Some fake websites work 45% of the time, according to our research. Hijackers then send phishing emails from the victims account to everyone in his or her address book. People in the contact list of hijacked accounts are 36 times more likely to be hijacked themselves. Gmail blocks the vast majority of spam, but be wary of messages asking for login information or other personal data. When in doubt, visit websites directly (not through a link in an email) to review or update account information.”]
Source: https://security.googleblog.com/2014/11/behind-enemy-lines-in-our-war-against.html