Fake Google account / Gmail security alert phishing — impersonates Google security notices claiming Google account or Gmail has been locked, suspended, or flagged for unusual activity, driving to a credential-harvest page; Google is the #2 most impersonated brand in consumer credential phishing (APWG Q4 2024); compromised Google credentials unlock Gmail, Drive, Google Pay, and all OAuth-linked services

Phishing emails impersonating Google security alerts to claim the victim's Google account or Gmail has been locked, suspended, or flagged for unusual activity — directing to a credential-harvest page styled as Google's sign-in portal. Key facts: (1) APWG Q4 2024 Phishing Activity Trends Report: Google is the #2 most impersonated brand in consumer credential phishing; Google account credentials are extremely high-value because a single compromised account unlocks Gmail (which contains password reset links for every linked service), Google Drive, Google Photos, Google Pay, YouTube, and all OAuth-connected third-party applications; (2) Google accounts are the master key to modern digital identity — once an attacker has Google credentials, they typically gain access to 15–30+ additional accounts within hours through "forgot password" flows that route to Gmail; this cascade effect makes Google account phishing especially damaging relative to other credential-theft targets; (3) Google Workspace accounts (used by businesses) are a separate high-value target because compromise enables access to all internal documents, email history, and admin controls for the Google Workspace domain; (4) Legitimate Google security alerts arrive exclusively from accounts.google.com or no-reply@accounts.google.com, always include the specific device, location (city/country), and time of the suspicious sign-in, and direct users to g.co/allowaccess — they never threaten permanent account deactivation via a third-party link. Warning signs: sender not a google.com domain, no specific device/location details about the suspicious activity, threat of permanent account deletion, link to a non-Google domain, no reference to the user's account recovery options.