Robinhood phishing scam exploits Gmail dot trick

Users of Robinhood are being targeted by a phishing scam that exploits Gmail’s dot alias feature to send fake security alerts that appear legitimate.

Cybersecurity researcher Alex Eckelberry said attackers created fake accounts using email variations, allowing real emails from Robinhood’s system to be redirected into victims’ inboxes.

“The result is a real email from '[noreply@robinhood.com](mailto:noreply@robinhood.com)' that passes SPF, DKIM, and DMARC… but now contains injected fake warning text and a working phishing button,”

Eckelberry said.

The scam works by taking advantage of how Gmail ignores dots in email addresses, combined with weaknesses in Robinhood’s account creation flow.

Attackers embed malicious links into legitimate-looking emails by injecting code into optional fields during account setup, creating convincing phishing messages.

Robinhood said the issue was not a system breach and that user funds and personal data were not directly compromised, and following the announcement there was no market impact.

The incident comes as phishing and social engineering attacks continue to dominate crypto-related losses, with Hacken reporting $306 million in such attacks in early 2026.