Don’t click that Google email! Gmail address change could be a scam
Earlier this month, Google started rolling out a new feature that lets users change their Gmail addresses—and it’s already being exploited by cybercriminals and malicious actors.
The new feature allows one’s original Gmail address to remain as an alias, so that incoming emails continue to land in the same inbox. The feature is primarily intended for users who want to replace their old address.
Security experts are now warning that scammers are specifically exploiting this new feature by crafting deceptively genuine phishing emails that are sent via legitimate Google systems and aim to take complete control of Google accounts.
Phishing via Google imitations
According to security experts, scam emails are currently being sent that purportedly originate from Google and refer to an alleged change of Gmail address or a necessary security confirmation. The messages appear particularly credible because they’re sent via Google’s own systems and display real Google addresses, such as “no-reply@accounts.google.com” as the sender.
These emails often mention a security-related action, such as activating a new address or confirming your identity. A link supposedly leads to a Google support or security page, but in reality users end up on fake websites where they’re asked to enter their password.
What makes this particularly insidious is that the scammers are using the “sites.google.com” domain, which is a legitimate Google service for user-generated websites—and is therefore not blocked by many spam filters. These fake sites are made to imitate genuine Google support pages in a way that seems visually authentic at first glance.
If attackers succeed in taking over your Google account, the consequences are serious. Not only are Gmail messages affected, but all connected services (such as Google Drive, Google Photos, and Google Calendar) will also be compromised. Furthermore, if your Google account is used to log into third-party services (such as social networks, online shops, or financial services), attackers can trigger a chain reaction and gain access to those other accounts.
Security experts warned of this before
Security company Check Point Research had previously pointed out a first wave of these attacks at the end of 2025, even before Google had officially announced the new feature more widely.
Back then, the attackers had abused a workflow automation tool to send phishing emails via legitimate Google infrastructure. Google stated that its own systems had not been compromised, but that protective measures had been taken.
How to recognize phishing emails
Despite their professional appearance, many of these fraudulent emails can be spotted if you know what to look for. Typical red flags include:
- Impersonal salutations such as “Dear customer” instead of your actual first and last name.
- Urgent wording and threats, such as risk of account suspension, account deletion, or monetary consequences. The urgency is meant to scare you into acting without thinking.
- Requests to enter passwords or other access data via a link. The link often takes you to a fake website that’s dressed up like the real thing, hoping you’ll enter your credentials—which are then intercepted by the scammer.
Google itself recommends never clicking links in emails and instead always checking security warnings directly in your account. To do this, open your browser and manually navigate to your Google account page instead of clicking on links in emails. Genuine warnings usually contain details such as device type, time, and location of access.
How to protect your Google account
The most important thing you can do is maintain healthy skepticism towards unsolicited emails. Be sure to enable two-factor authentication (2FA) for your Google account—even if attackers know your password, 2FA will prevent access in many cases.
Check your security settings regularly, use a long and unique password, and never enter your login credentials via links in emails. When in doubt, always go directly to the official Google website, log into your account, and check whether any action is actually required.
New features are often abused by criminals for phishing. It’s therefore important to remain vigilant when it comes to alleged security messages—even if they appear to come from a legitimate source.
Further reading: Never, ever delete your spam email. Here’s why