investigating suspicious activity.
5. Contact Your Bank
Call your bank using the number on the back of your card or inside the official banking app. Tell them you may have been targeted by a tech support scam.
Ask them to check for:
- New payees
- Unauthorized transfers
- Card charges
- Changed contact details
- New devices
- Suspicious login activity
6. Cancel Exposed Cards
If you typed card details, read card details aloud, or opened banking while the scammer was connected, ask your bank whether the card should be replaced.
7. Report Gift Card Losses Immediately
If you bought gift cards and gave the codes to the scammer, contact the gift card company right away. Keep the card and receipt.
8. Scan the Device
Run a full security scan. If the scammer had remote control, consider asking a trusted local technician to inspect the device.
9. Watch for Follow-Up Scams
Do not trust anyone who contacts you claiming they can recover the money for a fee. Recovery scams often follow tech support scams.
Is Your Device Infected? Run a Free Malware Scan
Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. A quick way to check is to scan your device with Malwarebytes Free, one of the most trusted malware removal tools available. If you only visited a scam page and didn’t download or install anything, this scan is optional.
The free version detects and removes the most common threats, including:
- Adware — the cause of those annoying pop-ups
- Browser hijackers — unwanted redirects and changed homepages
- Trojans and spyware — hidden programs stealing your data
- Potentially unwanted programs (PUPs) — software you never asked for
👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.
Run a Malware Scan with Malwarebytes for Windows
Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan your PC and remove what Malwarebytes finds.
Download Malwarebytes
Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.
Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium
Malwarebytes Free for WindowsScans and removes malware at no cost-
Install Malwarebytes
When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.
Follow the On-Screen Prompts to Install Malwarebytes
The setup wizard will walk you through a few quick screens:
-
Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.
-
Malwarebytes will now install on your device. This usually takes under a minute.
-
When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.
-
On the final screen, click Open Malwarebytes to launch the program.
-
Optional: Check for rootkits with a Custom Scan
You don’t need to change any settings for a normal scan. The standard Threat Scan in the next step is enough for most problems, so you can go straight to it.
If you also want to check for rootkits, use a Custom Scan. In current versions of Malwarebytes, rootkit scanning is only available there:
- On the Scanner tile, click the three-dot menu and select Advanced Scan.
- Choose Custom Scan. In its options, check Scan for rootkits.
- Select your system drive (usually C:\) as the location to scan, then start the scan. It takes longer than a Threat Scan.
- When it finishes, review and quarantine the results as described in the steps below.
Rootkit scanning isn’t available on Windows devices with ARM processors.
Start the Scan
Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.
-
Wait for the Scan to Finish
The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.
Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.
-
Restart Your Computer
Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.
When the scan is done, check whether the problems you noticed have stopped. If they continue, see the options below.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:
- Run a computer scan with ESET Online Scanner
- Ask for help in our Windows Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Mac
Malwarebytes for Mac is a free on-demand scanner that removes the malware other security software tends to miss — adware, browser hijackers, and unwanted programs included. Cleaning an infected Mac with Malwarebytes has always been completely free, and it’s our go-to recommendation. Follow the steps below to scan your Mac and remove what Malwarebytes finds.
-
Download Malwarebytes for Mac
Click the button below to download the latest version of Malwarebytes for Mac.
Download MalwarebytesOfficial installer for macOS. Your download starts right away.Want real-time protection? See Malwarebytes PremiumMalwarebytes Free for MacScans and removes malware at no cost -
Open the Malwarebytes setup file
When the download finishes, open your Downloads folder and double-click the setup file to begin the installation.
-
Follow the On-Screen Prompts to Install Malwarebytes
The Malwarebytes for Mac Installer will guide you through a few quick screens. Click “Continue” and keep following the prompts until the installation completes.
When the installation is complete, Malwarebytes opens to the Welcome to Malwarebytes screen. Click “Get started“.
Malwarebytes needs Full Disk Access to check your whole Mac. When it asks, open System Settings > Privacy & Security > Full Disk Access, turn on Malwarebytes (it may be listed as Malwarebytes Protection), and confirm with your password or Touch ID. Then return to Malwarebytes. On macOS Monterey and earlier, this setting is in System Preferences > Security & Privacy > Privacy.
-
Select “Personal Computer” or “Work Computer”
Malwarebytes will ask what type of computer you’re installing it on. Click either Personal Computer or Work Computer, whichever applies.
-
Start the Scan
Click the “Scan” button. Malwarebytes will automatically update its detection database and begin checking your Mac for malware.
-
Wait for the Scan to Finish
Malwarebytes will scan your Mac for adware, browser hijackers, and other malicious programs. This can take a few minutes, so feel free to do something else — just check back occasionally to see the progress.
-
Quarantine the Detected Threats
When the scan is done, you’ll see a list of everything Malwarebytes found. Click the “Quarantine” button to remove all the threats at once.
-
Restart Your Mac
Malwarebytes will now remove all the malicious files it found. Some threats can only be fully removed after a reboot — if Malwarebytes asks you to restart, allow it. Once you’re logged back in, check whether the problems you noticed have stopped. If they come back, save the scan report and ask for help in our forum.
If the problems you noticed continue after the scan, see the options below.
If you are still experiencing problems while trying to remove a malicious program from your computer, please ask for help in our Mac Malware Removal Help & Support forum.
Run a Malware Scan with Malwarebytes for Android
Malwarebytes for Android scans your phone or tablet for malware, adware, and potentially unwanted apps. The free version scans only when you start a scan. Real-time protection, which checks apps automatically, is part of the paid Premium version.
-
Download Malwarebytes for Android.
You can download Malwarebytes for Android by clicking the link below.
