Scam Detective
Scam verdict · Educational pattern check
Scam Detective research desk · Updated September 2026
No — Google doesn't call

“Google” Calling About a Suspicious Login? Google Doesn't Call You — the Call Is the Attack (2026)

No — Google does not call users about account security, period. The “suspicious login” call — one documented version names a sign-in attempt from Frankfurt, Germany — arrives alongside something real: an actual Google account-recovery email or notification, which the scammer triggers themselves by starting Google's real recovery process against your account. The “agent” walks you through “securing” your account, and the verification code you read back is the exact code that completes their takeover. Rossen Reports exposed the script the weekend of August 30, 2026. Hang up — the recovery email paired with the call is the scam itself, not two separate events.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL freeRead the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — September 15, 2026 →

Why now · September 2026

Why you’re seeing this now

A phone call claiming to be Google support warns that there's been a “suspicious login attempt” on your Gmail — one documented version names a sign-in from Frankfurt, Germany — from a caller who sounds professional, possibly AI-generated, with a spoofed caller ID. What makes it convincing is that the call arrives alongside something real: an actual Google account-recovery email or notification, which the scammer triggers themselves by starting Google's real recovery process against your account. The “agent” then walks you through “securing” your account, and the verification code you read back to them is the exact code that completes their takeover of your account, not a fix for it. Rossen Reports exposed the script the weekend of August 30, 2026, and tech and consumer channels picked it up through the following days. Google does not call users about account security, period — so an unexpected recovery email followed by a “customer service” call is the scam itself, not two separate events.

The script · As it arrives — phone call, paired with a real recovery email

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

“There's been a suspicious sign-in attempt from Frankfurt, Germany.”

Followed by a real-looking Google account-recovery notification, and a request to read back the verification code “to secure your account.”

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

The checklist

Five red flags — any one is enough

An unsolicited call claiming to be Google support about a “suspicious login.”
It's paired with a real-looking Google account-recovery email or notification you didn't request.
You're asked to read back or enter a verification code to “secure” your account.
The caller ID looks legitimate — but Google does not call users about account security.
The sequence itself is the tell: an unexpected recovery attempt followed immediately by a “support” call.
What to do now

Your next three moves

1
Verify through a channel you open yourself: hang up and check your account by opening Gmail or your Google account's security page directly — never through a link, number, or instruction the caller provides.
2
Refuse the code read-back: no verification code ever needs to be spoken to a caller “to secure your account.” The code you read back is the exact code that completes their takeover, not a fix for it.
3
Report the call at reportfraud.ftc.gov and through Google's own account-help channel, then secure the account yourself — password, 2-step verification, signed-in sessions — and check any link or number from the call via the $2 instant check.
Instant URL Check · $2, one-time
Holding the actual message? Check the exact link, number, or sender.
Paste it into the instant check — free risk signal in 60 seconds, then the full report for $2: a 0–100 scam risk score, a plain-English verdict, the top 5 red flags found, and a 3-step what-to-do-now list. No subscription.
Run the $2 instant check
Follow-up questions

People also ask

The recovery email really came from Google — doesn't that make the call real?

No — that's the trick. The scammer triggers Google's real recovery process against your account, so the email or notification is genuine; the caller who arrives alongside it is not. One event, not two.

Does Google ever call users about account security?

No — Google does not call users about account security, period. An unsolicited “Google support” call is the attack, whatever the caller ID shows.

The caller sounded professional, with a legitimate caller ID — how?

The documented script uses a professional-sounding, possibly AI-generated voice and a spoofed caller ID. Rossen Reports exposed the script the weekend of August 30, 2026.

I already read back a code — what now?

Treat the account as compromised: from the official app or a site you type yourself, change your password, review signed-in sessions and devices, and turn on 2-step verification — then watch for recovery attempts you didn't start.

Related verdicts

People asking this also asked

Someone keeps calling about an urgent problem with my Google business listing — is it Google?No — not GoogleAn email from IT says my password is expiring and shows a QR code to scan — is it legit?No — phishingIs that Wells Fargo / Bank of America fraud call or text real?Verify it yourselfThe “Free Claude Max Upgrade” Never Asks for Your Card — It Wants Your Whole Google Account (2026)No — it's a phishing page
← Browse all 218 answers
$2, one time
No subscription, no account, nothing to cancel.
Verdict in minutes
Full report on screen and as a PDF, usually within minutes.
Honest verdicts
If it looks safe, we say so — a clear “safe” is worth $2 too.
Got a link of your own?

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Check a URL free
Spot the scam before it spots you.
For businesses · $19, one-time
Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19
Free brand scan first — you only pay for the full audit.