Scammed out of $130K via fake Google call, spoofed Google email and auth sync

https://bewildered.substack.com/p/i-was-scammed-out-of-130000-and-google

by davidscoville • 10 months ago

427 647 10 months ago

bewildered.substack.com

latchkey• 10 months ago

Zak just posted this eye opening behind the scenes look at what these scammers are doing...

https://x.com/0xzak/status/1967592307714379934

ncr100• 10 months ago

Wow - that is really interesting, to hear the hacker's voice, the absence of guilt, the thinking of "it's a game to steal".

A Horrific threat.

clgeoio• 10 months ago

Is there a service that can “de-twitter” links like this?

wmf6• 10 months ago

https://xcancel.com/0xzak/status/1967592307714379934

junto• 10 months ago

xcancel.com

ycombinatrix3• 10 months ago

https://xcancel.com/0xzak/status/1967592307714379934

vkou2• 10 months ago

As soon as I read the headline, I knew that the problem was...

In just 40 minutes, the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.

One of the many, many benefits of irreversible transactions.

I made mistakes, yes

His first mistake was keeping six figures worth of 'cash' in a wallet that anyone with less than 40 minutes of access to can swipe.

fortran772• 10 months ago

Also if you have crypto you should never mention anywhere that you do. No forums, social media, etc.

RandomBacon4• 10 months ago

They still attack tech professionals living in California. Saying you have crypto will probably move you to the top of the list, but they'll still get to you eventually.

My brother (a tech professional in California) does not have any crypto or social media, and attackers still stole his phone number, which they used to steal his email account, which they then tried to get into a non-existent Coinbase account. He was only out of the time it took to get his phone number back (a couple of hours later).

like_any_other2• 10 months ago

The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

Can somebody explain what exactly this means, and how it works?

throw_m239339• 10 months ago

It's my understanding that emails have headers, just like http responses, and the app might have displayed that fake header instead of verifying the provenance of the email and displaying where it actually came from. So it is a UI/UX issue.

alaithea• 10 months ago

Why email clients have started hiding/not providing access to headers is beyond me. It seems like an anti-pattern. There have been many times recently where I've wanted to check the headers because an email was suspicious, only to find I couldn't.

goda90• 10 months ago

No clue how it works functionally these days. But it reminds me of tricks we pulled back in high school programming class. Our school was using Novell NetWare, and some students were given email addresses for various purposes. We discovered you could edit the From field, so it would display any text as your name and then your email address after it to the recipient on Novell's email client. If you added enough text, including whitespace, it would push the actual email address off screen(I don't remember if you could scroll to it or not).

We trolled each other in class with it a bit. But at one point some student not in our class sent out a mass email, which was against the rules. I replied with a From line as "Administrator" and a bunch of whitespace, telling the girl that she broke the rule and would be suspended for it. Our teacher made me apologize, and I was lucky that I didn't get into more trouble beyond that.

matsemann2• 10 months ago

Dmarc/spf https://en.m.wikipedia.org/wiki/DMARC

Basically, the from field on an email can be anything you want. It's like sending physical mail and using a fake letterhead with someone else's info, just type what you want. No verification.

That's sometimes a good feature. Like, a third party provider can send newsletters on behalf of company A. But can also be bad, when used for phishing.

However, the email doesn't just appear in your mailbox. It comes to your email provider by another server connecting to it and sending the email. Spf allows the owner of A.com to specify which IPs/servers are actually acting on their behalf. So if I get an email from something@A.com, I can lookup and verify that the sending server is one to trust. If not, the email client should reject or warn the user somehow.

tryauuum• 10 months ago

DMARC does check the from field in the mail, so I don't know how could this happen

opesorry• 10 months ago

Assuming I follow what you want to know, the wikipedia page on email spoofing should provide the info you desire. https://en.m.wikipedia.org/wiki/Email_spoofing

I'm pretty surprised gmail didn't flag this at least. When I did it for a class in Uni, it always let me know that the FROM header didn't match the sender since that's a clear attack vector

like_any_other2• 10 months ago

His phrasing is very confusing - claiming the "from" field was spoofed, but that if he could see the "full header", he could have spotted the spoofing.

I would also assume something as prominent as the Gmail website/app for iOS, and the google.com domain, would have all possible email security features correctly configured.

So.. is this not the case? Or is it, but due to bad UI, despite all this security, any schmoe can send email appearing to come from google.com, and I have to pore over unspecified details in the "full header" to spot a fake?

atallahw• 10 months ago

What did the account did the email actually come from? Was it legit from legal and he just submitted the request or was it a real spoofing

fkskammerz4• 10 months ago

It was not legit from legal, I had the same attack on me two weeks ago. They were pretending to be from Google General Counsel responding to an estate request to my Google account being handed to another party who was supposedly the inheritor.

What clued me in was that he said he couldnt share the estate documents with me until I gave him my popup 2FA code.

edm0nd6• 10 months ago

It was legit from Google email and servers.

You cannot spoof an email from @google that will inbox

layman514• 10 months ago

Were there any further login attempts that they tried to do to access your Google Account? It almost seems like the attack being described in the article is very sophisticated that the attackers aren't just contacting random people but might have certain people in their radar.

fkyoureadthedoc2• 10 months ago

oof that sucks. Luckily I'll never answer the phone

traceroute667• 10 months ago

Luckily I'll never answer the phone

One of the best features of Apple iOS 26 is the new call-screening feature[1].

[1] https://support.apple.com/en-gb/guide/iphone/iphe4b3f7823/io...

nsriv• 10 months ago

Pixel Call Screen has been a godsend for me since its debut, akin to using uBlock Origin for browsing.

edm0nd6• 10 months ago

Apple once again just implementing ideas from Android lol

This will be great tho to help cut down on iOS users and scams hopefully

layman514• 10 months ago

Would this actually work if it's more of a targeted attack? It seems like not, because they could just kind of lie to your call-screener.

rwmj• 10 months ago

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

fastest963• 10 months ago

Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).

youngtaff• 10 months ago

From the article he uses gmail I think

traceroute667• 10 months ago

Wouldn't the Apple account reject it because it fails DKIM/etc?

Yeah, I would be curious to see the actual email headers of what was received.

As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.

Avamander6• 10 months ago

How would recipients know to expect an S/MIME signature though. It's not like it's enforced by MTAs like DMARC is.

valleyer• 10 months ago

this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer

A few do, but most do not, and certainly Apple's automated-system e-mails do not.

rolph• 10 months ago

How Email Spoofing Exploits SPF and DMARC: A Cybersecurity Deep Dive.

https://undercodetesting.com/how-email-spoofing-exploits-spf...

neuronflux2• 10 months ago

They probably sent it from gmail which would pass the SPF check (google.com and gmail.com have the same SPF). They wouldn't have it signed to pass DKIM, but google doesn't use strict alignment checking so to pass DMARC either SPF or DKIM are acceptable.

    ~ dig _dmarc.google.com txt +short
  "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"

Avamander6• 10 months ago

Can't practically require both SPF and DKIM with DMARC anyways. Doing so would also be dumb as it would break forwarding (even when DKIM would otherwise remain intact).

Deprecating SPF would do everyone a favour though. Especially for reasons like these.

teraflop• 10 months ago

So any message from Gmail is treated as legitimate for google.com, and yet Gmail can't do its own checks on outgoing mail to ensure that unauthorized people don't put legal@google.com in the From: header? Seriously?

BCM43• 10 months ago

I'm pretty confident gmail's servers don't let you send with headers matching @google.com email addresses you don't control though.

LeonM2• 10 months ago

What you're saying makes little sense.

Yes, SPF (the original design) is horribly broken and trivially bypassed. The most prominent design flaw is that the inbound SMTP service uses the SMTP (rfc5321) MailFrom address for SPF validation, which is not the same sender address shown to the recipient, they can only see the the message (rfc5321) 'From' header address. SPF originally didn't require the domains in the MailFrom and From addresses to match, so an attacker would simply use a domain they control in the MailFrom address, and the 'spoofed' domain in the From header.

That was in 10 years ago though. DMARC fixed this by adding the alignment requirement, meaning that the domains in the MailFrom and From address must match. By default the alignment policy is 'relaxed', meaning that the MailFrom and From domains can differ in subdomain, as long as they share the same organizational domain. Setting the SPF alignment to strict (aspf=s) like you mention in your post requires the domains to match exactly, with no subdomain differences allowed.

So, it doesn't matter that Google doesn't use strict SPF alignment in the DMARC policy, the fact that they have DMARC already adds the requirement to SPF validation that the domains must match.

Yes, google.com and gmail.com use the same IP ranges in the respective SPF policies, but Gmail will never allow you to send email addresses from a domain that you do not own. This is why domain validation is required when you set up Gmail with a custom domain.

The only scenario where your explanation would hold up, is if the attacker was able to gain control of the DNS of a subdomain of the google.com domain, and successfully validated it as a custom domain in Gmail, then send emails from that subdomain in rfc5321.MailFrom address and the google.com domain itself as the rfc5322.From domain.

fkskammerz4• 10 months ago

I use gmail and i was attacked almost identically and the email came thru to my gmail with a @google origin account

davsti4• 10 months ago

More details would be great, like the headers.

davidscoville10• 10 months ago

I’ve heard scammers use Google tools like Google forms or Google cloud to send out fraudulent emails that appear like they come from Google.

thrill3• 10 months ago

The latest attempted scams I’m getting on my gmail account are fake postmaster bounces “from” google.com.

bradly• 10 months ago

Probably not the same attack vector, but I've gotten phising emails from a real googlemail.com addresses by the scammer abusing backscatter spam and the reply-to address.

Flimm3• 10 months ago

I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.

noname120• 10 months ago

Can you download the email as EML and paste the content here?

beambot• 10 months ago

There have been cases recently of exploits that successfully spoof valid DKIM credentials too:

https://easydmarc.com/blog/google-spoofed-via-dkim-replay-at...

QuadmasterXLII2• 10 months ago

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

bdangubic8• 10 months ago

the banks don’t give two shits about it :)

fn-mote• 10 months ago

The difference is that you have leverage to force the banks to care.

