As noted by Johnson, it even appears as a legitimate security alert. The email was sent from "no-reply@accounts.google.com," the usual address of Google, and is also signed by "accounts.google.com." ...

Johnson noted that the email was sent from no-reply@accounts.google.com and that it was actually signed by accounts.google.com. He also noted that Gmail didn’t show any warnings in the email.