Email — Scammers have been putting a fake bill, such as a $399 McAfee charge, and a phone number into a real Google security email. Google sends the message because the scammers typed that text into an app-password name. Do not call the number in the email.
Email — Fake calendar invites can steal a live Google login even after you approve a real two-step prompt. Do not click links inside an unexpected invite. Open Calendar yourself instead.