There isn't any federal regulation at all covering your Bitcoin.

adrr4• 10 months ago

Banks do care because they are on the hook. If someone commits identity theft and steals money from the bank via your account, its on them.

insane_dreamer2• 10 months ago

but crypto exchanges/wallets give even fewer shits :)

calmbell2• 10 months ago

And transferring money from a bank or brokerage account takes time. Enough time that anyone paying attention should be able to report the transfer as fraudulent before it completes and have the account frozen.

dist-epoch• 10 months ago

It depends. In UK a transfer is instant. In most of EU it happens the same day, many times in hours.

QuadmasterXLII2• 10 months ago

What I specifically mean by "care literally at all" : banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions. This creates sane, linear incentives: banks care 1000x more about a $100,000 fraud than a $100 fraud; they care 1000x more about a scam affecting 100 people than a scam affecting one person, etc.

Unrelated, but for added spice, here's a thread from ten months where everyone agrees you're a fool unless you secure your coinbase account with google authenticator

https://www.reddit.com/r/CoinBase/comments/1h65zuh/account_h...

3D304974202• 10 months ago

This is one of the main reasons I don't like crypto. If you get hacked, even if you did everything right, then you're out of luck. The funds are (generally) unrecoverable.

With my bank, I've been able to recover several thousand after a thief was able to bypass the 2FA app used to verify large transfers. (I still don't know how they were able to bypass the verification, and after investigating our bank never told us. Not sure that makes me feel all warm and fuzzy, but at least I was made whole with minimal fuss.)

thrill3• 10 months ago

In my actual real world experience of digging my elderly mother out of $25,000+ of scam debt, banks do not care at all unless they can be shown to be at fault, and then they weigh the loss expense vs the likely legal expense.

ycombinatrix3• 10 months ago

yubikey is better

petcat• 10 months ago

banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions

In USA, banks are actually required by law to reimburse fraudulent account activity if reported within 60 days. However, this does not cover cases where the account holder themselves made the transfers even if they were tricked into doing so.

But if someone gets your login and liquidates your bank account, in USA a least, the bank is 100% responsible for that fraud.

Credit card companies are 100% responsible for fraud regardless. Even if they try to market it as a perk "You're never responsible for unauthorized transactions". Yeah, no shit. It's the law.

nostrademons• 10 months ago

It's not linear at all. We had our identity stolen through an insurance scam (somebody used our bank account and somebody else's name to open a policy with Progressive, which apparently does not validate ACH debits). This resulted in premiums of ~$300, $300, ~$500, $1002.96, ~$900, ~$900, and ~$3000 as the attacker presumably racked up huge fraudulent claims on the insurance company. The first 3 bills were reversed by Wells Fargo because their fraud policy covers fraudulent charges under $1000. The 5th and 6th were reimbursed because they were reported within 60 days of being made (and were under the limit anyway). The 7th didn't go through because we had detected the fraud and closed the account by then. But the 4th was just over the $1000 limit that they would reimburse, and so they were like "Sorry, nope, you're on your own for that one." We even filed a police report and waved that at them, and they said "We don't care. Company policy." So the very counterintuitive and non-linear result was that they paid for the $300, $500, $900, $900, and $3000 charges, and stuck us with the $1000 one, just because it was $2.96 over their limit. (Part of me really regrets declining to prosecute, but I had a ton of other stuff going on at the time and the last thing I wanted to do was get involved in a court case.)

Tharre• 10 months ago

The flip side of that of course being that they increasingly force you to do your banking on a locked down smartphone for the same reason.

Doesn't seem like there's a lot of middle ground between being responsible for your mistakes and being treated like you can't be trusted to make your own decisions.

barbazoo2• 10 months ago

Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly.

I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.

The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.

Ugh, google

arethuza3• 10 months ago

I usually don't answer calls from numbers I don't recognise - but a couple of days back it was a scammer claiming to be from Amazon - said I had ordered an iPhone for £600 and was it a real order.

I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was...

I must have stayed on the call for 20 minutes, eventually they ended up swearing at me - all the time I could hear other people in the same room trying the same lines on different people. I have no idea why I stayed on for so long....

zamadatix3• 10 months ago

Would (the actual) Amazon even agree to provide this kind of information over the phone to someone?

unyttigfjelltol• 10 months ago

Even when you know it’s fake, the whole thing is very disconcerting. I received a scam call ostensibly from a local utility and filed an identity theft report with local police naming the utility as “victim”. The caller even told me where they (probably really) were. Police do nothing, scams continue until something breaks.

galaxy_gas2• 10 months ago

I get this kind of call about 5-15 times a day

I do not answer calls

golan• 10 months ago

As of late, I have one rule: Any unknown number I'm not expecting I let it go to voicemail, where I have a message along the lines of: leave your message and your number, and if it's important I'll call you back. The only time I pick up is when I am expecting, say, a delivery, or a doctor's call, etc, and in those cases I'm only expecting to hear about a delivery or a doctor's call, etc. Hoping that can filter and help on this front.

paleotrope• 10 months ago

I have a 1-2 second rule. I pick up I say hello, if someone doesn't respond in 1-2 seconds, I hang up.

They have the scammers working off phone queues, it takes a little bit of time to get the call to the scammer, who has to start off with a script, so there's a delay.

Remember, the scammer, also likely not a native english speaker, also probably bored out of their mind, has to spin up, they have to read the name, understand how to say it and then say it out loud. Their is a mental startup time that a normal conversation doesn't have.

If someone calls you and isn't ready to immediately respond to "hello" it's a scammer.

zamadatix3• 10 months ago

I try to avoid picking up and saying anything because it seems like an advertisement "yes, this number is not only active but a real person who answers random calls - try calling back (possibly from a different number) later".

aj7• 10 months ago

I use a variation of this. I answer but do not speak. A legitimate caller will speak immediately.

barbazoo2• 10 months ago

In those 2 seconds, do you count the inevitable preamble of "Hellooooo... Hello? ... Heeeello? Yes now I can hear you." or is that just me?

tejohnso• 10 months ago

I don't even pick up calls from unknown numbers. I use call screen. Most people hang up as soon as they hear it, or they don't say anything at all. Once somebody did start speaking sensibly and a personal matter and I picked up and continued the call normally. Probably my favourite feature since upgrading to a reasonably modern phone.

https://support.google.com/phoneapp/answer/9118387?hl=en

throwaway77833• 10 months ago

I didn't quite understand this part. Attacked has access to Google accounts because Google had cloud-synced my codes? What does that mean?

remus• 10 months ago

They gained access to the Google account by stealing the verification code over the phone, but then they had easy access to other accounts (e.g. coinbase) because they had access to 2FA codes because Google authenticator was backed up to the users Google account.

riffraff2• 10 months ago

The other way around.

The attacker had access to the Google account which includes passwords from Chrome and also the 2fa codes stored in Google Authenticator, because those were synced to Google without the author noticing it.

So with passwords and 2fa the attacker could login to Coinbase too.

crawftv• 10 months ago

The biggest red flag in all these stories is getting a call from a customer support person trying to help you. When it seems like it’s impossible to get ahold of them in a real emergency.

fkskammerz4• 10 months ago

It doesnt seem to be a red-flag. The caller was calling as an Attorney from Google General Counsel responding to an estate request. They followed up with a spoofed @google.com email with their name corroborating the call.

jfim• 10 months ago

I've actually gotten legitimate calls from the bank, although the correct way to handle those is to say that you won't give any information to them but you'll call them back.

speckx• 10 months ago

I get legitimate calls from my health insurance company. When they call, they are not allowed to say the company they call from, it's a HIPAA thing. Once I say the name of the health insurance company, they will confirm it. It's weird, but it's the way it is now.

atm3ga2• 10 months ago

I've set my phone to not answer unknown callers (those not in my address list) and more importantly, I've done this for my parents as well and further instruct them as often as possible to not believe anything they get in email. With all of this, my mom still will reach out at least once or twice a year in a panic about some scam email she thinks is real.

atlanta90210• 10 months ago

If you have an iPhone, the latest iOS 26 will answer unknown numbers not in your address book for you and ask what they want and then alert you to see if you want to take the call.

general1465• 10 months ago

Well easy to say, but if you are working in the real world, then unknown callers may be important - i.e. FedEx trying to push your package through the customs and if they can not contact you, your package goes either back or is destroyed.

AJ007• 10 months ago

If you have to have use a phone, at minimum disable notifications and never answer it. First it removes all of the urgency. Second, the caller has to provide some way for you to contact them, which gives you a second point of contact to validate.

Never, ever, use a cloud password manager, that's just dumb. Combining these things together in some sort of master account -- be it Google, Apple, Microsoft -- is also terrible. It's like leaving all of your savings accounts, checking, and investments at a single bank.

All of this stuff is going to get way worse because of AI. You'll be talking to real people you know personally who are 100% not AI but were tricked in to asking you to do something by other AI enabled scammers. However aggressive I've suggested people be in the past probably isn't going to be enough for 5 years from now.

These things have always been possible, and have been done, but now they can be done at scale, with advanced testing to figure out what works on who, whereas before it was targeting the guy who kept posting pictures of expensive watches on his public Instagram.

pavel_lishin2• 10 months ago

If you have to have use a phone, at minimum disable notifications and never answer it.

Great advice for someone who doesn't have children or family members with health conditions.

drillsteps52• 10 months ago

Never, ever, use a cloud password manager, that's just dumb. Combining these things together in some sort of master account -- be it Google, Apple, Microsoft -- is also terrible. It's like leaving all of your savings accounts, checking, and investments at a single bank.

Do people actually downvote this? Seriously???

pc86• 10 months ago

I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.

The answer is almost certainly greater than 0.

vehementi8• 10 months ago

It's honestly irresponsible to pick up phone calls at this point. Phishers are really good, and every human has some weakness, so you can't guarantee you wouldn't fall for something -- perhaps one day a new vulnerability comes out and your old guidance is no longer perfect. Answering the phone at all is just putting yourself at risk

prawn3• 10 months ago

“never answering my phone when someone calls unless I'm expecting a call”

Friend’s mother got scammed. She’d contacted tech support and they said they’d call back. Then a scammer just happened to call her within that next hour…

everybodyknows3• 10 months ago

Call center worker with a sideline business?

mihaaly2• 10 months ago

In my experience organizations providing services to me for money nowadays ususally just send mail instructing me calling a central number where I can be in the 15th place of the call queue. In case they call they do whenever they please, which is the most inopportune occasion in most cases (in the loo, in transit, in a conversation, basically busy with life!). In best case leaving a message mumbling quickly in a sound quality sounding like sitting in a bucket in ungoverned Afghanistan, with the suspected sense of calling them back on the central number (incomprehensible).

