Last year a phishing email showed up from no-reply@google.com. It wasn't a lookalike address. It was the real one, and it passed Google's own signature check.
The scammers got Google's system to send a real, signed message, then forwarded it on. Google first said that was working as intended. Later it said it was working on a fix.
So checking the sender isn't enough anymore.
Judge the message by what it asks you to do. If it wants you to sign in through a link, call a number in the email, or pay a new account, don't. Go to the site or app yourself.
Top comments (0)