Fake Gmail security alerts are tricking users into inadvertently handing over control of their accounts to scammers. Here's what to look for.