Johnson noted that the email was sent from no-reply@accounts.google.com and that it was actually signed by accounts.google.com. He also noted that Gmail didn’t show any warnings in the email.

As noted by Johnson, it even appears as a legitimate security alert. The email was sent from "no-reply@accounts.google.com," the usual address of Google, and is also signed by "accounts.google.com." ...

“It is time for you to leave the United States,” the mass email from the U.S. Department of Homeland Security advises, including this warning: “Do not attempt to remain in the United States ...