Getting a procative call for my benefit would make me very suspicious about the authenticity of that call!

thebytefairy2• 10 months ago

Ugh, google

In my experience most authenticators cloud sync automatically, at least on iOS. For most people, this is a benefit. Otherwise, lose your phone and you're stuck, I doubt most people secure recovery codes properly either.

fkskammerz4• 10 months ago

Same exact scam happened to me three weeks ago and I almost fell for it. The guy was very sharp and sounded very authentic.

Ever since then I've been getting hundreds or thousands of Google notifications I've had to decline. Anyone know how people are able to send out hundreds of 2FA gmail notification popups without Google blocking this?

thenickdude• 10 months ago

This means you should still have the email from legal@, right? In that case you can solve the mystery of how they managed to pass DMARC by sharing the headers from it.

layman514• 10 months ago

Can someone please explain to me what it means for authenticator codes to be “cloud-synced”? Is that solely dependent on whether you’re using the Google Authenticator app while signed in to your Google Account? Is it possible to not have them “cloud-synced” if you are signed in?

jazzyjackson2• 10 months ago

Google Authenticator app defaults to backing up the TOTP secrets so if you log in on a new device you have them there. Pretty poor default for security, and you can disable it, but not the first time I've heard of this biting someone.

rib3ye2• 10 months ago

The risk of not syncing — when you lose/reset your phone, so does your OTP app. If you don't have backup codes saved, you're cooked.

layman514• 10 months ago

You mean to say that if it were enabled on my Google account, then the TOTP numbers for my other accounts are visible via authenticating into Google Account on some other unknown device? Sounds like it could be convenient if you lose your phone, but still risky if an attacker can sign into your Google Account.

tetromino_• 10 months ago

https://security.googleblog.com/2023/04/google-authenticator...

Google Authenticator can be local-only or synced to the cloud.

In local-only mode, the authenticator is bound to a specific device. You can manually sync it to additional devices, but if you lose access to all those devices, it's game over, you will get locked out of whatever accounts you secured with authenticator as the second factor.

In cloud-synced mode, it's synced to your google account, so if you lose your phone, you can restore authenticator state. But if your google account gets taken over, it's game over, the attacker has your authentication codes.

ShrimpHawk• 10 months ago

One wrong point in this. Google Authenticator does not cloud sync by default. You specifically have to accept the cloud sync option that you are prompted with.

nzeid• 10 months ago

Google enabled Authenticator cloud sync by default.

Never understood this convenience and never will. This is exactly the wrong way to deal with people losing their authenticator secrets.

UncleMeat3• 10 months ago

The convenience is that people don’t drop their phone in the toilet and suddenly lose access to all of their accounts.

Flimm3• 10 months ago

I agree. I wonder if there is a good compromise between convenience and security, though. For example, before allowing Google Authenticator to sync for the first time on a new device, maybe notify the user on all devices and enforce a 72-hour delay, or wait until the user approves the new device using an old device (in a way that is hard for a scammer to pass off as legitimate).

drillsteps52• 10 months ago

Why would you have passwords/credentials to your accounts (including financial accounts with tens of thousands of dollars) on a device that not only you can drop in the toilet, but also lose, or get stolen, or hacked? Do you have any idea what access all your cute apps have to the contents of your device?

sciencesama• 10 months ago

i regularly check reddit scams to know about the scams and i recently dodged one which wanted my details !

sequin• 10 months ago

How did they get the passwords to his Google and Coinbase accounts? He reused passwords? The same one for Google as for Coinbase? Or did they reset his Coinbase password via his Gmail? The post doesn't make this explicit, but it warns against password reuse.

em500• 10 months ago

Google/Chrome Password Manager?

IncreasePosts• 10 months ago

But how did they get his Gmail password in the first place?

I'm not sure if I have the same password reset flow as OP, but when I try to reset my password and even provide the 2fa code, it basically doesn't let me get past a certain point without contacting my backup email address or making me use a phone which I'm logged in on to complete the reset

davidscoville10• 10 months ago

I believe they logged into coinbase with Google SSO. And then they used my Google Authenticator codes which were cloud synced as the second factor auth method.

A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.

avree• 10 months ago

This isn't something "auth engineers" can control, there's no magic Google Authenticator flag on a 2fa code - it's all HMAC and numbers, you don't know if the code came from Authy, Google Auth, a homebrew code generator, a dongle, etc.

haarolean• 10 months ago

A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.

Incredible take. I don't know what's worse here — suggesting gmail address = google authenticator, thinking you can know the source of "auth codes", or the fact this is coming from an auth engineer. I'm switching to handwritten HMACs on paper napkins today.

quantified• 10 months ago

Mistake cost him 80k. Author is feeling burnt, but the cost is the cost at transaction time.

shocks• 10 months ago

Incorrect. Author may not have had the required savings to rebuy the position he wanted.

nradov2• 10 months ago

The author can simply buy a "position" in Monopoly Money instead. It's just as useful as cryptocurrency, and as a bonus harder to steal!

saaaaaam3• 10 months ago

Extending this further, based on the stated value it looks like he probably had 40 or 50 ethereum. He might have bought them for a fraction of today's price - say $50 - so might only be out $2500 based on cost at transaction time...

thevillagechief2• 10 months ago

If someone made away with all my retirement savings, I wouldn't say I was only out the cost basis.

vehementi8• 10 months ago

Your analogy is different. They bought for X, then when it was stolen it was worth 80k, and at this random time today, it's worth $120k and he's saying he lost $120k.

elAhmo2• 10 months ago

I have a feeling if ETH went down in the meantime, blog post would reflect 80k, not the lower value.

Imnimo• 10 months ago

I notice none of the pieces of advice are "don't keep a hundred thousand dollars in a Coinbase account".

atm3ga2• 10 months ago

I split my crypto assets between Coinbase and what is now a corrupted hard-drive I've yet to recover.

hcknwscommenter• 10 months ago

The funniest hacker news comment I've read all year. Funny because I'm essentially in the same situation. I'd bet we are legion.

madaxe_again• 10 months ago

I keep mine on a broken raid 5 array (seagate flood drives - two failed within hours of each other) in a shoe box. It’s super secure.

otterley4• 10 months ago

I recommend not investing in crypto at all because it’s an attractive nuisance and has no useful purpose other than speculation and money laundering.

nharada• 10 months ago

One thing I really hate is that some companies with poorly design customer service flows actually REQUIRE you to read a code they text you over the phone to a rep.

At least now more companies include a "never read this over the phone" note in their authentication texts.

narrator• 10 months ago

I got scammed because somebody put a fake bank location into Google Maps and so the Google voice caller ID said it was my bank. Luckily, I realized I got scammed and called the bank up right away and they got the charges reversed, which is why I still use that bank. Moral of the story: never trust inbound calls. They are the easiest vector for scammers to spoof.

themafia2• 10 months ago

It's insane that telephone service companies aren't getting greater scrutiny in all of this. For marginal profits they're allowed to create giant financial craters in the lives of citizens.

Why do banks have to "know their customers" and telephone providers don't?

ianburrell• 10 months ago

Telephone companies are required to implement the STIR/SHAKEN protocols to authenticate phone calls. But it doesn't seem to have stopped the flood of scammers.

I have read that one problem are VOIP systems which can spoof outgoing phone numbers. It sounded like these are easy to attack. Or maybe scammers just make fake VOIP calls from overseas.

BizarroLand• 10 months ago

Same for emails. If you didn't reach out to the person first, don't trust ANY email with alarming call-to-action text, especially if it contains a link to where you can take care of the issue.

RandomBacon4• 10 months ago

Coinbase STILL doesn't freeze user accounts for a token amount of time, 24 hours or so, after resetting a password‽

Part of the blame should be levied on Coinbase if this is the case.

(I'm assuming this guy at least uses unique passwords...)

riffraff2• 10 months ago

The attacker had the passwords and 2fa codes from the Google account so Coinbase couldn't really distinguish them from the right person (tho presumably for large transfers they may require some extra checks, dunno)

RandomBacon4• 10 months ago

The article is poorly written and not clear. It sounds like you're suggesting the author let Chrome save his Coinbase password and Google synced that to the attacker as well?

Google had cloud-synced my codes.
That was the master key. Within minutes, he was inside my Coinbase account.

The author wrote "codes", not "passwords".

Havoc• 10 months ago

I believe you can lock it to specific outgoing addresses though & ones not on the list have a long delay - like a week

edm0nd6• 10 months ago

Coinbase offers Vault though. You can lock your funds into a Vault and it takes like 2-3 days to unlock them + you have to get approval from multiple different email accounts to even begin the unlock.

Coinbase has many ways to secure your account if the user enables them

also physical Yubi Keys would prevent anyone from withdrawing or steals funds as it would have to be plugged in and tapped to process them.

rib3ye2• 10 months ago

I get scam calls with Google in the caller ID everyday.

It kinda sucks that in 2025, voice calls are now near-zero trust.

Is there really no velocity behind any open/consortium replacement to traditional voice calls?

ninalanyon• 10 months ago

Always confirm such things by calling the official contact number that you already have and asking about the case. Do this before you discuss the matter further.

Never act based solely on an unsolicited telephone call or email.

blueflow• 10 months ago

If someone calls and claims to be from an big tech company, its is always a scam and you are going to loose money.

throwaway77833• 10 months ago

I never pick up calls from numbers that I don't know. If it's important they leave a message. And if I think it is important, I call them back through official phone numbers

dec0dedab0de3• 10 months ago

i always tell my mom that no legitimate business would ever call, email, or send a letter about anything.

calmbell2• 10 months ago

The key takeaway from this imo should be to only use password managers with a secret key like 1Password.

wcoenen2• 10 months ago

Thanks for sharing. I already had it in the back of my mind that this cloud sync thing in Google Authenticator was not very secure. I'm getting rid of it right now.

I do see why Google did it; it's going to be difficult to educate users to always set up 2FA both on a primary and a backup device. Much easier and convenient to automatically sync different devices. But your story makes it obvious that something isn't quite right here.

jgilias3• 10 months ago

Authy has solved this though. The cloud sync is opt-in, and encrypted with a password. This makes it immensely more involved to compromise.

wcoenen2• 10 months ago

Ironically, Authy's cloud sync feature may have been what pressured Google to add cloud sync[1].

