I received a convincing phishing attack on my personal email and gave up my Google password. Here's how it happened, and how to be more careful about it.