bell Warning: JavaScript is turned off! Some features on this website will not work without it. We recommend turning it on.
Online Threat Alerts: Alerting you to scams, malware, fraud, hoaxes and other threats.

Google Docs Phishing Email Scam

Date: April 25, 2013 2:09 PM - Views: 124,703 - Comments: 82
Google Docs Phishing Email Scam

Google account users, beware of the phishing email messages below that were designed to steal your Google user name and password. If you receive any email message appearing as if it came from a friend or family member, asking you to view a document that was uploaded to Google Docs or Google Drive, please delete this message.

This is another malicious attempt by hackers and scammers to steal your Google account information so that they can rob you or sell your information to other scammers.

Here are copies of the "Google Docs or Google Drive Phishing Email" scams

Subject: VITAL NEWSLETTER

Hello,

I uploaded this vital newsletter using my google doc. For immediate access CLICK HERE

Sign in with your email.


Hello,
Please view the document i uploaded for you using Google docs, CLICK HERE and just sign in with your email to view the document its very important


Subject: RE Important Document
Hello,
Here is the document i told you about,i sent it in a more secured way, CLICK HERE. and log in with your email for immediate access and more information.


Hello, Kindly click the link to view the document I uploaded for you using Google cloud drive. Just Sign in with your email to view the document, it is very important. Thank you, -- Rev. Dr. Karen Serving Humanity Spiritually

If you click on the link in the email message, you will be taken to the web page greensolutionsgp .com/google/google /index.php.htm.

This is how the phishing Google Docs page looks

Google Docs Phishing Email

Google Docs Phishing Email

It appears that the website greensolutionsgp .com was hacked and the malicious page "google/google/index.php.htm" was put there by the hackers.

You will be asked to sign in with your Google email address and password. If you enter your Google credentials on this page, it will be stolen by the hackers who have set this page up.

If you have already entered your Google user name and password on this bogus web page or others, please change your Google password right now!!!

There are different versions of this Google phishing scam, so please be on the look out for e-mail messages asking you to view documents in Google Docs or Google Drive.

Remember to leave your comment and read the ones made by others below.

Alert others by sharing this article with them:
Click the following thumb up or down, if you like or dislike this alert:
Rating: Thumb up 1 likes Rating: Thumb down 0 dislikes   
Tell us what you know or ask a question regarding this article, by leaving a comment in the box below.
We will not send a response to your email address, so do not post your email address in your comment. All response will be posted in the comment section below.

Comments or Questions (82)

The comments on this page do not necessarily reflect the views of Online Threat Alerts. Online Threat Alerts reserves the right not to publish comments that may be deemed libelous, derogatory or indecent.

  • Anonymous: 3 weeks, 5 days ago

    Does it affect iPhones? I opened the email and entered my address but not the password. Them I closed the browser and deleted both messages - I got two of them. And emptied the trash ~


    • info: 3 weeks, 5 days ago

      This is a phishing scam designed to steal your username and password. So, it doesn't matter which device you are on. ~


  • Anonymous: 1 month, 1 week ago

    I received an email stating that my google mail was terminating. see address below:
    no-reply click on a link
    Obviously, I am not clicking on a link.

    I am sure that such is not valid and even with a hybrid goggle address I would be nervous.

    Please advise if this email address above is valid and has anything to do with goggle.

    J. Carroll ~


    • info: 1 month, 1 week ago

      The email is a scam. ~


  • Anonymous: 2 months, 2 weeks ago

    Received one today:
    Subject: Hello
    Message:

    You have a pending incoming docs shared with you via Google docs
    Click to open:? ? e?-?Statement ??
    ??
    Google Docs makes it easy to create, store and share online documents, spreadsheets and presentations.

    Link took me to: http://residentiesaa nzee.be/images/ googledocs/ googledrives/ ~


  • Anonymous: 4 months, 1 week ago

    Make sure you check your gmail settings under "Forwarding", to make sure that your emails are not being forwarded to a different account. ~


  • Anonymous: 4 months, 2 weeks ago

    I got stung by one too and the link was to
    http://viewwwinng.altervista .org/index.php ~


  • Anonymous: 4 months, 2 weeks ago

    Beware of this:
    ------
    Subject: Please review

    You have received a new document via Googledoc.