And yes, Google could have added an extra encryption password. But users forget/lose passwords, especially if they normally never need them. So I can see why Google didn't go that route.

[1] https://www.reddit.com/r/2fa/comments/pmow4k/switching_from_...

blevinstein• 10 months ago

I avoided this exact scam. The most important thing is to never trust an incoming phone number. If they can't give you a publicly posted phone number that you can call inbound, they are a scammer.

Google has dozens of properties and it is easy to generate an email from one of them that seems to confirm the attacker's identity. Never trust any of these to identify a legitimate representative.

bo1024• 10 months ago

It's already hard to verify if a phone number is legitimate, and I think it will get harder. And on the other hand, easier to get a search engine AI to incorrectly spit out the wrong number.

vessenes• 10 months ago

I too avoided it; I had an interesting interaction with the (American) call center scammer -- he called, said his story; he gave me a callback number when asked; I asked him for a web page I could verify a callback number. He quickly rattled off a legitimate Coinbase webpage URL, I believe their ToS page, which does include a phone number. He then hung up rather quickly.

Sadly for the scammers, that number didn't match. But, I note it was part of his script to sound confident and give a working URL. Pretty strong.

____tom____2• 10 months ago

They frequently have nicely done webpages, which have this phone number on them. So you need to find the URL yourself.

blindriver5• 10 months ago

Sorry but it’s stupid to blame Google when it’s 100% your fault. This is a scam that is 10+ years old and you fell for it in 2025. It’s not googles fault at all.

acdha9• 10 months ago

This is like saying it’s not Ford’s fault that they didn’t put in seatbelts and safety glass because people knew driving was unsafe. When bad outcomes happen at scale, you need a system-level fix.

EDIT: to be clear, the fix has arrived: had he used passkeys, this attack would have been impossible and every login would’ve been faster and easier. There are edge cases but this is literally the reason why U2F was created a decade ago.

blindriver5• 10 months ago

The author knew that the scam existed and he even was skeptical. Then chose to rely on it being true despite all the red flags. That’s his fault.

At some point people have to accept responsibility for their own stupid actions.

ycombinatrix3• 10 months ago

It isn't Google's fault that an attacker was able to spoof mail from "legal@google.com"?

Avamander6• 10 months ago

Proof of that remains to be seen.

That being said, there are a few approaches that might leave such an impression to people unfamiliar with their email client.

blindriver5• 10 months ago

Spoofing email addresses has been around since the 90s.

arx_4• 10 months ago

The attacker doesn’t need to spoof anything, this is known as a homograph attack:

https://en.m.wikipedia.org/wiki/IDN_homograph_attack

https://www.xudongz.com/blog/2017/idn-phishing/

sega_sai• 10 months ago

I always read these stories and worry that I will fall for something like this at some point. With all the complexity around authentication, 2FA, backup codes, text messages, cloud-sync, pass keys etc, I find it impossible to be confident that you won't be phished/spoofed/hacked.

briHass• 10 months ago

I worry more about aging parents/relatives, many of whom aren't exactly tech-savvy to begin with. Many of these scams are becoming increasingly sophisticated, at the same time that being able to perform verification in meat-space is disappearing (companies don't have local support reps that answer phones, etc.)

niwtsol• 10 months ago

I just started a company in May to address exactly this! There is so much cyber security tech, but we just felt that no one has really focused on that aging group of users who are historically not technical and very susceptible to phishing attacks. I would love to chat with you about what kind of features you would want to see in that kind of product and/or invite you as a beta user

gargan• 10 months ago

You don't need a spoofed email to steal someone's crypto. Criminals can just hold a gun to your head and demand your keys.

It's happened lots of times and it's why traditional banks are way more secure than crypto.

Well done to the author for talking about it, but I hope the real lesson is learned that crypto isn't a real store of wealth and can be stolen at any time....

ghurtado2• 10 months ago

Criminals can just hold a gun to your head and demand your keys.

Sure, but this is Hacker News, not Mugger News.

ajross5• 10 months ago

You miss the point. You can't mug someone for their Vanguard account. Robbery risk is limited to cash on hand, or arguably whatever the ATM limit is on your bank account.

pavel_lishin2• 10 months ago

True - but a phone call scales much easier than driving to someone's house with a gun.

lo_zamoyski4• 10 months ago

I've been told that scammers aren't interested in making scams too good, the idea being that you want to select for people who are bad at recognizing a mediocre scam, because they'll be more likely to play along for the entire scam.

prawn3• 10 months ago

Not just scale either. On the phone you're dealing with people having less fear from local repercussions, from reprisal, less care for the community, etc.

bingboingbang2• 10 months ago

There's a non-zero chance someone can just roll a new key and it happens to be yours, and poof, your money is gone with no recourse.

It's a tiny, infinitesimal chance: but it's a heck of a lot greater of a chance than the same thing happening with a bank account, especially the "no recourse" part.

vkou2• 10 months ago

Let's be realistic.

I'm a huge critic of the cult of crypto, but the odds of a key collision are smaller than the odds of <some highly improbable series of mistakes/coincidences/malice happening that result in you losing your money in the traditional banking system>.

The odds of a 'someone gets access to your account/wallet and instantly drains it with no recourse' are much higher in the crypto space, as the author of the post experienced.

Jleagle• 10 months ago

I think you're misunderstanding how small the chance of creating the same wallet as someone else is.

There are 2^256 wallets. There are 2^72 grains of sand on earth.

The chance of your bank screwing up is a lot higher, by trillions.

beeflet12• 10 months ago

The odds of the bank making an error related to your account and crediting you money is far greater than the odds of generating the same keypair as someone else.

beeflet12• 10 months ago

In cryptocurrency, you can use a multi-signature account to define your own security setup.

For example, even a 2-of-2 setup with a trusted authority like a bank is straight-forward improvement in security over the conventional bank system.

You can go further, for example consider a 3-of-5 setup with 2 keys in security deposit boxes, 1 key on a laptop, 1 key on a phone, and 1 key on a hardware token. You can set the hardware token to erase its keys when the wrong pin is entered, making it pretty rubber hose proof.

hvb23• 10 months ago

But no one will require that. When you do, no new money will flow into crypto and the music stops. And no one in crypto wants that.

So you want there to be as low of a barrier of entry as possible, which is how we get here...

Especially when transactions can't be traced

BehindTheMath• 10 months ago

https://xkcd.com/538/

ProllyInfamous• 10 months ago

Multisignature wallets are the answer to this. Also helps spendthrifts (to require group concensus for bitcoin redemption).

Of course, this doesn't help if you don't have trusted associates — and can be (even more) dangerous with multiple people responsible for crypto custody.

Also helps if you have offline ("cold wallet") storage, which would require hours to importPrivKey and redeem. Slow them down...

stefap2• 10 months ago

I have a cell phone with an area code where I no longer have any connections or ties. Almost all the spam calls I receive come from that area code. By simply ignoring or blocking calls from that area code, I can avoid nearly all of the spam.

joshstrange• 10 months ago

I've enjoyed that state of affairs for over a decade but now I'm moving back to where my area code matches my physical location. I'm sad I'll be losing this easy filtering trick.

On the plus side, iOS and Android now have features for auto-answering and filtering so thankfully I have that.

sroussey2• 10 months ago

A few reminders bear repeating:

— no support group from a big company is going to call you. Ever.

— never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!

— Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party like 1Password or similar.

— Don’t have the same email you use banking and investments be the email that the world knows. Create a new email for that. If you use Chrome, even use a separate profile with that email, and only have your password manager as an extension. No others.

gpt5• 10 months ago

never give out codes sent to use via sms or push notifications to someone requesting them via phone

Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).

sroussey2• 10 months ago

I’ve personally never had that happen. It should go on a name and shame list.

ApolloFortyNine• 10 months ago

Google support actually did ask me for that code when I had them disable energy savings on my nest thermostat. (it's insane that this had to be done through support, it's the setting where the power company can essentially control your thermostat in exchange for savings)

To their credit/discredit, when I said no I'm not giving that out it says not to they just moved on. Not sure why they even asked then.

fvgvkujdfbllo• 10 months ago

Yes, it is so easy to enable this setting, they even keep sending us notifications to enable it. But once enabled, it is impossible to disable it.

It is a setting that let your power company to change your temperature settings when grid is under load. We wouldn’t mind it but they turned our heat way down during one freezing night while we were sleeping. Everyone woke up with cold next day.

Loughla• 10 months ago

Google business support called me to close the loop on an issue I had with a business listing. It was from a very busy and loud call center, and was made by someone with a heavy accent.

It's like they want us to get scammed?

mandeepj2• 10 months ago

Include SPAM call blocker in that list! Notably, both iOS and Android have that feature. Never pick the first call from an unknown number! If it's urgent and they are genuine, they'd leave either a voicemail or a text.

ajross5• 10 months ago

— never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!

I tried making this point downthread but it bears repeating higher up. Per OP, this was account with Authenticator enabled. If you have a working authenticator setup, they aren't going to "ask for a code", since by definition you're already authenticated. And while I'm no expert, I really don't think there is such a thing. Recovery for a lost account never goes back to device-in-hand once you have enabled full 2FA.

Something is being skipped in the description of the phish here. I don't think OP is being completely honest.

davidscoville10• 10 months ago

The code I read to them was a Google account recovery code. That’s how they accessed my Google account. I, mistakenly, believed they needed to confirm I was still alive and the rightful owner of the account.

Then the attacker used Google SSO to perform the initial log in to my coinbase account. Then they opened Google Authenticator, signed in as me, to get the coinbase auth code so they could complete coinbase’s 2fac.

827a• 10 months ago

Honestly if someone from Google Support calls me, my immediate response would be: "Google... Support? Now there's two words I've never heard in the same sentence before."

traceroute667• 10 months ago

Always use a third party like 1Password or similar.

Or even better, don't rely on a third-party hosted service.

I've been a Codebook[1] user since the old-days when they used to call it Strip.

