Real Google Security Alert, Fake Bill: The App Password Scam and How to Check Your Account

Last checked: Nov 1, 2026. Based on reporting from the University of Michigan Safe Computing team, PlayCISO, BleepingComputer, Google Account Help, and Google's safety guides.

A scam email is hitting inboxes that passes every authentication check, because it's a real, signed Google security alert. Here's how the trick works, and how to check your account safely.

#How the scam works

Scammers have found a way to hide their message inside a genuine Google security alert.

According to PlayCISO, the attacker creates an app password on their own Google account and types the scam into the app password's custom name: a fake bill, an invoice, or a threat.

Google's systems then generate a genuine, signed "new app password" security alert that contains that name. The scammers forward the alert to their targets.

Because the alert is authentic and passes DKIM and DMARC email authentication checks, it gets through security filters.

#The University of Michigan example

The University of Michigan Safe Computing team flagged one of these emails on October 6, 2026. Some U-M community members reported receiving it.

The attack "leveraged a Google apps security notification to show a scammer's custom phishing message," the team wrote. The app password name contained a fake $399 McAfee invoice and a support phone number.

It was designed to make recipients think their account was compromised, "although no U-M account or system compromise occurred."

The goal: get the recipient to call the phone number.

#Why it passed email checks

The University of Michigan team explained that the attacker set the fake invoice and phone number as a Google app password label, "forcing Google's systems to generate an authentic, signed security alert containing the scammer's phishing message."

Google sent the alert to the scammer's recovery domain, which routed it through a compromised high school's Microsoft 365 tenant to auto-forward it to U-M.

"Stacking valid Microsoft and Google DKIM/DMARC signatures allowed the message to pass all gateway checks," the team wrote.

#The dead end that makes you call

According to the University of Michigan team, clicking the legitimate Google account links in these alerts leads to the recipient's own clean dashboard. That's an intentional dead end.

"The recipient only has one actionable resolution left in the email: calling the scammer's phone number," the team wrote.

PlayCISO also noted a variant with a 24-hour "permanent access" threat and a shortened link in the app password name. Gmail showed DKIM and DMARC passing.

#How to spot the scam

PlayCISO lists these giveaways:

• The alert and its real 'Check activity' button refer to someone else's account. If the email address shown isn't yours, it's not about your account.
• A link inside the alert wording. The normal buttons are fine, but a link embedded in the message text is a red flag.
• A false threat. App passwords can be revoked any time. Claims of "permanent access" or "24-hour deadline" are designed to push you into acting fast.
• Odd forwarding traces in 'Show original.' Check the email's full headers if you know how.

#What to do if you get one of these alerts

Google's safety guide recommends these steps for checking any Google security alert:

1. Don't call a number or use a link inside the alert. The scam relies on you taking that action.
2. Open your Google Account yourself. Type myaccount.google.com into your browser, or use the Google app.
3. Check Security, Recent security events. Look for unfamiliar locations or devices.
4. If you see something you don't recognize, secure your account. Change your password. Google's Account Help says app passwords are revoked when you change your Google Account password.
5. Report the email as phishing. In Gmail, click More, then Report phishing.

#If you already called

If you already called the number and gave remote access to your device or payment details:

• Contact your bank right away.
• Change your passwords, starting with your Google password and any financial accounts.
• Enable two-factor authentication if you haven't already.
• Check your Google Account's Security, Recent security events for unfamiliar activity.

#The earlier OAuth version

This isn't the first time scammers have exploited Google's security alerts.

BleepingComputer reported in April 2025 that phishers abused Google OAuth to spoof Google in a DKIM replay attack, using an OAuth app name instead of an app password name. Google said it had rolled out protections for that avenue.

As of November 1, 2026, no public statement from Google has addressed the app password variant specifically.

#How scammers pick their targets

Scammers find your email address, phone number, and other contact details from data brokers, people-search sites, old breaches, and marketing lists. They use that data to personalize phishing attempts and make messages like these more convincing.

UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.

#Sources

All facts in this article come from the following sources:

• University of Michigan Safe Computing: App password created to sign in to your account (Oct 6, 2026)
• PlayCISO: Google App Password Phishing: Real Alert, Fake Threat (Oct 31, 2026)
• Google safety guide: Verify a security alert (2026)
• Google Account Help: Sign in with app passwords (2026)
• BleepingComputer: Phishers abuse Google OAuth to spoof Google in DKIM replay attack (Apr 20, 2025)

---

Not affiliated with Google or McAfee.