    Click Here to review your secure document.

    Link: www.fabbricanove .com/index.php ~


  • Anonymous: 4 months, 3 weeks ago

    They tried it with me as well, i just got this e-mail on my company mailadrfess, like they want to purchase products! I didn't fall for it... Watch out!
    ------

    Hello Mark,
    I appreciate your response, i'm trying to send you some of the documents through attachment, but it is multiple, so i had to save it online and shared. Click the following link to download the file(s):

    http://www.google.com/drive /globalinvestments/files2014 /purchase-order002#.pdf

    Please inform me if you can meet up with the needed supply quantity and forward your quotation or proforma invoice to me or you upload it through the same link above.

    Hoping for an anticipated business cooperation,
    Thank you.

    Robert Hao
    Sales - Department ~


  • Anonymous: 4 months, 4 weeks ago

    Does this just affect Gmail accounts? ~


    • info: 4 months, 4 weeks ago

      No, if you put any other email address username and password on the phishing or fake website, it will be stolen and used to hijack that account. ~


  • Anonymous: 5 months, 0 week ago

    Got one today -- 5/4 looks like this:

    On the subject line: An Important Document was sent to you from your Bank

    Viewer
    Use Google Docs to quickly view documents online without leaving your browser.

    -----------------------
    Hello!

    An Important Document was sent to you by your Financial Institution through Google Docs Viewer.
    To view this document, please follow our secure web server link below and sign in with your email address.


    To Get Started, :

    Click Here

    Sincerely,

    The Gmail Team
    Google Docs

    Copyright © 2014 Google Docs. All rights reserved. ~


  • Anonymous: 5 months, 2 weeks ago

    I gave out my google password. They emailed my Contacts. Now half my Contacts list on all devices are missing. When I click Restore Contacts to one week ago in My Google Account after first changing my password, the missing half return only and the other half of my Contacts disappear that I had previously. How do I regain my full contacts list on windows laptop and iphone and ipad? Thank you ~


  • dtaylor: 5 months, 2 weeks ago

    Someone set up a Google Apps account and somehow connected it to my gmail account a got access all of my contacts and past emails. Then they added an alphabetical letter to the middle of my business email address (which they must have gotten from my past emails) and sent out emails to all of my gmail contacts with this fake email address that has one extra letter in it. The fraudulent email contains a link to a supposedly google drive app and the email heading states "Follow-up Shared Doc!"

    Before doing this they sent a fraudulent email to my broker and asked them to wire money to two foreign bank accounts.

    Am I right to assume that they did not get access to my computer, only my gmail account? I have done a few scans and nothing turns up.

    Thank you.
    DT ~


    • info: 5 months, 2 weeks ago

      Change your passwords immediately. ~


  • Anonymous: 5 months, 3 weeks ago

    I was shocked to see a message sent by my email-id. How do they get access to ur email account? Are there any ways to stop them? ~


  • Anonymous: 5 months, 3 weeks ago

    I have been sent these emails,never opened them because I was suspicious,now my contact list is being sent this email from me. How is that happening? ~


    • info: 5 months, 3 weeks ago

      The emails probably are not being sent from your email account.

      Maybe the emails that the persons on your contact list are receiving, were sent from some other email account, but the sender spoofed his/her email address.

      Email spoofing allows someone to change the "From" address of an email message, to make it appears as if it came from someone else.

      Here is an example:
      I can send an email message to you, and change the "From" address to "president@whitehouse.gov". So, when you receive the email message it will appear as if it came from the Whitehouse, instead of me.

      But, if they are still sceptical, please change your email address password.

      ~


  • Anonymous: 6 months, 0 week ago


    The scam go to or points to: http://www.untouchedworlds .com/pay/Google_Doc/secure Login.htm

    Please kindly check the Document i sent you via Google Document.
    And get back to me.
    VIEW ORIGINAL DOCS HERE
    And log in with This email.
    It is very important.
    Regards.

