Member guide · Read a preview, full guide with Personal

Real vs fake Apple, Google and Gmail security alerts

Got an email, text, pop-up or call saying your Apple Account or Google Account has been compromised? How to tell a real security alert from a fake, check it safely inside your account, and what to do if you clicked.

Check yourself or someone else

See what’s online about a photo, phone number or email. Check your own to see what others can find, or check someone you’re talking to.

See what’s online about an email address: yours, or one that’s contacting you.

We check this address against known data leaks. We don’t save what you enter. Up to 10 checks a day.

Got a suspicious email? Check where it really came from →

Got a suspicious email? See where it really came from

Paste the email’s headers to see the real sending server, country and sender checks.

✉️ Check email headers

Security alerts are designed to get your attention, which is exactly why scammers copy them. A fake “Your Apple Account has been locked” email or a “Someone has your Google password” text looks a lot like the real thing. The good news is that you never need to decide from the message alone: Apple and Google both let you check your account’s security status directly. This guide covers the common fakes, the differences that matter, and what to do if you already clicked.

The common fakes

  • Emails saying your account is locked, suspended, or signed in from a new country, with a button to “verify”.
  • Texts with a short link about an Apple Pay or iCloud problem.
  • Pop-ups in your browser saying your phone or computer is infected, with a number to call. Apple lists these alongside fake emails and calls impersonating Apple Support (Apple).
  • Phone calls from “Apple Support” or “Google security”, sometimes after a burst of genuine-looking sign-in code texts that the caller triggered.
  • Calendar invitations and subscriptions with scam links, which Apple also warns about (Apple).

Unlock the full guide with ImposterWatch Personal, US$9/mo

Members read every guide in full, plus get breach and dark web alerts for up to three email addresses, an AI-powered romance scam check every month, and account recovery help.

Get Personal, US$9/mo Already a member? Log in

Not ready? Get scam alerts

Signing up doesn’t unlock this guide. See our privacy policy.

Real vs fake: the differences that matter

  • Real alerts never need your password or codes over the phone. Apple says it never asks for your Apple Account password or verification codes to provide support (Apple).
  • Real alerts can be confirmed in your account. On Apple devices, look in Settings under your name for devices signed in to your account. For Google, open myaccount.google.com yourself and look at recent security activity.
  • Fake alerts push you to act through the message. The link, attachment or phone number is the whole point.
  • Check the full sender address. A friendly display name can hide an unrelated address. Gmail’s help pages explain how to report phishing from the message menu (Google).
  • Payment is never part of a security fix. Gift cards, crypto or “refund” transfers are always a scam. Apple specifically warns never to pay other people with Apple Gift Cards (Apple).

If you clicked, called or shared something

  1. Change your password from Settings or the real website, and confirm two-factor authentication is on. Apple gives this advice if you may have entered details on a scam site (Apple).
  2. For Google, follow its steps to secure a compromised account, including reviewing devices and recovery details (Google).
  3. If you gave someone remote access, disconnect from the internet and see our tech support scam guide.
  4. If you shared card or bank details, call your bank.
  5. Check your email address with the tab above, and read what to do after clicking a phishing link.

Dating-app emails and codes you didn’t request

The same rules apply to Tinder, Bumble and Hinge messages:

  • A code you didn’t ask for usually means someone typed your number or email into a login or sign-up screen, by mistake or on purpose. Don’t share it with anyone. If you have an account, sign in directly and change your password; if you don’t, you can ignore it.
  • “Is this Tinder email real?” Don’t click links in it. Open the app or type the website address yourself and check your account. Real account notices will be there too.
  • Messages asking you to “verify” on another site are a common dating scam. Dating apps verify you inside the app.

The FTC’s advice is that anyone who asks for your verification code is a scammer (FTC).

Where to report it

  • Fake Apple emails: forward to reportphishing@apple.com (Apple).
  • Gmail: use “Report phishing” in the message menu (Google).

ImposterWatch Personal (US$9/month, cancel anytime) includes breach alerts for up to three email addresses and account recovery help if something does go wrong.

Questions

I got a Tinder or Bumble code I didn’t request. What does it mean?

Someone entered your number or email at a login or sign-up screen. Don’t share the code. If you have an account, sign in directly and change your password; if you don’t, ignore it.

How do I know if an email from Tinder is real?

Don’t use links in the email. Open the app or type the site address yourself and look for the same notice in your account. Check the sender with the email check on this page.

Does Apple ever call you about a security problem?

Apple says not to answer suspicious calls claiming to be from Apple and to contact Apple through its official support channels instead. It also says it never asks for your Apple Account password or verification codes to provide support.

Are Google’s “critical security alert” emails real?

Google does send genuine security alerts. The safe way to check any of them is to ignore the email’s buttons and open myaccount.google.com yourself. Real alerts also show up in your account’s recent security activity.

A pop-up says my iPhone has a virus and to call a number. Is it real?

No. Apple lists misleading pop-ups saying your device has a security problem as a common scam. Close the browser tab and don’t call the number.

I typed my password into a fake page. What now?

Change the password straight away from the real site or Settings, make sure two-factor authentication is on, sign out unknown devices and check recovery email and phone.

How can I tell where an email really came from?

Look at the full sender address, not the display name, and check the headers. Our email header check reads them for you.

Not sure where that alert came from?

Paste the email headers into our email header check to see who really sent it, or check a phone number that called you. ImposterWatch Personal (US$9/month, cancel anytime) adds AI-powered checks, breach alerts for up to three email addresses and account recovery help.

Check an email’s headersGet Personal for US$9/month, cancel anytime

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.