Fake Google Play developer termination email: how to spot it

The email arrived in Gmail with the subject “Message about Android developer verification”, preceded by a reference number in square brackets. The sender appears as “Google@access-developer-poli…”, cut off by the inbox. It is addressed to “Developers at” the account name, which is blacked out here.

It says the developer account will be terminated for previous violations of the Developer Program Policies and the Developer Distribution Agreement, and because the account is associated with other terminated developer accounts. It warns against registering a new account. To “avoid termination”, it asks the recipient to:

1. log in to the Google Play Developer Console,
2. open Settings > Users & Permissions,
3. remove any “unauthorized or unrelated users” and keep only the account owner’s primary email address,
4. reply to the message with a screenshot of the updated user list.

Without a reply, it threatens “immediate action to terminate your developer account”. It is signed “Belle, Google Play Developer Support”.

• The sender address. “Google” stands before the @, where anyone can write any name. What counts is the domain after the @. Here it starts with “access-developer-poli…” instead of google.com, and the rest is cut off.
• A contradiction. The email first says the account “will be terminated”, then continues with “After your developer account was terminated…”. It cannot be both.
• A threat. If you do not reply, it announces “immediate action” to terminate the account.
• An unusual request. You are to remove users and send a screenshot of who has access to your developer account. That list tells a stranger which email addresses manage your apps, and removing people on someone else’s instruction can lock out those who legitimately work on them.
• The answer goes by reply. The steps happen in Play Console, but the proof is meant to go back by email to whoever sent this message.

The word “Google”, a reference number and a support signature prove nothing: all of them are easy to copy. Several of these signs together are a clear reason to stop and check.

The general rules behind these signs, with a second example, are in How to spot a phishing email.

We imported a screenshot of the email into ExplainThisDoc and had it analyzed for warning signs with Pro. The analysis checks the text for typical scam signs such as time pressure, threats, requests for login or payment details and a sender that does not match. It titled the result “Google Play developer account warning”, with the document type “Account Warning Email”.

At the top, a security notice says: “This document contains possible security risks.” Under “Suspicious account warning”, the analysis calls the email likely phishing or impersonation: the displayed sender address is incomplete, the message threatens immediate account termination, and it asks for a screenshot by reply. It adds that the excerpt cannot confirm who sent it.

Under “What it claims”, it notes that the email describes the account as both already terminated and facing termination. Under “What it requests”, it lists the steps in Settings > Users & Permissions and the screenshot by reply, and treats them as requests in the message, not as verified instructions from Google.

01

02

1. Do not reply to the email, and do not send a screenshot of your user list.
2. Do not remove users or change permissions because an email tells you to.
3. Open Play Console yourself, from your bookmark or by typing the address, not through a link or button in the message. Check your account and any notices or messages shown there.
4. If there is a real notice, ask about it through Google’s official support, using contact options you find yourself, not the email.
5. If you have already replied, clicked a link or entered your password, change the password, check your account’s security settings and review who has access.

The analysis gives the same advice under “Check it safely”.

Keeping a suspicious email can help if more messages follow or you want to report it. In ExplainThisDoc the screenshot stays in your archive together with its analysis, and a red shield marks documents the analysis considers suspicious. Add a note with what you checked, for example when you opened Play Console and what you found there.

Scanning and the archive are free. The analysis for warning signs comes with Pro: 1 credit per analysis. You get three trial credits once on your first installation. The free Light analysis does not assess these signs. The analysis reads the text you import and does not open links; as it says itself, an excerpt cannot confirm who sent a message. A warning is not a proof of fraud, and the absence of a warning does not prove a message is genuine.