Mark Maunder, the CEO of WordPress security plugin Wordfence , says the attacker will send an email to your Gmail account. That email may come from someone you know who has had their account hacked using this technique.