Scammers are impersonating Google representatives and conducting a Google subpoena scam. This scam involves threatening users, creating a sense of urgency, and a mandatory security check.
In this scam, users will receive an email that seems to be sent from no-reply@google.com, pretending to inform users of a subpoena, a legal request that usually no user would avoid. To succeed in this scam, scammers use the email’s subject line as Security Alert or Notice of Subpoena so that it can look urgent or something that needs to be attended to on priority.
The scammers pretend in the email that Google has received a subpoena asking that it provide the user’s account information, like emails, documents, search history, and much more. The email asks the user to view their case materials by clicking on a link. Usually hosted on Google Sites, the attachment leads users to a fake website that mimics an official Google Assistant page.
Since scammers are skilled in their work, they can easily bypass basic security checks, like DomainKeys Identified Mail (DKIM). Following such steps helps convince users to make it a truly mandatory process
An email security standard called DomainKeys Identified Mail (DKIM) checks to see if a message is from the domain it purports to be from. It makes users’ mailboxes a little safer every day by using cryptographic signatures to defend against phishing and email spoofing attempts.
Scammers try to scam by intercepting and replaying authentic Google emails with official DKIM signatures; attackers circumvent spam filters and email authentication checks such as SPF, DKIM, and DMARC. This methodology helps scammers succeed in their plan most of the time.
Avoid falling for Google subpoena scams by using security measures like spam filters and 2FA, being wary of unexpected emails, and confirming allegations through a legitimate Google page. Users should review their account settings regularly and be alert to identify such scams.
