Crypto users are facing a new phishing threat as scammers disguise malicious emails as legitimate Google security alerts, making fake account warnings look far more convincing than a typical scam message. The campaign is drawing concern because it seems to tap into Google account recovery processes and conceal harmful links through formatting tricks inside emails that can initially appear trustworthy.

What's happening?

According to Coinpaper, the phishing campaign targets crypto users with emails that mimic authentic Google security notifications, using phrases like "recovery contact request" or "review request" to create a sense of urgency.

What makes the scam particularly deceptive is that the messages can seem to arrive through genuine Google systems rather than from clearly suspicious addresses. Attackers are also reportedly using oversized blank areas or concealed formatting in the body of the email to move malicious links far below what users first see. As a result, the top of the email can look like a routine security alert, while the dangerous content remains easy to miss unless a user scrolls down.

The warning comes as crypto-related fraud continues to climb. Binance said that, in figures cited by Coinpaper, its systems stopped 22.9 million phishing and scam attempts in the first quarter of 2026 alone, helping protect almost $2 billion in user funds.

Why is this phishing campaign concerning?

For crypto users, a single successful phishing attack can be devastating. Fake login pages can capture passwords, session cookies, and two-factor authentication codes, according to Coinpaper. If attackers gain access to an exchange account or wallet, funds can potentially be moved within minutes — and many crypto transactions are irreversible.

The scam also underscores a broader challenge for the digital asset industry: security remains one of the biggest obstacles to wider trust and adoption. While crypto has attracted criticism for some of its downsides — including the high energy demands tied to certain operations — it has also been promoted as a driver of innovation, from new financial systems to, in some cases, support for clean energy development. Still, high-profile phishing schemes and account takeovers can erode confidence in the space regardless of its potential.

These attacks are also becoming more sophisticated. Rather than relying on poor spelling or obviously fake branding, attackers are increasingly using legitimate platforms and polished formatting to make scams harder to spot.

What's being done about crypto phishing scams?

Major companies and law enforcement agencies are stepping up their response. Earlier reports, as noted by Coinpaper, linked Coinbase, Microsoft, and Europol to operations targeting the Tycoon 2FA phishing network, which was allegedly responsible for sending millions of phishing emails each month.

The crypto industry is also working on technical safeguards. Ethereum developers, for example, have been advancing the ERC-7730 Clear Signing standard, which aims to help users better understand transaction approvals before authorizing potentially risky requests.

For everyday users, security experts, and Google recommend avoiding links in unexpected emails — even when the message appears legitimate. Instead, users can go directly to Google account settings, exchange apps, or wallet platforms through official websites or trusted apps to verify whether an alert is real. Enabling strong two-factor authentication, using unique passwords, and staying alert to unusual account notifications can also help reduce risk.

Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.