    Ronald L Korf, CEO
    Korf Continental, Korf Auto Group | www.korfautogroup.com
    Ford Lincoln Chevrolet Buick GMC Chrysler Dodge Jeep Ram
    500 West 8th Avenue, Yuma, CO 80759
    (T 970-848-5361 | C 970-396-5275)
    rlk@korfauto.com ronkorf@outlook.com ~


  • Anonymous: 6 months, 1 week ago

    OK, so if I already clicked, etc., and already changed my email password, I should be ok, right? ~


    • info: 6 months, 1 week ago

      Yes, you should be ok. ~


  • Anonymous: 6 months, 2 weeks ago

    Here is another one of these scams:
    ---------

    "Just Uploaded Some Files For You Using Google Docs

    Kindly Click On Here To View The File I Upload For You.

    Best Regards."

    Link points to http://fullform.co .in/Hub/gdocs/index.htm ~


  • Anonymous: 6 months, 2 weeks ago

    I have received one of these emails and deleted it but i when I send it to my trash and then delete the trash it appears again. How do I remove it permanently. ~


  • Anonymous: 6 months, 3 weeks ago

    All my email contacts were deleted and the scam was sent to them. I have changed my password and secured my account but I get credit card bills, bank statements etc sent to my email account. Are they in danger? What should I be looking out for? ~


    • info: 6 months, 3 weeks ago

      Once you have changed your email address password, you should be ok. ~


  • Anonymous: 7 months, 2 weeks ago

    Noticed that my gmail security said: logged in from Dublin, CA with the following IP address: 108.200.178.199
    That was not legit! ~


  • Anonymous: 7 months, 2 weeks ago

    I have been receiving these and have contacted Google, and they advise me to click on the links and then click the "report abuse" link at the bottom of the page.

    That's right, Google support says to click on the links! I responded and say "do you really recommend that I click on links in a phishing email? If so, there is a problem with your system". They don't respond.

    Thanks Google ~


  • Anonymous: 7 months, 2 weeks ago

    Please note that the scammers/phishers will examine your gmail files and addressbook and forward the scam to all your contacts. Furthermore, they will examine your contacts and if they find a useful one, like the one to your broker or financial adviser, they will try to obtain money from your accounts, posing as you. ~


  • Anonymous: 7 months, 2 weeks ago

    I am usually pretty savvy to email scams, trojan horses, etc. but this one caught me off guard. After entering my email and password, I was sent to Google Template Gallery. I've not used this feature and there was nothing except the stock templates. At that point, I finally got suspicious and "Googled" the phrase in the incoming email. That brought me to this page and the awareness that I'd been "Phished". I immediately went back to my accounts and changed passwords.

    Thanks for being here and keeping watch. ~


  • Anonymous: 7 months, 3 weeks ago

    we are receiving messages such as : you have shared documets with (name).
    we are confused as we have not shared documents.. nor do we know who (name) is. ~


  • info: 7 months, 4 weeks ago

    From: Gmail Team
    Date: 12 February 2014 13:13:57 GMT
    Subject: Google Document

    You have a pending incoming docs shared with you via Google docs

    Click to open: eStatement.pdf

    Google Docs makes it easy to create, store and share online documents, spreadsheets and presentations.

    Google®
    ---------

    The link goes to phishing website: cafesevda .com/google/index.htm ~


  • Anonymous: 8 months, 0 week ago

    Today I received the same. Thanks for information about it.I am pasting below the spam message from one of my friend.
    I sent you a document via Google drive, follow the link Click Here and just sign in with your email to view it.
    Thanks ~


  • Anonymous: 8 months, 1 week ago

    Just got this email from someone I know, there were email addresses in the distribution list that could have come from their computers, including my email address. I sent a 'reply all' with a warning not to open it and a link to this blog. ~


  • Anonymous: 8 months, 1 week ago

    Hi received a similar email from a previous employer:

    ----------
    Hello,

    I've uploaded an attachments to a Google Drive in a secure way to view a document CLICK HERE to view, its very important.

    Thanks.
    --------

    Link points to hxxp://www.espezia .com.ar/bin/gdocs/index.htm

    I was suspicious so I forwarded the email directly to my previous employer to have them confirm the email was legit and seconds after I got an email from them saying it was alright to open it.

