Google and Microsoft Won't Call You Out of the Blue: One Simple Rule Worth Sharing

Here is a rule worth passing to your whole team this summer: Google and Microsoft will never phone you out of the blue about your account, and they will never open a support case you did not start yourself. If a real conversation is ever needed, it happens through a ticket you opened, on a schedule you agreed to. Anything else is someone looking for a way in.

That rule matters because the scams have become genuinely convincing. In one widely reported technique, attackers found a way to send phishing emails that actually originate from Google's own systems. They register a Google app and tuck their scam message into the app's name, which triggers a real, properly signed security alert from no-reply@accounts.google.com. They then forward that signed message along to their targets. Because every technical trust signal checks out, the email lands looking authentic, sometimes even sitting alongside genuine Google alerts. The fake "support portal" is then built on sites.google.com, a free Google page builder, so even the link looks right.

So the usual advice, check the sender and check the link, is no longer enough on its own. The reliable tells are behavioural. Google does not host account security steps on sites.google.com; the real ones live on accounts.google.com. And neither Google nor Microsoft will cold-call you, ask for your password or a one-time code, or chase you about a case you never opened.

When something feels off, slow down and come to us directly. We would always rather answer a quick "is this real?" question than help clean up afterward.