Google’s latest scam advisory flags QR phishing, fake logins and police impersonation together

Google’s latest public scam advisory is useful because it does more than say “be careful online.” It groups recent patterns that real people can actually meet: QR phishing, fake login flows that steal session cookies, payment prompts hidden inside calendar invites, fake crypto-profit bait and even police impersonation. The key consumer takeaway is that familiar-looking screens and trusted-looking routes are now part of the attack surface.

What stands out first in this advisory

Google opens with Adversary-in-the-Middle (AITM) and Quishing. The point is that a fake login page no longer only wants your password. If attackers can capture the session cookie after sign-in, they may get the “already verified” state too.

That is why the old habit of following a login link from an email or alert is less safe than it used to be. If a message says you need to sign in, it is safer to open the official site yourself instead of trusting the route the message suggests.

Why QR codes and calendar invites are harder to judge

This update also mentions fake renewal notices placed directly into calendar invitations and hidden “invisible pages” inside cloud documents. Those are effective because people tend to trust familiar product surfaces before they stop to inspect the real destination.

Google says it is strengthening defenses such as Device Bound Session Credentials (DBSC) against session theft. Even so, the simplest reader-side protection is still to avoid opening unexpected QR codes or invite links on your personal phone in the first place.

Most money-pressure scams still sound alike

The other examples in Google’s advisory follow the same emotional script: fake crypto income, urgent mobile payment prompts and police impersonation all try to make a person send money, install something or verify something right now.

So the quick rule remains practical: if money pressure and a login request show up together, stop first. Re-open the official app or your saved official bookmark, and never call the number printed inside the suspicious message itself.