Please be on the lookout for this one, and do not fall for it. If you do, your Google account will be taken over and the attacker gains access to everything: photos, emails, documents, everything you have ever put in there.
This is one of the best-crafted phishing emails I have come across. It was sent to one of my client's personal Gmail accounts at 10:18pm.
Most phishing is easy to spot. This is not. Four things make it dangerous:
That last point is worth sitting with. The message arrives from Google's real notification address, not a lookalike domain with a swapped letter. Attackers have methods to pull this off, which means the usual advice about checking the sender address does not save you here.
The next step is just as hard to catch. The link looks like a real Google sign-in URL, because the first part of it genuinely is. But if you follow where it actually ends up, it forwards to sites.google.com.
Google Sites is a legitimate product. Anyone can build a page on it, and that page sits on a real Google domain with a valid certificate. So an attacker builds a convincing fake sign-in page there, and every surface-level check a careful person would make still comes back clean.
If you click through and authenticate or approve the request, the attacker has your Google account. The takeover starts immediately.
Once they are in, they work fast. They remove your recovery methods, reset your password, and lock you out of your own account. From there your email becomes the key to everything else you own online, because almost every other service you use will happily send a password reset to it. Banking, shopping, social, work. Then come the extortion attempts and the scams run in your name against the people in your contacts.
Losing a Gmail account is not losing an email account. It is losing the recovery route to your entire digital life.
Move quickly, and do it from a device you trust.
Then check the accounts that use that address for password resets, starting with anything financial.
The old advice was to look for bad spelling, odd sender addresses and suspicious links. This email has none of those. It is well written, it comes from Google, and it links to Google.
So the rule has to change. Treat any unexpected message about your account security as untrustworthy regardless of how legitimate it looks, and go check the account yourself by typing the address in. That habit costs you thirty seconds and it is the one thing that would have defeated this email completely.
If you are not sure about something that has arrived in your inbox, forward it to us before you click. We would much rather look at ten harmless emails than clean up after one that was not.