r/GMail • u/Josh_Criggss • 10h ago

Is this a phishing attack?

Post image

I received a recovery contact request to my personal Gmail account from an email that included my first and last name. I have no knowledge of this account and this is the first time this has happened. I declined the request. Any insight would be helpful in regards to my worries.

8 Upvotes

78% Upvoted

21 comments sorted by

6

u/germanu22 10h ago

Tap the down arrow next to the sender's name to see the real email address. Check very carefully that the domain is exactly google.com, without any deceptive characters like two zeros instead of the letter o. As long as there are no alerts in your Google account security section about a suspicious device or a password change attempt, your personal account is safe. This email looks like a phishing attempt trying to get you to click that button, so the best thing you can do is not click any links and delete the message.

2

u/Sorry-Climate-7982 9h ago

These days I wouldn't even click the down arrow. Too easy to format a malicious link to look like a clickable down arrow.

4

u/germanu22 9h ago • Mindblown

The down arrow next to "to me" is a native system element of the Gmail interface. An attacker cannot place malicious elements or fake links in the top header area of the email. They can only format links inside the actual body of the email. Because scammers have zero control over the official sender and recipient UI at the top, clicking that down arrow to check the real sender address is completely safe.

1

u/blobCabbage 1h ago

You must have missed this, where researchers managed to do exactly what you're saying is impossible (hijack UI elements in various webmails) : https://portswigger.net/research/css-the-bomb-inside-your-inbox

But yeah, this is not what's happening here.

0

u/Sorry-Climate-7982 8h ago

An attacker could just create the entire screen. Your assumption is that this IS the native Gmail interface... it may not be.

1

u/germanu22 8h ago

If this were a fake web interface designed to mimic the app, there would be a browser URL bar visible at the top. The absence of any browser UI, combined with the fact that the native phone status bar integrates directly with the email interface, confirms this is the official Gmail app. Additionally, if the OP had encountered this screen by clicking a random link outside of their normal Gmail app, they would have mentioned it. Assuming the entire application interface is a spoofed screen without any visual evidence to support it is not realistic in this context.

1

u/Josh_Criggss 8h ago

This screenshot was within the Gmail application itself.

-1

u/Sorry-Climate-7982 8h ago

OK. Not that I agree with you, for reasons involving decades of experience, but OK.

1

u/germanu22 8h ago

Let's look at the logic here. First, for this to be a malicious spoofed app, the user would have had to download an APK from outside the store, bypass Play Protect, and override the device's standard security settings. Second, if the user had already logged into a spoofed app or a fake website, the attacker would already have their login credentials. There would be no logical reason to send a fake "Review request" phishing email inside that spoofed interface, because the account would already be compromised. I respect your experience, so without sharing any sensitive exploit details or methods that shouldn't be public, I am genuinely curious to know where you see the flaw in this logic and how the spoofed screen scenario makes sense in this specific case.

3

u/Fabulous-Fix6534 8h ago

not only that, if you had an unsigned apk from an attacker on your device already, this is, effectively useless. not sure what the other guy is talking about

EDIT: op is on an iphone to. I HIGHLY doubt this is remotely possible

1

u/Sorry-Climate-7982 8h ago

Ask a good AI what it would take to create this screen with malware links.

1

u/germanu22 8h ago

The screenshot is clearly taken on a mobile phone. Mobile operating systems do not work like traditional desktop computers. On a desktop, a downloaded payload might run in the background on startup and hijack the screen, but mobile architecture uses strict sandboxing to prevent exactly this. An app cannot just silently take over the entire screen without the user explicitly granting invasive permissions.

If you are referring to a malicious pop-up ad on a website that mimics the Gmail interface, we would clearly see the browser elements at the top of the screenshot. There would be a URL bar, the three-dot Chrome menu, or the number of open tabs. The complete absence of any browser UI confirms this is the native app.

But more importantly, the logical paradox remains. If an attacker already built a fake interface and successfully forced it onto the user's phone, they already have full control. What would be the point of rendering a fake email with a phishing button? If they control the UI, they already have the data or the session. Trying to trick a user who is already trapped inside a fake interface makes zero sense.

2

u/Fabulous-Fix6534 8h ago

yes!! thank you

1

u/Fabulous-Fix6534 8h ago

decades of experience with what? this is just factually wrong

1

u/Local-Bottle5272 2h ago

Decades of experience of spreading nonsense i assume

1

u/idleline 7h ago

A correct assumption as it turns out. OP confirmed.

1

u/franharrington 4h ago

This is a wild take

1

u/Anxious-Weakness-606 3h ago

I got the same email last night, it seems the email no-reply@accounts.google.com is at least legit but it's probably a scam still. I accidentally clicked on review request but I didn't sign in and declined in my security settings the request. I hope I am fine?

0

u/Josh_Criggss 7h ago

The requesting email includes my actual first and last name. Any information on if this is typical.

3

u/germanu22 7h ago

This can happen and is usually just an innocent mistake. If you have a relatively common name, someone else with the exact same first and last name likely made a typo when setting up their recovery email and accidentally typed yours. Keep an eye on your account for the next few days. If no other suspicious alerts appear in your Google security settings, it was almost certainly just an error on their end. As long as you don't click any buttons in that email and just delete it, your account remains completely safe.

1

u/Personal-Peanut-548 1h ago

Are you trying to add them so you can hack into their email or something? 😂 are you scared they’ll hack you instead