1
Fear of losing access
Messages threaten to lock you out of the account you need to do your job today. That makes you act before you check.
How it showed up here"Your password expires today" and "your account will be suspended".
Google Account Sign-In Scams
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers steal your Google Workspace login — fake sign-in pages, fake security alerts and unexpected 2-Step prompts — and how to protect your account.
What this is about
Your Charitybuzz Google account is the key to your email, Drive, calendar, Slack sign-in and the files we share with bidders and nonprofit partners. If an attacker gets in, they can read everything, send messages as you, and use your name to push scams on colleagues and partners.
Account-takeover attacks are not clever hacking. They are a fake page or a fake alert that gets you to hand over the password or approve the prompt yourself. They work because they look routine: "your password expires today", "new sign-in from a new device", "storage is full".
191,561
phishing and spoofing complaints filed with the FBI in 2025
$215.8M
reported lost to phishing and spoofing in 2025
~3×
increase in reported losses from 2024 ($70.0M)
Take the message apart
A fake Google "password expires" message. Click every detail that should make you stop. There are 6.
0 of 6 red flags found Click anything in this message that looks suspicious.
Your password for [email protected] expires today
Hi Jordan,
The password for your Charitybuzz Google Workspace account expires today. If you do not act, your account will be suspended and you will lose access to Gmail and Drive.
Click below to keep your current password.
Keep Current Password
You may be asked to approve a sign-in on your phone or enter the 6-digit code to confirm it's you.
© 2026 Google LLC
Link goes to:—
Click anything in this message that looks suspicious.
Spot the signs
Quick check: for each address or situation, decide whether it is a red flag or looks fine. Real Google sign-in pages live on accounts.google.com.
0 of 6 answered
https://accounts.google.com/signinThe real owner of the address is google.com, and the sign-in page lives on the "accounts" part of it.
https://accounts.google.com.session-verify.net/signinRead from the first "/" backwards: the real owner is session-verify.net. "accounts.google.com" is only a name the attacker put in front.
https://sign-in-google.com/workspaceA hyphenated look-alike. Google never asks you to sign in on a site that merely contains the word "google".
A 2-Step Verification prompt appears on your phone, but you have not tried to sign inSomebody has your password and is trying to get in. Deny the prompt and tell John. Never approve a prompt you did not start.
A caller says they are "Google support" and asks you to read out the code just texted to youThat code lets them into your account. Google will never ask you to read out a verification code.
You type accounts.google.com yourself and it asks you to sign inYou went there on your own, which is exactly the safe way to sign in.
Why this works on smart people
2
Looks routine
Real sign-in alerts and expiry reminders exist, so a fake one does not feel strange. The page is a copy of the real one.
How it showed up hereA familiar Google-style sign-in box with your name or company filled in.
3
Urgency
A short deadline makes verifying feel like a risk in itself.
How it showed up here"Act within 24 hours".
4
Prompt fatigue
Attackers who already have your password send many approval prompts, hoping you will tap "Yes" just to make them stop.
How it showed up hereA string of 2-Step prompts late at night or while you are busy.
How this lands at Charitybuzz
Account-takeover attempts that aimed at a company like ours look like these:
Everyone
The "password expires" notice
A message says your Charitybuzz password or Google account is about to expire or be suspended and asks you to sign in through a link to keep it active.
The tell
Google does not email you to "keep your password active". The link goes to a page that is not accounts.google.com.The right move
Do not click. Go to myaccount.google.com yourself and check Security → Recent security activity. Report the message.Executives & executive assistants
Unwanted approval prompts
Your phone shows a sign-in approval prompt you did not start, or several in a row. Soon after, someone calls or texts "from IT" to say it is a mistake and asks you to approve it.
The tell
You did not start it, so someone else has your password. A real IT person will not ask you to approve a prompt.The right move
Tap Deny, change your password, and tell John right away.IT & admins
Fake admin alerts
A message claims to be from Google Workspace about storage, billing or a suspended user and asks an admin to sign in and "resolve" it.
The tell
Admin alerts that matter are visible in the Admin console, which you open yourself.The right move
Open admin.google.com by typing it, check there, and report the email.Red flags to watch for
A sign-in link in a message about your account
Real alerts can be checked by visiting the site yourself. You should never need the link.
The page address is not accounts.google.com
Look at the very start of the address before the first "/". Hyphens and extra words mean it is a different site.
A threat to lock or suspend you
Used to push you to act before you think.
A deadline in hours
Real account notices give you time and a way to check independently.
A 2-Step prompt you did not start
Someone already has your password. Deny it.
Someone asks for a code
Verification codes are for you alone. No one legitimate asks for them.
A sign-in page that opens after a QR code or a shared "file"
Being asked to sign in again "to view" something is a common trick.
A "support" call or text you did not start
Google and Charitybuzz IT do not call to ask you to approve or read out anything.
A real Google account notice
- Can be confirmed by visiting myaccount.google.com yourself
- Never asks for your password or a verification code
- Does not demand action within hours
- Comes from a google.com address and links to google.com
- Leaves your next step in your own hands
A fake Google account notice
- Pushes you to click its own link
- Opens a page not on accounts.google.com
- Threatens to lock or delete your account
- Asks you to approve, read a code, or sign in again
- Arrives when you were not expecting anything
What to do instead
Do not use the link
Treat every sign-in link in an unexpected message as untrusted, however real it looks.
Go to Google yourself
Type myaccount.google.com in a new tab. Check Security → Recent security activity and Your devices.
Only approve what you started
If a 2-Step prompt appears and you did not just sign in, tap Deny and tell John.
Never read out a code
No one needs your verification codes, not Google, not IT, not a leader.
Prefer a security key or passkey
If you have one, use it. They work only on the real site, so a fake page cannot capture them.
Report it
Use Gmail's Report phishing, and let John know.
If you clicked — or entered something
Entered your password on a page? Change it now and sign out other sessions
Go to myaccount.google.com → Security, change your password, then open Your devices and sign out any you do not recognize.
Check what was changed
In Gmail settings, look for forwarding addresses or filters you did not create, and tell John what you find.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Real Google sign-in pages are on accounts.google.com. Check the part before the first "/".
- Never use a sign-in link from a message about your account. Go to myaccount.google.com yourself.
- Only approve a 2-Step prompt if you just tried to sign in. Otherwise, Deny and tell John.
- No one legitimate will ever ask you to read out a verification code.
- If you entered anything, change your password and report it straight away.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Real Google sign-in pages are on accounts.google.com. Check the part before the first "/".
- Never use a sign-in link from a message about your account. Go to myaccount.google.com yourself.
- Only approve a 2-Step prompt if you just tried to sign in. Otherwise, Deny and tell John.
- No one legitimate will ever ask you to read out a verification code.
- If you entered anything, change your password and report it straight away.