They are old-school, local-system storage. With sync/backup done how you like it (all three encrypted before it leaves your computer):

    - Dropbox
    - Google Drive
    - Local folder (which you can then sync with using your own mechanism)
    - Recently (only this year) they introduced a totally optional hosted subscription cloud-sync option for those who want it

[1] https://www.zetetic.net/codebook/

no_wizard• 10 months ago

There’s something to be said for the setup and largely forget it nature of 1Password

There’s good reasons to use it over self managed solutions, just like there are other good reasons to use a self managed system like this.

Neither should be strictly dictated as better without first ascertaining what the user is looking for

lokar2• 10 months ago

The backup of a TOTP is just the seed, right? Print it out and keep it with your other sensitive papers

MrDarcy• 10 months ago

— no support group from a big company is going to call you. Ever
- never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that.

Chase bank still, as of last week, asks for these codes over inbound calls. Drives me mad. They do so when calling me about fraud alerts, not the other way around.

schneems• 10 months ago

You can hang up and call the number on the back of your card

bdangubic8• 10 months ago

NEVER answer - like NEVER :) absolutely NEVER answer... calls or text... it is really simple. I also have Chase and I have blocked just about every single number they called me from (probably like 12 over the last decade)

kevin_thibedeau5• 10 months ago

If you initiated the call (to the correct number) then SMS verification has a low likelihood of being a scam.

fxtentacle2• 10 months ago

Except that a few weeks ago, I got a phone call

- from a number with no results on Kagi search

- claiming to be the online banking support of my bank

- asking me to read them a code sent to me via SMS

and when I refused to do that, they blocked my login credentials for online banking and sent me a sternly worded (paper) letter that my account could not be upgraded automatically for their software system migration because I had refused to engage with their support agent.

I then had to create a new login in their app, call the phone number on their letter and read that guy the SMS code and, to my surprise, that was the only !!! authentication needed to activate the new login credentials that I had just created.

(BTW, this was one of the top 100 largest banks worldwide)

It's almost like some companies are training you to fall for scams.

EDIT: This specific instance was Deutsche, but Chase has the exact same horrible habit of calling and then asking for an OTP code.

tartoran2• 10 months ago

Can you name the bank?

gcr• 10 months ago

Which bank was this? Please name them so I can avoid doing business

mandeepj2• 10 months ago

At least, you took the right steps. However, they were stupid to begin with.

carlosjobim2• 10 months ago

They treat you as you deserved to be treated: As a serf. You let them stomp all over you and still come crawling back to plead with them to let you bank with them. Even though there's hundreds of banks you can switch to.

If anything even remotely similar happened to me, I'll instantly close all accounts and move my business to another bank.

dec0dedab0de3• 10 months ago

My old insurance company (Cigna) used to call me and demand information to verify it was me. I eventually figured out it was a thing to try to convince me into getting cheaper cancer treatment so they could save money.

rightbyte2• 10 months ago

Ye. I called my bank to unblock my Mastercard after they blocked it due to Blizzard charging 10USD or something for Star Craft. I just told them my name and they unblocked it.

On another occasion the bank called me regarding my house insurance and asked me to identify myself with their dongle.

Like, there is a wonder I have any money at all in my account. But then again, giving away plastic cards with a magic number on that you gave to strangers for them to withdraw an amount of their choosing from your account was the norm for decades ...

Maybe the wisdom is "Security through no security"?

apparent• 10 months ago

I've gotten calls from my bank before, where they tried to get me to authenticate after I answered the phone. I said "look, you called me, I'd be crazy to just answer the phone and give out personal info." They refused to provide any info that I could have used to validate that they were legit (like telling me something about my account number, when my account was created, etc.). They said I had to authenticate with them before they would tell me anything.

Sometimes the rep is understanding, and acknowledges that he would have the same reaction, but other times it's like they don't realize they're asking their customers to do something Very Stupid™.

jlarocco• 10 months ago

I know Wells Fargo gets a bad wrap (and rightly so) for some of their behavior, but IME they've always had their stuff together with online access and banking.

andy99• 10 months ago

The bank's policies and those like it are the root cause of these scams. There are countless things like this where real "legit" behavior is completely indistinguishable or sometimes even worse than scams.

There will always be people that are "wallet inspector" stupid that you can't really shield from scams. But common sense practices and consistent messaging would solve a lot of the problem. There needs to be better accountability for companies that have these insecure practices. The same way they'd be held accountable for a data breach. Oh, wait...

UltraSane7• 10 months ago

They should really send the code in a letter.

joshuamorton3• 10 months ago

Yes, I've also had wells fargo require me to read codes that were emailed back to them, and while this was mitigated by me calling them, it sketched me out every time I had to do it.

thrtythreeforty• 10 months ago

I mean just get a new bank at that point. They're telegraphing that they're gonna cause you more inconvenience in the future.

mvdtnz2• 10 months ago

Change banks.

john_the_writer5• 10 months ago

My local medical clinic sent me an sms with a link, asking me to change my medical info. I called them to point out how they were training their patients to fall for sms scamms.

brewdad3• 10 months ago

I had to call Chase about an issue with my credit card. I called them and knew I was talking to a legit agent. At least as sure as one can ever be. Still, at one point she asked me to read back the code she texted me. I started to do so then stopped. I explained that the text she sent me specifically states "We will never ask you for this number (over the phone". I refused to read it back since it violated their own stated policy.

She had to do some additional work to resolve my issue but it did get fixed.

zeven7• 10 months ago

At my (very large) bank, they have asked me to read them a code from text that literally said "Do not share this code with anyone over the phone" in the text message next to the code. I'm 100% sure it was my bank asking for the code. I called them from a number I found on their site over HTTPS and verified from another source, they knew my account information. I gave it to them while telling them they need to fix this. This was a few years ago. Nothing bad ever happened. Just bad security practices.

Pesthuf• 10 months ago

Did the OTP message they sent you state that this code was specifically to authenticate on the phone?

If it did and even included details like the person‘s name, that would make me feel safe. If it’s a generic OTP that could be used to log into my account or reset its password, though…

Arrowmaster• 10 months ago

I had this happen with fucking Google.

I called them about my Fitbit warranty and the rep needed to verify my account and wanted me to give him the code from SMS that explicitly said in the SMS not to give it to anyone!

No my account did not get hacked afterwards. Yes it was a legit service rep because afterwards he was able to pull up info on my previous warranty claim.

speeder• 10 months ago

I used to manage the Google Ads account of a business I had in the past.

Google Support would call me all the time, and then first thing they would do is ask me to open the interface and repeat some code or another.

cmurf• 10 months ago

AMEX fraud support group called me. A real live agent.

Capital One texts codes during live calls and requests the customer read the code to them.

A health care provider sends emails with links to 3rd party domain to provide encrypted email, because a) regular email isn’t supposedly not HIPAA compliant and b) apparently the health care provider’s web and app infrastructure which provides secure messaging is not secure enough for certain messages. It’s indistinguishable from a phishing attack.

Hospital direct invoicing by email, also includes 3rd party links, which takes the user to a site asking for personal information including SSN. It’s certainly phishing. Right? Nope, it’s legit, and no option to get a mailed bill once volunteering an email address.

I think half of mobile device users don’t know or can’t handle a best practices workflow.

The reality is the tech industry sucks, it’s bad at its job, gives shitty advice to everyone then goes and violates all of it leading to loss of trust.

reaperducer2• 10 months ago

regular email isn’t supposedly not HIPAA compliant

It isn't.

I work in healthcare, and if anyone in the company sends an email with PHI or PII in it, we're supposed to alert the Security department, or lose our jobs.

klik994• 10 months ago

I am a big fan of keepass which I sync with dropbox, good apps exist for iphone/android/mac/windows/linux. But I don't know if that's more secure than a password provider like 1password. At least not fitting into the typical profile, and being able to control the data, open source code, and offline access feels like the optimal way for me.

krashidov• 10 months ago

My phone is set to Do Not Disturb by default. Only 5 numbers can reach me direct to ring and that is immediate family only. I never answer calls from unsaved numbers. If they really need to reach me they can leave a voicemail.

When you answer a call your brain kinda loses its ability to step back and think. Almost like the same trick that those people who ask for directions and steal your watch do.

Security is not the main reason I do this but it has been nice knowing I can't be reached directly by scammers and hackers.

anal_reactor• 10 months ago

I stopped answering unknown numbers because everything that's important comes via email anyway. But a friend of mine has a job that requires them to answer calls from weird numbers, so it's tough.

everybodyknows3• 10 months ago

Doesn't any legit caller always leave a message? That way, you can think through the security issue before responding.

IshKebab• 10 months ago

Yeah except I used to get legitimate calls from my bank's fraud department starting with "can you confirm your date of birth and address".

Yeah, insane. I think it was HSBC. This was a couple of decades ago so maybe they've fixed that. I don't bank with them any more.

ajsnigrutin• 10 months ago

Yep.

But over here our bank has also been sending out leaflets on how to avoid scams, and the top two are "if you need to call, call the number written on the back of the card" and "if you're not sure, come to the bank in person".

Same thing I tought my parents, and my mom actually got a call about some "personal info they needed to verify", said she'll come to a bank in person, they said "ok", she went in person, and they actually needed to verify some data (some EU regulation, she hasn't visited a bank in years).

sowbug• 10 months ago

Has anyone invented something like the TLS three-way handshake, or a U2F challenge, that can use spoken words as a transport layer? People could then be "safely" tricked into reading back "correct-horse-battery-staple" or whatever, because they actually wouldn't have the ability to generate a usable sequence unless the attacker first provided something that only the real site owner could provide.

I'm imagining something with the non-phishability of U2F but the usability of an SMS 6-digit code. Maybe that's U2F.

ctennis1• 10 months ago

I'm in the midst of a transfer of enterprise account ownership with with Apple, and I can assure you, the only way to complete it is to wait for a phone call from Apple Support from 1-512-884-5022. You can call this number back and verify it is indeed Apple Support and get notified it does not accept inbound calls, only outbound.

zamadatix3• 10 months ago

The danger with stating this in terms of absolutes like:

no support group from a big company is going to call you. Ever.

Is, eventually, you probably will get a call from a support group at a big company, as many have noted in response, and then all of the other absolutes in the list also become "well, people say never, but I think this is one of those exceptions" instead of "it's never worth taking the risk of assuming it's the company who really called you".

