Do this now — one minute
- Change your password at
myaccount.google.com/security. Not because we kept it — we didn't — but the habit is worth having. - Confirm 2-Step Verification is on while you're there.
Three things gave it away
-
The sender wasn't Bob.
Real Bob mail comes from
no-reply@hibob.com. This came fromnoreply@earthrated.com— and Front shows the address right beside the name, so it was on screen the whole time. The bold name is where your eye goes; the address next to it is the part that can't be faked. -
The link's real domain was buried at the end.
https://hibob.com.docs-my-requests-review-and-sign.earthratedpoopbags.com
hibob.comwas just a subdomain we made up. The owner is always the last two labels — so read URLs right to left. -
It wasn't
accounts.google.com. And here's the catch:earthratedpoopbags.comreally is ours. So "is this an Earth Rated domain?" was the wrong question — it would have reassured you. Google sign-in happens ataccounts.google.comand nowhere else, ours included.
The one rule
Never sign in through an email link. Open a new tab and go to the site yourself.
That single habit defeats all three tricks above, and you don't have to inspect anything to use it.