Email security alert or phishing?
Short answer
Open your provider’s security dashboard independently of the message. Check whether the event exists there before entering a password or code.
What you need to know
Avoid turning an alert into a credential theft.
-
Check the event independently
An authentic-looking logo or sender label can be copied. Open the provider directly and compare the account security event, rather than entering a password through the message’s sign-in link.
-
If you already entered a secret
Use the provider’s account-security response promptly and review the relevant credentials or methods. Keep the suspicious message for reporting if appropriate; never send more verification codes to the sender to “cancel” the incident.
Check, act, and the limit
-
Start by checking
Inspect the alert details without opening attachments or sign-in links.
-
Then act
Report the message using provider tools if it is fake; secure your account if the event is real.
-
Know the limit
A familiar logo or sender display name is not authentication.
Next guide: Unusual email sign-in alert
Official sources
Provider security pages this guide is based on. Product details change, so check them before acting.
- Google Account Help: respond to security alerts support.google.com
HackEmail is an independent guide. We never ask for your password or verification codes, never read messages and never access anyone’s inbox. Not affiliated with Google, Microsoft, Apple or Yahoo.