A company, even big one people joke about having a complete lack of actual human support agents, may really call you one day. The other 364 days of the year it's probably a scam. The safe bet is to take the issue they called about and contact the official support channel yourself (being careful to get a real one and not an ad/fake site if you need to Google it). It may not always seem the most convenient, but it only takes one mistake to end up in a much more inconvenient place one day.

odie5533• 10 months ago

During a Tracfone support call I made recently, they sent a 2FA text to me. I said to the rep, "The text says 'Don't share this code with anyone.' Can I share it with you?" They laughed and said yes. It was completely legit as I had called Tracfone for some service changes.

So some of these systems are very poorly designed.

LeafItAlone• 10 months ago

never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!

Some services even say that when they are indeed codes you are _supposed_ to read back to them. Which clearly helps further train people to ignore that language.

oliwarner3• 10 months ago

We're a bit light on detail here but it's worrying that it's 2025 and Google isn't flagging "looks like" @google.com messages.

I'm assuming this is a dirty unicode hack and not something worse: no DKIM or an actually compromised sender.

The whole thing stinks.

carodgers2• 10 months ago

I can't believe he omitted that detail. How did they appear to send an email from a google domain? This is especially puzzling given that he says he works in security.

iLoveOncall• 10 months ago

Looks like the attacker set "legal@google.com" as expeditor name, so that's what showed on the author's phone, that's it.

rs186• 10 months ago

I never considered Unicode domain names a good idea. Looking at it today, it appears that the only people who use Unicode in domains are scammers and criminals.

Thanks ICANN!

BXLE_1-1-BitIs1• 10 months ago

My favourite Pixel feature is Screen Call.

My primitive security precautions:

1. DO NOT use your Gmail for recovery. Use another email provider.

2. Use a family member's phone number for recovery.

3. DO NOT install your bank's app. Somehow the Royal Bank of Canada's app was used as an attack vector. If the RBC app can get hacked, smaller banks are even more vulnerable.

4. Use incognito mode on your browser for banking so a thief or hacker can't use your browser history to find out your bank.

adrr4• 10 months ago

4. Use incognito mode on your browser for banking so a thief or hacker can't use your browser history to find out your bank.

You can buy that information. Databrokers will sell it. Your bank sells your transactions.

kerpal2• 10 months ago

Use a password manager and use a SEPARATE second factor authenticator not tied to the password manager. I personally use Authy (though I think it's been deprecated) and Bitwarden.

I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my to unlock my account probably to drain bank accounts.

icedchai2• 10 months ago

Same. I don't store my 2FA with my passwords. I also use Authy, I'd like to move to something else but as long as it's working. I was annoyed they got rid of the Mac app.

kerpal2• 10 months ago

Same, the desktop app worked great. Probably for the best though, ideally you want to pull your codes from a phone and password from your desktop device.

jp191919• 10 months ago

Absolutely. If you are looking for a new 2FA/TOTP app- Aegis is good, also Proton Authenticator as it's independent of a Proton account.

ajross5• 10 months ago

Something isn't adding up here. The author is excruciatingly rigorous with documenting lots of stuff here, including the screenshots. Then glosses over this bit awfully fast:

So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did

This was an account with authenticator enabled. I'm no expert, but I really don't think there's a recovery process that works as simply as "read back a code". Certainly not in the SMS 2FA sense I'm sure we're all expected to interpret.

Honestly it seems like the author is trying to blame Gmail's UI, when some other more involved phishing technique was actually the novel part here.

GioM2• 10 months ago

I don't get this part either.

if the scammers had spoofed the email, they would already have that code, and if they hadn't spoofed that email... I mean it looks like a case ID, why would they need it?

Maybe the reading back the code was to get buy in, then there's a missing step here like they had him hit "allow" on a 2fa prompt. Or maybe the email was legit, since it references a "temporary code" and the case ID allowed access with that code?

Good chance my reading comprehension is shot and I'm missing something, I suppose, but I don't understand.

ajross5• 10 months ago

Good chance my reading comprehension is shot and I'm missing something, I suppose

That's more charitable than me. My UnreliableNarrator sense is tingling really badly here.

InMice• 10 months ago

I also feel like the article doesnt completely explain what happpened. Where is this code from?

Did they send the fake legal email and at same time trigger a recovery code to be sent?

Is this like the same thing in discord where they ask you for your email to join a server then ask you for a code sent to verify you own that email but really they submitted the email for password reset. The victim doesn't realize it's a real recovery code sent by Microsoft, etc instead in the moment thinking it is a "discord code". Once you submit the code in discord they have your account stolen in seconds.

Is this what the article is attempting to describe?

LgWoodenBadger• 10 months ago

If the scammer is attempting to login to the actual account (which requires 2fa), asking the scammee for the code will allow the scammer to login and do all the things. The scammer is using the victim as the 2fa directly.

elAhmo2• 10 months ago

Knowing how impossible is to get a hang of anyone at Google in case things go wrong, it is probably very safe to just assume they will never ever ever call you.

____tom____2• 10 months ago

Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator.

So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth.

Example: If you log in from a Macbook, and the second auth is sent to your phone, Apple will helpfully forward that code to the Macbook, completely removing the second factor.

joshuamorton3• 10 months ago

Two factor usually means "something you have + something you know". So your MacBook + your password is two factors.

I've seen references to "three factor" auth which is often a push notification to a phone, and then there's more secure second factors, like yubikeys or code-protected passkeys.

jenadine2• 10 months ago

I don't know my passwords: They are stored on my MacBook.

UncleMeat3• 10 months ago

There’s threats and there are threats. Second factors largely exist to prevent password stuffing from password reuse. Even if the second factor is the same device as the device where you are initiating a login this works just fine.

If your goal is to stay safe even after one of your devices is owned then you’ve got a rarer (and way more difficult) threat model.

commandersaki3• 10 months ago

How did this user Coinbase account get hacked anyways? Did they reuse passwords? Did the attacker even have passwords?

PaulHoule• 10 months ago

It doesn’t work because people don’t understand it. They understand they are getting harassed all the time and in a state of terror because you might get locked out from your accounts because you lost a device or because something went wrong with your relationship with Apple, Google, Microsoft and other large unaccountable vendors —- something you may or may not get an explanation of.

Since you’re getting harassed all the time and dealing with opaque rules it is no wonder people are fatigued, make mistakes, are inclined to panic when they get a scary call and hand over the keys, etc.

To add to that, having anything to do with crypto is to put a big target on your back and make yourself vulnerable.

jiveturkey• 10 months ago

MFA is a cargo cult these days.

janalsncm3• 10 months ago

Every day Google is trying to foist Gemini on me yet spam like this waltzes right through Gmail. Perhaps once we have finished our Dyson sphere powered AGI we will be able to block emails spoofed from @google.com.

slig• 10 months ago

I'm get tons of email from @google.com, not spoofed, but somehow they send some email to $myname@google.com, which doesn't exist, and it google server returns back to my $myname@gmail.com telling me that with a huge CTA from the spammer. That bypasses all spam filters since it's an actual email from google.

insane_dreamer2• 10 months ago

I no longer answer calls from a number not in my contacts. If it's a real call that I need to take care of, I figure they'll leave a voicemail and I can decide whether I want to call back.

zargon2• 10 months ago

If you want to keep $100k in a crypto exchange, it doesn’t cost much comparatively to purchase a few yubikeys.

The thought of having all my online services centralized with a single provider for email, SSO, 2FA, and so on is scary. Especially at Google, where you can lose all access at the drop of a hat, with no recourse.

chinathrow• 10 months ago

The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.

Don't do that. Don't put your 2FAs somewhere else than in an unsynched app. Not in Bitwarden, not in any online account, nowhere else than "Something you have".

gip• 10 months ago

Just wondering what is the plan in case this thing you have gets lost?

And would you say that using something like authy with encryption using a totally unique password is safe?

cbdumas3• 10 months ago

Typically you print out recovery codes and keep them somewhere safe

cbdumas3• 10 months ago

The attacker already had access to ... my Google Authenticator codes, because Google had cloud-synced my codes.

This was such an obvious mis-feature I can't believe they actually rolled it out. For those using Google Authenticator you can and should disable cloud sync of your TOTP codes.

Flimm3• 10 months ago

I can understand it. Ordinary users were getting locked out of their accounts when losing their phones. Some of those stories hit HN.

Don't disable cloud sync unless you have a backup of all your TPTP secret keys. It's dangerous to advise people to disable cloud sync without mentioning backups. Being locked out of thousands of dollars in your crypto account is as damaging as losing that crypto to hackers.

cbdumas3• 10 months ago

In that case wouldn't you be better off just disabling 2FA? The problem with the cloud sync is that users like the one in the article think they have 2FA but in fact if their Google account is compromised all their accounts using Google Authenticator TOTP second factors are also compromised.

kwar13• 10 months ago

So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.

I am not clear how the account access occurred. What code did he read? He voluntarily read his own 2FA code from his Authenticator?

bingboingbang2• 10 months ago

Seems likely to be an SMS code, Google will use a phone for recovery if you claim to have no other access.

This person read an SMS code — one that explicitly says not to give it to anyone — and then they said "I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes! And yet, I got phished."

This person's greatest mistake was answering the phone to a stranger. Who knows what hell can be unleashed on one's emotions nowadays with AI. One cannot expect to be rational in a lion's den.

They are royally fucking up their PSA by throwing Google under the bus rather than telling people to avoid answering their phone to scammers. I suspect this PSA will help approximately no one because of that. Not getting your voice captured (for AI synthesis) is, by itself, a great reason not to answer random calls like this.

vehementi8• 10 months ago

Who knows what hell can be unleashed on one's emotions nowadays with AI

This is key. I would "never" fall for a scam like this. But who knows for sure? I would also never cheat on my partner, but can I say with 100% certainty that some insane situation can't possibly ever come up where my many layered defenses are compromised? Can some sufficiently charismatic individual deliver a perfect AI script to me based on info from 5 other breaches, in my brother's voice, to make me give up a 2fa token in an emergency? Maybe! So just never answer the phone, ever

mystraline• 10 months ago

Another company that sends 2FA over SMS codes, then wants them over the phone is Family Mobile. Its a Walmart T-Mobile derivative.

Its not a GREAT carrier, but I have a legacy plan for unlimited everything at $20 a line.