    Looks like the account is hacked and they can even respond to email!!! Beware!!! ~


  • Anonymous: 8 months, 1 week ago

    Phishing scams are everywhere. If you happen to click on a link from a suspicious e-mail, always check the URL in your address bar. An e-mail from google should send you to a URL that contains "google.com" That is their domain and everything pertinent to your privacy should go through that. Everything else should be completely disregarded. This is the same for any large, reputable company. Beware of this for banking too, which is a very popular place for phishing scams! ~


    • Anonymous: 6 months, 4 weeks ago

      Google.com proves nothing. It just means that the phisher got a google address too. ~


  • Anonymous: 8 months, 2 weeks ago

    Well, I couldn't find a place on Google to report this email. Google needs to make it easier for people to quickly report stuff and then send out alerts to users. My bank has an email address that starts with spoof.bankname_url@... to quickly forward this crap to their security dept. ~


  • Anonymous: 8 months, 2 weeks ago

    This is pretty amusing to watch; someone in my school has a compromised account and sent it to every person in the school. Since then, numerous accounts have been compromised as well, with more emails sent. I am just facepalming at how gullible my co-students are. As an avid internet user, I know all about phishing and related methods, so I'm wondering how people don't notice the obvious signs. ~


  • Anonymous: 8 months, 2 weeks ago

    We have 3 gmail accounts hacked by the google docs scam. I have reset passwords, but cannot reopen my gmail. All pertinent communications are lost! ~


  • Anonymous: 8 months, 2 weeks ago

    Received email from GOOGLESECURITYALERTS @gmailteam .on,I roost .com

    Stating my email acct and password were recently used on another computer, mobile device or other location. Then it has a line to click on to verify.
    Question. Is this legit, who used my acct, or should I immediately delete.

    Thanks ~


    • info: 7 months, 4 weeks ago

      The email message that you have received is a phishing scam. ~


    • info: 8 months, 2 weeks ago

      Can you please send the email message to us. Our contact information is located on the "Contact Us" page. ~


  • Anonymous: 9 months, 0 week ago

    I received this e-mail, but I did not open because I suspected it was a scam. But the hacker used my yahoo user name. What is really worry is that these people are sending the same message to all my contacts. ~


  • Anonymous: 9 months, 1 week ago

    Strangely I've received two of these emails and when I replied to ask if it was genuinely sent from the user I received the reply:
    "Yes log on to see the document.

    Thanks".

    Even with this reply I didn't risk opening them since the people sending the request were not close acquaintances. ~


  • Anonymous: 9 months, 1 week ago

    Just received:

    "Hi,

    Please view this Document I uploaded for you using Google Doc.
    Click Here and sign in your email to see the important document Secured Verified Page.

    Thanks."

    From: Jermal Alleyne ~


  • Anonymous: 9 months, 2 weeks ago

    I received a slightly modified version of the email today from a business acquaintance's Hotmail account. The "Click here" text linked to this Chinese company's website: hxxp://ez-agogo .com/documented

    Subject: Document

    "Please view the document i uploaded for you using Google docs.

    Click here just sign in with your email to view the document its very important.

    Thank you" ~


  • Anonymous: 10 months, 0 week ago

    Mine came from:

    adtechdirect .com/googleattachment shared doument/ ~


  • Anonymous: 10 months, 0 week ago

    Just got this one. Here is where it takes you to:
    hxxp://gmasti .net/ncdoc
    then redirects you to hxxp://www.himalayanrock .com/images/nrb.jpg ~


  • Anonymous: 10 months, 1 week ago

    New phishing email address www.para-fiestas .com/js/slideshow/ googledcmnt/index.html
    Pretending to be google drive. Worded exactly as described above ~


  • Anonymous: 10 months, 1 week ago

    I received an email today saying i have to upgrade my gmail account now for security reasons it asked me to reply with email address password d.o.b country or territory and alternate email and password. It said if i dont respond in 24 hours my account will be suspended if i dont do it within 2 week it would be deleted. they were doing it to find out which accounts were active or not ~


