What are the red flags?

A Google security alert whose app name reads like an invoice or charge, such as a $399 McAfee subscription; A phone number to call about a charge inside a security alert; Your Google account shows no matching activity when you check it; The alert names an account email address that isn't yours.

What should I do if I clicked, paid, or replied?

Don't call the phone number, reply, or provide personal information or money; Check your recent security activity by going directly to myaccount.google.com/notifications; Check for real charges on your own bank or card statement; Use Gmail's Report phishing option, and report losses to the FBI at ic3.gov.

← Back to search

Tech support / phishingEmailPhone

Real Google "app password created" alert with a fake $399 McAfee invoice

Q: What does the Real Google "app password created" alert with a fake $399 McAfee invoice scam look like?

Yes, it's a phishing scam: the University of Michigan says the fake invoice text was planted in a real Google alert to get you to call the scammer's phone number. An email that is a genuine Google security alert saying an app password was created, but where the app name has been replaced with a scammer's message: a fake $399 McAfee invoice and a support phone number. According to the University of Michigan's IT security team, the scammer typed that text as the app password label on their own Google account, so Google generated an authentic, signed alert, which was then forwarded to victims and passed email security checks. The real Google links lead only to the recipient's own clean account dashboard, an intentional dead end that leaves calling the scammer's number as the only apparent next step.

Last updated Nov 2, 2026

Also known as: Google app password created email scam, Google security alert McAfee $399 invoice, Fake invoice inside real Google alert, Google alert callback scam phone number

The Scam

An email that is a genuine Google security alert saying an app password was created, but where the app name has been replaced with a scammer's message: a fake $399 McAfee invoice and a support phone number. According to the University of Michigan's IT security team, the scammer typed that text as the app password label on their own Google account, so Google generated an authentic, signed alert, which was then forwarded to victims and passed email security checks. The real Google links lead only to the recipient's own clean account dashboard, an intentional dead end that leaves calling the scammer's number as the only apparent next step.

The Targets

Email users, including Gmail and university and work accounts.

Red flags

A Google security alert whose app name reads like an invoice or charge, such as a $399 McAfee subscription
A phone number to call about a charge inside a security alert
Your Google account shows no matching activity when you check it
The alert names an account email address that isn't yours

Your Move

Don't call the phone number, reply, or provide personal information or money
Check your recent security activity by going directly to myaccount.google.com/notifications
Check for real charges on your own bank or card statement
Use Gmail's Report phishing option, and report losses to the FBI at ic3.gov

More steps for any scam link: I clicked a scam link. What now?

Still circulating?

First flagged by the University of Michigan on Oct. 6, 2026; Augment Intent Security Group reported on Nov. 2, 2026 that copies have kept circulating.

Primary source: University of Michigan Safe Computing: phishing alert · 2026-10-06

Related sources

Similar scams

Fake Apple Support calls, texts, and pop-ups Tech support / brand impersonation
Tech support / phantom hacker scams Tech support
Fake subscription renewal and invoice emails Shopping / phishing
Fake product recall / refund texts (Amazon & retailers) Shopping / phishing

Educational summary only. Verify details on the source page. Report fraud at ReportFraud.ftc.gov or ic3.gov.