But if I have to call in, they do send a 2fa SMS code, and require to tell them over the call. Its absolutely ridiculous. But, Ive only had to call in 4 times in the last 9 years, so, yeah.

amradio1989• 10 months ago

The key takeaway is: we are all human. And humans are easily hackable under the right circumstances.

Your story is humbling, and a good reminder that anyone can get “got”. We shouldn’t think ourselves above such incidents.

edm0nd6• 10 months ago

IMO the takeaway is the author had very poor security.

You can literally tie a yubi key to your Coinbase account and no one can withdraw funds unless a yubi key is physically plugged in and pressed.

One can also use the Coinbase Vault system where it would be impossible to steal any funds from his account had he enabled it.

You should also never use cloud sync for Google Authenticator as evidence here as why.

jonny_eh• 10 months ago

My takeaway is to never answer the phone when an unknown number is shown.

wewewedxfgdf• 10 months ago

If you're running a service with things of value, slow down big actions - please - like why allow large money transfers without an 8 hour wait period and extraordinary verifications.

ipython• 10 months ago

It's so frustrating reading this, because this blog has about 75% useful information, with 25% just left there unsaid.

On iOS, Gmail doesn’t let you view full headers

True! But Gmail on desktop does provide full headers. Why not post them so the rest of the community can step in and help out?

vehementi8• 10 months ago

They're not saying they can't get the headers, the point is that if you're using iOS you don't have access to the headers to validate

davidscoville10• 10 months ago

I lost the original email—the attacker deleted all evidence and then cleared my trash (and yes I tried using the Google tool to find deleted emails, but the attacker cleared that too). The reason I have this email is because I forwarded this email on to phishing@google.com, before the attacker deleted everything. When I got control of my account, and removed the scammer recovery methods (he added a windows device—I don’t use windows, and a Brazil phone number), the email bounced back from phishing@google.com (apparently Google doesn’t accept that address). So what I have is the bounced-back copy.

davidscoville10• 10 months ago

I updated the post and include the headers & html of the bounced-copy, although I don't think it's very useful.

tracker1• 10 months ago

As a rule, I never give any private or secret information on received calls. I had a doctors office that their automated system would call and ask for my social security number, and I'm like, nope... not happening. Even when I knew it was likely legit.

Healthy levels of paranoia aren't so bad.

danr4• 10 months ago

the biggest mistake was thinking google actually provides customer support

m4tthumphrey• 10 months ago

I answered

This is honestly the cause IMO. I refuse to any call from any number not in my phone book, UNLESS I am expecting a very specific call and if it’s not who I expect, I hang up with no conversation.

Dilettante_2• 10 months ago

Fall for spoofed email sender
Keep your crypto on an exchange

This gets the same level of sympathy as a person without backups suffering from data loss.

jackconsidine• 10 months ago

I think that’s a pretty unsympathetic take. Hindsight is 2020 but there are factors outside the author’s control (synced MFA, Gmail not detecting the spoofed address)

Dilettante_2• 10 months ago

Cloud sync is not out of one's control, and complaining that Gmail did not automatically detect the spoofed address is an inversion of assumption. It's like dropping your icecream and then being mad nobody caught it for you.

Is the average user (someone who "works in tech" even!) really so uninvolved in their own security? Are they not expected to hold any responsibility whatsoever?

user34283• 10 months ago

No more deserving than any other of the crypto cultists.

Whether you fall for an elaborate phish, or if your Ponzi-token predictably loses value after your 'investment' was cashed out as an earlier adopter's profit, it's all the same to me.

Alternatively your hardware wallet bricks itself or three of your disks fail at once.

I don't care. You lost the money when you first exchanged it for worthless tokens.

tehwebguy• 10 months ago

Heck of a job, Google!

Email spoofed from legal@google.com and he read it in Google's Gmail app for iOS. The original title was correct: "Google Helped It Happen"

edm0nd6• 10 months ago

except its not a spoofed email. It's really from Google. You cant spoof emails from Google that inbox.

You can use Google Cloud or Google Sites to trigger emails to anyone that legit come for Google email addresses and servers or submit forms on Google that will send legit emails to Gmail users/targets.

They simply either just embed their scam text into these emails or use the emails from legal@ as a scare tactic and pretext for their scam when they call you.

ac292• 10 months ago

except its not a spoofed email. It's really from Google

Read the text shown in the screenshot in an article. I am 99.9% sure that is not from Google. The wording screams scam to me, most likely from someone who is not a native English speaker.

Among many many other red flags, it specifically says not to try and change your password for 6-12 hours and to not share the details of the email with anyone.

citizenpaul2• 10 months ago

I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes!

To Me this quote says so much about the crypto space more than anything.

Also not shocked it was crypto theft.

SoKamil• 10 months ago

What does it say about crypto space?

citizenpaul2• 10 months ago

Otherwise rational and educated people are willing to suspend disbelief about anything as long as it supports their crypto yacht dreams. In this case the concern that their yacht dreams were being lost. Which ironically caused their dream to be lost.

klik994• 10 months ago

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good.

The guy who called me said "I can send you an email to show it's official" and I thought of that immediately when I read this article. No dice, he refused to give me a number to call back on, so I knew it was fake.

EDIT You can spoof from email addresses and you can spoof phone numbers - if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.

dec0dedab0de3• 10 months ago

Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.

klik994• 10 months ago

Good to know.

The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.

skygazer• 10 months ago

It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. The web is untrustworthy, and Google transparently passes it to users. We'd probably be better off if Yahoo's quaint curated list of sites had won out.

Waterluvian• 10 months ago

I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.

kevin_thibedeau5• 10 months ago

They also typosquat support numbers for people who misread them or assume things like toll-free is always 800 when it can be other area codes. Just because someone answers, don't give them enough PII to use your identity elsewhere.

gblargg• 10 months ago

This happened to me once. I was calling Amazon and did a Google search on mobile. I called the big number that was at the top of search results. After I had given my account email, but nothing critical, I started becoming wary of the questions I was asked because they weren't relevant. I hung up and searched again and the result did not come up again, and Amazon's number was totally different. I looked up the number I called and it didn't find any results. So I'm guessing an ad scam. I definitely don't trust Google results with featured answers for things like that anymore.

avidiax2• 10 months ago

Yes, especially do not google the number that you were given on the phone. That is completely certain to turn up the scammer's official looking page and "confirm" the phone number.

I have seen Microsoft support forum articles that list the "Facebook official phone number". The fact that it's not from Facebook doesn't make it less authoritative in a panicked person's mind.

Google, Meta, Microsoft, and Apple really must start publishing an "official phone number". It is perfectly OK that this phone number just plays a repeating message saying that the user should browse google.com/phone. That website can explain that there is no phone support offered, and provide a bunch of links for common scamming hooks that leads to anti-phishing material.

beeflet12• 10 months ago

official phone number

Great idea unless the attacker has SS7 access.

klik994• 10 months ago

Yeah, if you're a high profile target then you need extra layers of security, but for regular folks that one weird trick is enough to make you just enough of an annoyance to make another target preferred.

But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.

ElijahLynn• 10 months ago

Can you expand on what ss7 means?

wil421• 10 months ago

Explain how SS7 access can allow someone intercept my call back to an official number like Bank of America or a number on Fidelity a 401k support page.

mihaaly2• 10 months ago

I have no time and energy for the level of paranoia present web services RQUIRE. I started to cut back. One of the firsts: not accepting Terms and Conditions for a site my company delegated for the sole purpose of delivering my payslips (probably some others too, but marginal compared to this). I'd need to revisit the details to tell what was that exactly, but some sort of sharing some of my data with thrid party (subcontractor) thing. It is a recent develpment, I will see how it flies with my organization, but I'd be surprised if I could be forced to accept T&C just for receiving payslips. We have 2 other admin accounts for reporting time, absence, no more for me with some arbitrary service provider, thanks. (in the previous job of mine our absence tracking system sent me incentivised ads in the dashboard to attract others to their platform and some sort of weird discount system if I buy things here or there, quite repelling)

Braxton1980• 10 months ago

How can he spoof an email address without Gmail or the like flagging it? I'm not talking about the common name but the actual email address.

stavros• 10 months ago

That's what I'm curious about too. DMARC should make that impossible.

doctorpangloss2• 10 months ago

I don't know. Google could solve this all in an afternoon. It controls e-mail delivery, it is the e-mail delivery monopoly. Why deliver these e-mails? It just shouldn't.

But because Google delivers spam from senders who spend a lot on Google ads; and e-mail traffic gets laundered into web ads traffic; they just can't do it. And because Superhuman charges more than $0, it can't do it either. Nobody can fix e-mail. If you can't see how phishing and Google Ads are related... you know, this is why it is hard to "just" pass a law. It's not because the law wouldn't fix the problem. It would, if you permit the status quo where Google is the e-mail monopoly. It's this whole A16Z "just pass a law" nonsense, where someone thought he was saying something really insightful because he didn't like Jon Stewart, getting in the way of my inbox zero, and simply never receiving non-personal e-mails at all.

vunderba• 10 months ago

I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com, etc.) and look up the phone number there.

A little less convenient for a LOT more security.

bigiain• 10 months ago

For some reason I can't seem to find my local Google branch's phone number on their website...

misnome• 10 months ago

There are a lot of contact numbers for e.g. banks and often it’s not obvious how to re-contact the department you are talking to. So, I’m happy to take a number, but I have to be able to find it on the conpany site somewhere (will also accept generic e.g. “call the bank fraud line and supply this reference number”)

II2II3• 10 months ago

I have the fun of making outbound calls to offer people a public service and collect payment if people desire it. Most people gladly hand over their credit card details. A few years ago, someone wisely asked why they should trust me. (It only happened once in a decade!) I said they don't have to. They could look up our phone number at an easily verifiable government website, then call back; they could call any facility operated by the department; or they could visit any facility. Said individual provided their credit card details right then and there. Virtually noone cares about security.

hedora2• 10 months ago

I usually ask for the phone number, find it on the corporate site, then call the branch office.

Alternatively, ask for their license number, check the license, then call the number it lists. (Kills two birds with one stone for licensed professionals.)

cortesoft• 10 months ago

But this is google, who don’t have a phone number to call them.

marklubi4• 10 months ago

Just to add on, never say "yes" when you get a call from an unknown number (or maybe from all numbers, just be careful).

