⚠️If you use Gmail, read this. Scammers are hiding their messages inside REAL Google security alerts, so the emails pass the checks that normally catch fakes. They type the scam text into the name of a Google app password, which makes Google send out a genuine, signed alert containing it. Then they forward that alert to you. One version flagged by the University of Michigan carried a fake $399 McAfee invoice and a phone number to call. The real Google buttons in the email just open your own account page, where nothing looks wrong because nothing was breached. That dead end is deliberate, leaving the scammer's phone number as the only "fix" left. If an alert like this lands in your inbox, treat any phone number, reply request or button inside it as a red flag. Even a genuine Google sender address is no longer proof that an alert is safe.