Get Malwarebytes for AndroidOpens Google Play in a new tab.Want real-time protection? See Malwarebytes Premium for AndroidMalwarebytes for AndroidScans your phone and removes malware at no cost -
Install Malwarebytes for Android on your phone.
In the Google Play Store, tap “Install” to install Malwarebytes for Android on your device.
When the installation process has finished, tap “Open” to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.
-
Follow the on-screen prompts to complete the setup process
When Malwarebytes opens, it walks you through a short setup. Tap Get started and follow the prompts. If you see an offer for a trial or a paid plan, read it before you accept. You can skip it and keep using the free scanner.
Malwarebytes will ask for permission to access the files on your phone so it can scan them. Tap Allow, or turn on the permission in the Android screen that opens, then return to Malwarebytes.
-
Run a scan with Malwarebytes for Android
On the main screen, tap Scan now. In some versions, you open the menu, tap Scanner, and then tap Run a scan.
-
Wait for the Malwarebytes scan to complete.
Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.
-
Remove the detected apps.
When the scan has been completed, you will see a list of the threats that Malwarebytes for Android has detected. Next to each detected item, tap the menu icon (three dots), then choose to uninstall the app or delete the file. Android then asks you to confirm. Tap OK or Uninstall to remove the app.
-
Restart your phone.
When the detected apps are removed, restart your phone if Malwarebytes asks you to. Then check whether the problems you noticed have stopped.
If the problems you noticed continue after the scan, see the options below.
If you are still having problems with your phone after completing these instructions, then please follow one of the steps:
- Ask for help in our Mobile Malware Removal Help & Support forum.
- Only as a last resort, reset your phone to factory settings. Read the warning below first.
- Back up your photos, videos, files, and messages, for example to your Google account or a computer.
- Make sure you know your Google account email and password. The phone asks for them after the reset. If you changed the password recently, Google recommends waiting 24 hours before you reset.
- On a Samsung phone, also make sure you know your Samsung account password.
- If you use an authenticator app for two-step verification, move your accounts to another device or save your backup codes first.
Stay Protected: Block Ads and Malicious Sites
No scan can prove a device is completely clean, so it helps to block threats before they reach you. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.
We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.
👉 Download AdGuard and browse safely
FAQ About the Google Security Alert Scam
Is every Google Security Alert a scam?
No. Google can send real security alerts when it detects suspicious activity or a new sign-in. The scam version usually pushes you to call a random number, click a suspicious link, install remote access software, or share sensitive information.
How can I safely check if a Google alert is real?
Do not use the link or number in the message. Go directly to your Google Account, open Security, and review recent security events and signed-in devices.
Does Google ask users to call a support number from a text message?
A random phone number inside an unexpected security text should be treated as suspicious. Scammers commonly use fake support numbers to move victims into tech support fraud.
What happens if I call the number?
You may reach a fake support center. The scammer may claim your account is hacked, your device is infected, or your bank account is at risk. They may ask for remote access, verification codes, gift cards, or banking access.
Why do scammers ask for AnyDesk or TeamViewer?
They want to view or control your device. Once connected, they can watch what you type, guide you into banking pages, fake technical problems, or manipulate you into sending money.
Why do scammers ask for gift cards?
Gift cards are fast, hard to reverse, and easy to resell. No legitimate Google security process requires gift cards.
Should I change my Google password?
If you only received the message and did not interact with it, first check your Google security activity. If you see anything suspicious, change your password immediately from a clean device.
What if I gave the scammer a verification code?
Change your password immediately, sign out of all devices, remove unknown recovery options, and enable stronger two-step verification. A verification code can allow a scammer to access or take over your account.
What if I clicked the link but did not enter anything?
Close the page and do not continue. Then manually check your Google Account security settings. If you downloaded anything, remove it and scan your device.
What if I entered my password on a fake Google page?
Change your Google password immediately from a clean device. Then sign out of all devices, check recovery options, review Gmail forwarding rules, and enable two-step verification.
The Bottom Line
The Google Security Alert Scam uses the fear of a hacked account to push victims into dangerous actions. The fake alert may look like a warning about a new login, suspicious activity, account suspension, malware, or recovery changes.
The safest response is to avoid the phone number, avoid the link, and check your Google Account directly. Real account protection happens inside your official Google Account settings, not through a random support number, remote access session, gift card payment, or verification code request.
If a supposed Google agent asks to control your device, view your bank account, receive gift card codes, or collect one-time verification codes, it is a scam.
Join the discussion
2 commentsShare your experience or ask a question about this article.
Discussion
Hi Thomas,
I had used your last article: https://malwaretips.com/blogs/megan-and-joy-lexington-shopping-scam/
To report the site for fraud and had a refund reissued to my credit card since I had fallen for this scam. I wanted to see if you would be interested in investigating this website to see if it is fake: https://www.pilates-girl.com/pages/about-us
It was recently registered last year and I saw they had gotten a trademark also recently approved: https://tmsearch.uspto.gov/search/search-results/99089001
The pictures are blurry and it doesn’t seem like a real website to me. I was trying to figure out how a trademark was able to be registered for something like this.
Thanks!
Dana
In reply to Dana
That is very good to hear, and thank you for coming back to say so – the reissued refund is the part other readers need to know is possible, because most people assume the money is simply gone.
On the pattern you are noticing across the two articles: these are almost certainly the same operator. One template, a series of pleasant two-name boutique brands, a new domain each time the last one accumulates complaints or loses its payment processing. Which is why the practical advice generalises – the shop name is the least reliable thing about it, and the domain registration date on a free WHOIS lookup tells you more than the entire About page.
If you spot the next one in the series, do post it. Reader reports are how we find them, and the sequence is usually recognisable from the layout and the wording of the returns policy alone.