When I receive things like this, I make sure to open Gmail from within Firefox with all extensions meant to defend me (like NoScript, unlock origin, privacy badger, https everywhere) and then I hover over the gigantic button “check my activity” and see if it leads to a accounts.google.com link.
Either way, I then copy the link address without clicking on it, and open it in a private window to see what happens. If it’s a scam, the page it opens has a legit looking, but wrong google address (aka, it cannot really end with google.com). Then I just stop having fun and don’t continue nor type anything
What does it look like in your case?
Who told you to tell the truth?
You had no right!