Reading Time: 6 min

Worried about the security alert you received on your account from Google? It could be an authentic Google security alert guiding you that there is some security issue going on with your account. But be wary it can also be a scam.

As reported by Statista, around 45.6 percent of all emails worldwide were marked as spam in 2023.

This helpful security feature from Google sends an alert every time someone tries to access your account. Although a notification doesn’t always mean that your account has been compromised, it is a signal for you to review the account’s password and security.

This article explains what Google’s critical security alert is and how to make sure it is authentic. It also explains how to protect your account from unwanted access with just a few steps.

What is a Google Critical Security Alert?

Google Critical Security Alert is an automatically generated notification sent from Google alerting that your  Google account is under a security threat. Google’s Critical Security Alert acts as a warning that you need to protect your information.

The alert generally contains information about the email security threat and provides the steps that need to be taken. It sometimes shows the information about the device that has been trying to log into your account.

Common Reasons for Receiving a Security Alert

It is usually an alert that someone is trying to crack your password. It could be due to unusual login attempts or outdated applications. Here are some of the major reasons behind receiving Google Critical Security Alert.

• Google detected unusual Login attempts on your account.
• The account was logged in from an unfamiliar location.
• Could be a sign that your account is outdated or the apps are not secured.

Can it Be a Scam? Identifying a Legitimate Google Security Alert

There has been a debate on the legitimacy of the Google Security Alert. Here are some of the ways for you to identify if the alert is authentic or a scam.

Verify the Sender’s Email Address

Majority of the emails coming from fake addresses contain random letters or numbers. In contrast, authentic Google critical security alerts are usually sent with a valid email address, [email protected]. If the associated email address is different, it may be a scam.

Check for Unauthentic Links or Buttons

Most of the convincing fake emails contain links or any related buttons. If clicked on, these links help attackers phish users by leading them to a spoofed website or landing page. Therefore, avoid any malicious links or emails attachments. 

Run a Security Check on the Account

Don’t open or answer any email coming from unknown sources. If you received Google security alert mail from an unknown or suspicious source, it’s best to avoid it. Perform a security check on your Google account by visiting your Google Account > Home > Privacy & personalization.

Here is how you can run a security check of your Google account.

1. Open your Google account settings and tap “Review security tips”.

2. You will see a page with all the devices on which your account is logged in. If you witness any unfamiliar device, remove your account from that device.

3. On the same page, scroll down a bit and click on “Review recent Activity”. On tapping it, you will get the list of recent activities in your account. If you see any unfamiliar activity, select the “See unfamiliar activity”option as shown below.

4. You can change password and try to make a stronger one to secure your account.

5. You can also visit Google Help Centre to get more security tips.

How to Remove Google Security Alert

You need to take the proper steps after receiving a Google Critical Security Alert to protect your Account. Here are some suggestions to make your account secure.

Changing Your Password

Keep changing your passwords whether you are saving them on Google or not. It is preferable to keep different passwords for all the accounts and use a password manager for organizing. This makes it difficult for the hackers to access the accounts. A well-crafted combination of alphabets, numbers, symbols and special characters is recommended.

Reviewing Recent Activity

Review the recent activity on your device. This step helps recognize new sign-ins, password changes, and any security-related events.

• For this, open your browser and go to Google Account. In the security option, scroll and manage “Your Devices”.

• Check recent activities and devices where you are logged in. 
• Remove any unfamiliar device or change password.

Preventing Unauthorized Domain Usage

Most email scams are carried out from spoofed email domains. These impersonation scams are harder to detect and stop. But it’s possible. Businesses falling victim to spoofing or impersonation can implement DMARC, SPF, and DKIM for their domains. These are email authentication protocols that help prevent a variety of email scams by protecting a domain’s legitimacy. 

Enabling Two-Factor Authentication

It is helpful to turn on Two-factor authentication on all the Google accounts. It adds an extra layer of security to your account other than password. With this, it gets even more difficult for hackers to gain unauthorized access to your google accounts, even if they get hold of your password.

Keeping Software and Apps up to Date

Keep your accounts and devices updated. It is essential because servers keep updating their security feature to make it difficult for scammers to hack into accounts. 

Tips for Enhancing Email Security

In the current circumstances, scammers are getting more and more sophisticated with their ways. Businesses also need to take efficient steps to enhance their email’s security. Here are some tips for you to better secure your messages:

Enable MTA-STS

MTA Strict Transport Security (MTA-STS) requires authentication checks and encryption for all the emails sent to your domain. By enabling it, you can reduce man-in-the-middle attacks and passive eavesdropping on your email communications. 

Enable TLS Reporting

Enabling Transport Layer Security (TLS) Reporting help in receiving comprehensive reports on TLS encryption failures and deliverability issues. These reports provide details about MTA-STS security problems, and undelivered emails. You can use this data to identify and resolve your security issues faster.

Recognizing and Avoiding Suspicious Links and Attachments

If you receive any email from a scammer, there is a high chance that it has a link or file attached to the mail. The links attached to these fake emails are usually malicious in nature. Clicking on such links can cause significant data breaches. 

Regularly Reviewing Security Settings and Permissions

Most users don’t read the pop-up message before allowing permissions. It can make the account vulnerable., Therefore, read the pop-up text thoroughly before choosing any option. Keep reviewing the security updates now and then.

Wrapping It Up

Protecting online accounts from scammers is a must. This is why, Google had introduced its critical security alert feature to warn victims of potential scam. Furthermore, Google has also updated its email protection policies for senders by mandating authentication protocols like SPF, DKIM, and DMARC.

If after all these steps, you suspect that the alert sent by email is fake, you can report the email as spam or even raise the concern with Google’s support team.

*** This is a Security Bloggers Network syndicated blog from PowerDMARC authored by Ahona Rudra. Read the original post at: https://powerdmarc.com/google-critical-security-alert/