  • Anonymous: 10 months, 2 weeks ago

    Very helpful!!!!! ~


  • Anonymous: 10 months, 2 weeks ago

    Hi.. I received such a message and it looked so real.. It was not until I clicked on the steps and got nowhere that I thought it might not be real. Then I hit reply and found that it was her old address (which did not show up). I did change my passwords that I had put in.. Is there anything else I can do? ~


  • Anonymous: 10 months, 3 weeks ago

    I just fell for this. I entered my email and password. I will change the password now. Will that be enough though? ~


  • Anonymous: 11 months, 0 week ago

    Received such an email from helengatenby(at)gmail.com to my private email address. I do not know this person. ~


  • info: 11 months, 1 week ago

    The "Dear Gmail.com Email Owner" message below is another Gmail phishing scam. Click here to read about it. ~


  • Anonymous: 11 months, 1 week ago

    Is the following a scam or genuine?


    Dear Gmail.com Email Owner,

    We are upgrading our Email system to enable us reduce the occurrence of Spam. You are to click on the Link below to Upgrade your Email.

    hxxp://www.byfocal .com/forms/forms/form1.html

    Signed
    IT Service!
    System Administrator ® ~


  • info: 11 months, 1 week ago

    Opening the email will not affect you. The only way you will be affected, is if you enter your username and password on the phishing or fake website. ~


  • Anonymous: 11 months, 1 week ago

    i opened this email. it looked really genuine and it even said who it was from, someone I knew, but it didn't sound like their style of email. Because I opened this email, will it send a copy to all my contacts? ~


  • info: 11 months, 2 weeks ago

    Changing your password is the only thing than you can do. Ensure that you use a very strong password. A password that is not easily guessed. ~


  • Anonymous: 11 months, 2 weeks ago

    Ok so what do you do if you did click on the link and enter your info? I got it from a client and in haste I opened it. It's a little different than the one shown above but it's definitely a phishing thing. It sent an email to all my contacts. I changed my password but what else do I need to do now??? Help! ~


  • info: 11 months, 3 weeks ago

    Opening the email will not do anything to your computer. Entering your username and password on the fake website after clicking on the link in the email message is a problem. ~


  • Anonymous: 11 months, 3 weeks ago

    I opened the e-mail but did not click on the link. This should not be a problem right? ~


  • Anonymous: 11 months, 3 weeks ago

    Thank you for this. I received an email from someone I don't even know and it made me suspicious. It all looks very authentic but I still felt something wasn't right especially when it asked me to input my email and password so I did a quick search and sure enough this article came up and confirmed my suspicions. It's pretty scary because a few years ago I was more naiive and might have fallen for it. Thankfully back then these sorts of things weren't as prevalent as they are now but there are many other people who would fall victim to it including possibly the person who sent it to me because they are a real person. I google searched them and found their Facebook, website, a newspaper article and their linked in page. ~


  • info: Oct 8, 2013

    Yes, you should be safe if change your password. Please check to ensure that your alternate email addresses are correct. If the scammers change the alternate email to theirs, they will be able to reset your password. ~


  • Anonymous: Oct 8, 2013

    Please, i am so worry about this. I'm safe as long as I change my email password. I changed it inmmediatly ~


  • Anonymous: Oct 3, 2013

    I have a mac and I saw this come into my email so I did not open it up but I did send it to trash. Then my laptops curser started to jump around and it would fly between the one window i was on and the weather and time one Mac have. I had not control so I shut it down and did a full startup and reboot. Then I went into utilities to repair. I also deleted my trash my google trash and mac trash. I think I am good. BUT just after this happened my home phone rang and it was a recording telling me it was Allegacy Fed. Credit Union, and that I needed to call 866 872 3684 as soon as possible. So I got my Mac clean and started to do some digging. So it can happen to Mac and
    windows I am sure. I am worried because my old HP won't start up even when I go into safe mode, it acts like it wants to then reverts back to the Dos screen.
    But I think my Mac is good. ~


  • info: Oct 1, 2013

    You only need to change the password of the user names that you have entered. If you didnt enter the username and password on the phishing website for your other accounts, there is no need to change their passwords. ~


