Last year a phishing email showed up from [email protected]. It wasn't a lookalike address. It was the real one, and it passed Google's own signature check.

The scammers got Google's system to send a real, signed message, then forwarded it on. Google first said that was working as intended. Later it said it was working on a fix.

So checking the sender isn't enough anymore.

Judge the message by what it asks you to do. If it wants you to sign in through a link, call a number in the email, or pay a new account, don't. Go to the site or app yourself.

Source: BleepingComputer, Apr 20, 2025 (news report).