Scammers are exploiting Google Account recovery emails to trick victims into handing over access to their accounts, according to a new warning from Proton.
The scheme, which Proton says occurred in August, starts before any phone call. Proton says the scammer first sets up a throwaway Gmail account with a random address, then uses Google's own recovery flow to ask that the victim's address be attached to it, which triggers a genuine confirmation email carrying a security code. The call follows, from someone posing as Google security, who claims a suspicious access attempt was blocked. Proton says the caller spoke with an American accent and the call came from a number in California.
The victim then receives a genuine security alert, but it is actually a copy sent to the scammer's address. The alert's subject line addresses the scammer's inbox, and its headline is designed to scare, complete with a 'Check activity' button. The first email contains a security code that expires, creating urgency, and Proton says the conversation can steer the target away from the 'Remove email' option that would stop the request. In the case Proton describes, the scammer pulled the recovery request as soon as the employee hung up.
Both phishing emails come from Google's real servers, so conventional anti-phishing checks pass. The scam relies on corroborating elements to seem legitimate. Proton notes that exposed information from data breaches can personalize such vishing attacks.
Proton's advice centers on slowing the exchange down: hang up and confirm the situation through Google directly, read any alert closely enough to notice when it is merely a copy routed to a different inbox, and refuse to read verification codes aloud to a caller. Proton also points to the 'Remove email' option for anyone who cannot identify the account requesting their address.
Proton, which offers Proton Mail as an alternative to Gmail with end-to-end and zero-access encryption, says it will never call about account security. The company recommends two-factor authentication and notes that its paid plans include Proton Sentinel, while Proton Mail offers PhishGuard and link confirmation prompts. Proton also highlights separate data recovery protections, but acknowledges that no email service provides perfect protection.
