Scammers Exploit Genuine Google Security Alerts to Target Gmail Users With Fake Invoices
Cybercriminals are exploiting Google's legitimate security notification system to send fraudulent messages to Gmail users, making scam emails significantly harder to distinguish from genuine account alerts. The technique involves inserting fraudulent messages into the names of Google app passwords, causing Google to generate authentic, digitally signed security notifications containing the scammers' content.
According to information shared by Coin Bureau, attackers are using this method to distribute deceptive messages that appear to originate directly from Google's security infrastructure. Rather than creating conventional phishing emails that imitate Google's design and branding, scammers manipulate a legitimate Google account feature to make their messages appear trustworthy.
How the Google Security Alert Scam Works
The attack begins when scammers enter fraudulent text into the name field associated with a Google app password. App passwords are credentials designed to allow certain applications and devices to access a Google account without using its primary password.
By placing scam instructions or misleading payment information in that field, attackers can trigger Google to generate an authentic security notification containing the text they supplied. The resulting email is a genuine Google alert, complete with Google's legitimate security notification format and authentication signatures.
Scammers then forward the notification to their intended victims. Because the message is generated by Google rather than directly composed by the attacker, it can pass security checks that would normally identify suspicious or forged emails.
This approach creates a particularly difficult challenge for users. Traditional phishing awareness often focuses on identifying suspicious sender addresses, incorrect branding, fraudulent links and messages that imitate legitimate companies. In this case, however, the underlying notification is authentic, even though the information displayed inside it has been manipulated for fraudulent purposes.
Fake $399 McAfee Invoice Used in Reported Attack
One example of the technique was flagged by the University of Michigan. The fraudulent notification contained a fake McAfee invoice claiming a charge of $399 and included a telephone number that recipients were encouraged to call.
The message was designed to make recipients believe they had been billed for a security product or subscription they might not recognize. The unexpected charge could prompt concern and encourage users to contact the number provided to dispute the payment or request a refund.
That telephone number is central to the scam. Instead of directing victims toward a conventional phishing website, the attackers attempt to move markets the interaction into a phone conversation, where they can potentially impersonate customer support representatives and manipulate recipients into following their instructions.
Why Google's Genuine Buttons Do Not Reveal the Scam
Another detail makes this technique particularly deceptive. The Google security buttons included in the notification are legitimate and direct users to their own Google account pages.
However, visiting those pages does not necessarily reveal suspicious activity. The account may show no unauthorized access because the scam does not require attackers to compromise the recipient's Google account. Instead, the criminals exploit the way legitimate security notifications can display user-controlled information.
This creates a deliberate dead end for recipients. When they investigate the alert through Google's genuine account interface and find nothing apparently wrong, the fraudulent telephone number presented in the message may appear to be the only remaining way to resolve the supposed billing problem.
Coin Bureau highlighted the technique as a warning for Gmail users, emphasizing that an authentic Google security notification does not automatically mean every claim contained in its text is trustworthy.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.