  • Anonymous: Sep 30, 2013

    Just to clarify - I'm safe as long as I change my email password. No need to change other passwords correct? ~


  • Anonymous: Sep 22, 2013

    The real risk with this scam is for people who, (like myself), are stupid enough to enter the username and password to their Google or Gmail accounts. There's a very, very serious risk for people who use services like "GOOGLE WALLET", which is an online payment service, just like PayPal that you use access and use using your Google account details.
    I am a user of Goggle Wallet, but I was lucky not to have signed in to their fake sign in page with that particular account information. All they got from me was access to all of my contacts, who they sent the hoax message to and no doubt they'll have collected a few new suckers from my list of contacts. I sent EVERYONE in my address book an email warning them to change their password IMMEDIATELY if they inadvertently gave out their information. ~


  • Anonymous: Sep 13, 2013

    New website doing the same thing. Here is the email I got...

    From: Google Team (googleteams @usa.com) Microsoft SmartScreen classified this message as junk.
    Sent: Fri 9/13/13 4:38 PM
    To: XXXXXXXXXX
    Microsoft SmartScreen marked this message as junk and we'll delete it after ten days.

    You have a secured document sent to you by me at Google Docs.

    To have access to the document please login with your e-mail address by following the link below.

    Read now >>> hxxp://www.itweakly .com/google/doc/drive/index.htm

    Each Document is Independently Owned and Operated by Sender of this message.
    Google Drive.
    ©2013 Google Incorp. All Rights Reserved. ~


  • info: Aug 29, 2013

    Although it may appear as if the email was sent from your account, it was not. The cybercriminals behind these scams use a technique called Email Spoofing. Click here to read about this technique. ~


  • Anonymous: Aug 29, 2013

    so if you were the one who's email account sent it, do you have to do anything? ~


  • Anonymous: Aug 26, 2013

    Please convey this info to mail.yahoo.com and hotmail.com as i have received mails in this both accounts. Saying:

    ---
    Receipant name,

    I have send you a document click here and get the documents.
    --- ~


  • Anonymous: Aug 26, 2013

    I have received two mails from www.monquathuvi .com/googledocs/index.htm ~


  • Anonymous: Jul 30, 2013

    I just received a very similar email directing me to this phishing site:
    hxxp://k-webshop.com/sale/gogdocs1/index.htm ~


  • Anonymous: Jul 30, 2013

    Anything needed beyond change of pasword ~


  • info: Jul 18, 2013

    Maybe cybercriminals were able to gain access to your account by tricking you into entering your account user name and password on a phishing or fake website.

    With access to your account, they may have accessed your contacts' names and email addresses.

    I recommend that you change your email password. ~


  • Anonymous: Jul 18, 2013

    I understand the email spoofing part of the scam, what I don't get is how they target contacts in your address book? If it's pure spoofing, where do they get my contacts? I have run virus scan, nothing found. ~


  • Anonymous: Jul 15, 2013

    Hi I have just received email today gmail will stop if I don't re register to get rid if dormant accounts
    Al*b@gmail.com I have not replied ~


  • Anonymous: Jul 12, 2013

    So, can I fix it with only changing my passwords?
    Thank you! ~


  • info: Jun 24, 2013

    Although the email appeared as if came from your wife's email account, it was not. Scammers use a technique called email spoofing, where they alter an email message to make it appear as if it came from someone else.


    I could use this technique to send an email to you from my email address and change the "From" address to make the email appear as if it came from the "president@whitehouse.gov".


    Currently, it is virtually impossible to stop these scammers from sending these emails to you.


    Click here to read more about email spoofing. ~


  • Anonymous: Jun 24, 2013

    Good day, I got the email but it was coming from my wife's email account. She said she sent no such email so i guess she got one of those viruses that use your email to spam all their contacts.

    I would like to fix this but not sure what to look for or even how to start.

    Is this a worm/virus, if so how do I get rid of it / stop her account from spamming all her contacts. ~


Send this article to someone via email:
Email address:
Like our Facebook page at: www.facebook.com/OnlineThreatAlerts
Follow us on Twitter at: www.twitter.com/onlinethreatale