The short version: You may get a real security email from Google about an “app password”. But the message inside it, such as a case number, was typed by a criminal. Our advice: do not use any link or number in it. Go to myaccount.google.com yourself.
What is this, and why does it matter?
People have reported this trick since September 2026.
How it works:
- The criminal makes their own Google account.
- They add your email address as its “recovery email” (the backup address Google writes to about security).
- They create an “app password” (an extra password for older apps that cannot use normal sign-in) and type their scam message as its name.
- Google then sends its normal security email to that recovery address, with the scam message inside.
The criminals may also phone you, pretending to be Google support, and send you to a fake Google sign-in page. If you type your password or a code there, they can get into your real account. Switzerland’s national cyber security office (BACS) describes a case where criminals then added their own app password as a back door (a secret way in). In that case, they kept access even after the password was changed.
How to tell
- The email can look exactly like Google’s normal security alerts, because Google really sent it.
- The danger is the text the criminal typed inside it. Google says it “will never call you about your account security.”
What we do not know yet
- How many people got this email.
- Whether Google has changed anything.
Do this today (about 5 minutes)
- Our advice: don’t use a link or number from a security email, even a real one.
- Our advice: check your account yourself (about 2 minutes, our estimate). In a new tab, type myaccount.google.com/notifications. If the app password from the email is not listed there, it was not made on your account.
- Our advice: add a passkey (about 3 minutes, our estimate). A passkey lets you sign in with your fingerprint, face scan or screen lock (like a PIN) instead of typing a password. Go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey. Also turn on 2-Step Verification (a second sign-in check) with an authenticator app. Then a stolen password alone is not enough.
If you already called or typed your password
Our advice:
- Change your Google password on a device you trust.
- Sign out of devices you do not recognize. Go to google.com/devices, choose the device and select Sign out.
- Delete any app passwords you did not create. Go to myaccount.google.com/apppasswords and select Remove next to each one.
- Check that your recovery email and phone are yours.
To report it: on a computer, open the email in Gmail. Next to Reply, click More, then Report phishing.
See also: Hang up and call back
Sources
- Switzerland’s Federal Office for Cyber Security (BACS / NCSC), weekly review week 38, 22 September 2026, “Genuine Google emails, fake support and a dangerous back door” (official): https://www.bacs.admin.ch/en/26w38-en
- Google Gmail Help, “Avoid & report phishing emails” (official): https://support.google.com/mail/answer/8253?hl=en
- Google Account Help, “Sign in with app passwords” (official): https://support.google.com/accounts/answer/185833?hl=en
- Google Account Help, “Sign in with a passkey instead of a password” (official): https://support.google.com/accounts/answer/13548313?hl=en
- Google Account Help, “Set up recovery options” (official): https://support.google.com/accounts/answer/183723?hl=en
- Google Account Help, “Secure a hacked or compromised Google Account” (official): https://support.google.com/accounts/answer/6294825?hl=en
- Google Help, “Google Account Security Scam via Phone Call” (official): https://support.google.com/faqs/answer/17170932?hl=en
Checked: 2 Nov 2026, 11:20 Paris time. This entry will change if Google or BACS publishes more. Our disclosure: SafeinAI has no affiliate links and earns nothing from the sites or tools named on this page. If this ever changes we will say so here, on this page.
Leave a Reply