Fake McAfee bill inside a real Google security email
Scammers have been putting a fake bill, such as a $399 McAfee charge, and a phone number into a real Google security email. Google sends the message because the scammers typed that text into an app-password name. Do not call the number in the email.
How it works
You may get a genuine Google security message, which can make the whole email feel trustworthy. Inside the message is text that looks like a bill, including a dollar amount and a 'helpline' to call. Scammers type that wording into an app-password name so Google will include it in the alert it sends you. If you call, they will try to take payment, sell you useless 'support,' or get access to your accounts. The charge itself may not be real, so check your own card or bank statement instead of calling.
Red flags
- A security email from a real company also includes a bill and a phone number to call.
- The supposed charge, such as a McAfee fee, is not something you recognized on your own statement.
- The message pushes you to call right away to dispute or cancel a charge.
- You did not recently create an app password or expect that kind of Google alert.
What to do
- Do not call any phone number printed inside the email.
- Check your own credit-card or bank statement, or open your Google account settings yourself, to see if a real charge exists.
- If a strange app password appears in your Google account, remove it and review account security.
- Report the scam at reportfraud.ftc.gov and consider a report at ic3.gov if you called or paid.
Where to report it
- reportfraud.ftc.gov — the FTC's report form.
- ic3.gov — the FBI's Internet Crime Complaint Center.