"This is he(or she)", or "who are you trying to contact" handle most situations.

Just don't let scammers get you saying something in the affirmative.

docmars• 10 months ago

I simply don't answer my phone for anyone not already in my contacts, unless I'm expecting a call from a contractor or local service.

I assume if I have a problem with any of my accounts, I'll eventually find out and self serve to go and fix it, as much as possible.

Gud• 10 months ago

Yes, why would you accept the phone number given to you by this stranger calling you as legit?

8cvor6j844qw_d6• 10 months ago

if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.

This reminds me of one time where I got a call from a number I don't know, got yelled at something about spamming calls. Yelling includes threats about getting reported to police or whatever, which was confusing since I never had any history with this number.

I suspect my number was spoofed. I'm not sure if there's any defense against that.

Now my default is to ignore any unknown numbers.

glxxyz• 10 months ago

if someone is calling from a legit number on caller id it means NOTHING

I had to tell my bank this once a few years ago, when they called me up and then expected me to give them personal information to confirm my identity.

foofoo12• 10 months ago

I don't know what the Google Authenticator team was thinking, if at all, when they did that deplorable implementation of the sync feature.

One click on the "backup codes" on main screen and boom, no confirmation or anything. Your keys are in the cloud. I couldn't find a place to undo it. Article says it's enabled by default now. This is shameful.

1970-01-013• 10 months ago

The big tell was someone that operated via a telephone. Google would never do this.

bell-cot• 10 months ago

Their Adwords people seem to, occasionally.

At least when trying to drum up business from formerly-large accounts that have greatly reduced their spending.

arewethereyeta2• 10 months ago

every 6 months. They also rotate on you to have a reason for calling again, out of the blue

edu4rdshl• 10 months ago

And Google helped it happen No, it doesn't, you were just stupid. That field has always been modifiable.

Every action you did is what you hear multiple times every week about people falling in pishing, and you continued.

Finally, it was just some crypto shit so not a big deal.

p2detar• 10 months ago

On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

Apple's Mail.app also doesn't allow this and it's driving me nuts.

1970-01-013• 10 months ago

This is a great lesson on 2FA fundamentals. Picking time-based codes for 2FA is equal to picking something you know twice. That isn't strong 2FA. That is 1FA with an extra step (1.5FA). To make it all the way to 2.0FA, you must pick something you know (password) and a private key (Yubikey, smart card, etc.) that does operations in-situ, that cannot be computed anywhere else, to then match to an expected value on the server. It therefore isn't something you know twice. It is something you know + something you have uniquely generated.

beeflet12• 10 months ago

Strong 2FA is holding your cryptocurrency in a multisignature setup instead of an exchange that holds your keys for you and can disregard the 2FA whenever it wants.

The security bottleneck is the one institution that holds all of the responsibility. It cannot be fixed by giving more hoops to authenticate themselves to the one institution

1970-01-013• 10 months ago

3rd/4th party trust and has little to do with auth

jader201• 10 months ago

Why do people still answer phone calls from unrecognized numbers? Just don’t. If it’s actually someone that needs to reach you, they can leave a VM.

But 99.99% of the time, phone calls from unrecognized numbers are spam/scams.

pglevy• 10 months ago

I answered.

I never answer the phone.

Workaccount2• 10 months ago

On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

The most infuriating part of the story by far.

mbesto• 10 months ago

The first reason I knew this wasn't real is that Google doesn't have support...lol

YuukiRey• 10 months ago

The email has some obvious spelling issues. Not exactly a masterfully executed attack.

ratorx4• 10 months ago

I’m struggling to understand the chain of events, because the story starts midway. Is the claim that JUST the 2FA code was enough to pwn everything with no other vulnerabilities? If that’s the case, then that’s a way bigger problem.

Or (given the password database link at the end), is the sequence:

1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then password reuse?)

2) attacker has access to password

3) attacker phishes 2FA code for Google

4) attacker gains access to Google account

5) attacker gains access to Google authenticator 2FA codes

6) attacker gains access to stored passwords? (Maybe)

7) attacker gains the 2nd factor (and possible the first one, via the chrome password manager?) to a bunch of different accounts. Alternatively, more password reuse?

I guess the key question for me, was there password reuse and what was the extent, or did this not require that?

Disclaimer: work at Google, not related to security, opinions my own.

pluc2• 10 months ago

Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.

ratorx4• 10 months ago

But if you get access to the inbox, then you have a compromised device or the password via some other means right?

Inbox access is a fairly big compromise, even without the 2FA codes.

davidscoville10• 10 months ago

I think the attacker had my password, and they just needed a recovery method, which was the code I read over the phone.

I have no idea how they had my password, I never share passwords or use the same password. But I hadn’t changed my Google password in a while.

ratorx4• 10 months ago

Gotcha, thanks for clarifying!

And did you have passwords using chrome password manager as well (which were also compromised by the Google account access, and this is how they got access to e.g. Coinbase?), or did they get passwords through some other means and just needed 2FA?

lokar2• 10 months ago

Did you reuse that password on another site?

I don’t see how this happens if you use strong passwords without reuse.

cpncrunch7• 10 months ago

No, if they had had the password they wouldn't have needed to do all of that. They could have just logged in, perhaps just needed the 2FA code. However, you say that you gave them both enhanced security codes (I'm guessing this was a gmail backup key), and you also gave them the 2FA SMS code. These are the only two things you need to take over any gmail account, and it doesn't require knowing the password. It's just purely social engineering.

The only question mark is the email from google. It sounds like it was a scam email, so it would be interesting to know whether/how it was spoofed.

spapas82• 10 months ago

My two cents: 1. When somebody communicates with you and tells you it's urgent it's usually scam. They are trying to make you do stuff because of the urgency and so scam communication will always be urgent. Here in Greece one of the most common scams is to call older people and tell them that "your son has had a car accident and we need 5000 euros right now to operate on him, bring the money in a bag"

2. (More general) When a person initiates a communication with you it is for his benefit, not yours. If it was for your benefit then you'd initiated the communication to benefit from it. This is not only about scam but also about selling stuff or answering to polls or whatever. Be always sceptical when somebody you don't know contacts you.

arewethereyeta2• 10 months ago

Greece is 20 years behind Romania with that scam

carodgers2• 10 months ago

I don't understand. What combination of actions and app features allowed the scammer to send an email that is indicated to be from google's domain?

davidscoville10• 10 months ago

That's the big question. I've heard attackers have used Google's own tools like Google forms or Google cloud to send the email through Google's servers so it wasn't flagged. This is a major vulnerability that Google needs to fix. I'm quitting Google because I'm worried about other vulnerabilities like this.

Empact• 10 months ago

My mantra: trust no inbound communications. If something is in fact urgent, it can be confirmed by reaching out, rather than accepting an inbound call, to a number publicly listed and well known as representative of the company.

These scams will only get better, they will impersonate your loved ones, your best friends, your children, and plead with you to save them by handing over money or information, but it will all be a ruse. The only things that can prevent this outcome are: positive ironclad proof of identity / personhood / company representation, or ongoing rejection of belief in inbound communications.

lo_zamoyski4• 10 months ago

I used to think sophistication was the game, but when I brought up the obviousness of Nigerian prince scams with someone, I was told that the poor quality is a tactic. That is, these scams use scale, so the idea is that mediocre scams will weed those people out who are able to discern the scam and select for those who are easily manipulated. This increases the chances that you'll be able to scam the person.

karakot2• 10 months ago

https://www.microsoft.com/en-us/research/wp-content/uploads/...

``` By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor. ```

pmarreck3• 10 months ago

Someone keeps trying to hack into my main Google account (I keep getting 2FA requests), which unfortunately was part of some early crypto activity and was traced back to me, and I don’t know what to do.

I myself can keep denying them but I have a toddler and if he accidentally accepts one of them, I’m screwed.

And since it’s impossible to reach anyone at Google, WTF do I do?

winterqt• 10 months ago

Is changing your password to at least stop {some of, all} the 2FA requests not helping?

pmarreck3• 10 months ago

It’s account recovery, not 2FA, my bad

lavezzi2• 10 months ago

2FA or account recovery? I keep getting account recovery requests and it's pissing me off.

pmarreck3• 10 months ago

Account recovery, my bad

dlenski• 10 months ago

This is indeed a sophisticated and alarming attack, but…

the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.

Live by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency, die by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency.

Google enabled Authenticator cloud sync by default.

Adding that to the list of reasons I use FreeOTP instead (https://f-droid.org/en/packages/org.fedorahosted.freeotp)

renewiltord• 10 months ago

I get these inbound communications all the time and many banks actually use them to communicate with you. Each time, I have always sheepishly said "This is kind of how people get scammed right. Do you mind setting it up so that if I call back the account exec will know what to do? It's just I'd feel foolish if I got scammed this way" and then I end up calling back and with a little work get where I wanted.

I think the reality is that people think "Oh couldn't be me and am I going to be the weird security guy" so it isn't whether you know software and security etc. that determines it. It's whether you're willing to be embarrassed frequently in these conversations.

I've had the banks call me, Coinbase scammers call me, all sorts. I'm at the point where I block my own area code (which is from a different state where I have a few people whitelisted fortunately) and that's eliminated a lot of it.

I don't mean I can't be scammed. Just that perhaps some mitigation comes from willing to be socially awkward and insisting to someone that you want to do it by the book.

dismalaf• 10 months ago

The first clue should have been that you were talking to someone from a company notorious for not using real humans for customer support...

UltraSane7• 10 months ago

This is why I don't like cloud syncing OTP secrets. The hassle of migrating them is proportional to their security. They should only exist on one or more phones/watches/computers and on paper backups.

UltraSane7• 10 months ago

I was considering adding a page to my personal web page where people could add phone numbers for me to whitelist. I have been getting 5 to 15 spam calls a day recently so I essentially have to whitelist.

tiagobraw• 10 months ago

just realized google auth cloud sync was enabled in my device even though Ive never explicitly enabled…

so thanks for the advice!

stevage• 10 months ago

I'm pretty shocked that Gmail will deliver mail that claims to be from @google.com . Is that really what happened?

dankwizard• 10 months ago

I bet the fact it is omitted and "lost", it was probably something like g00gle or googIe.

rslashuser• 10 months ago

I'm super curious how this hack worked, but I feel like the story is just about the last step. What did the attacker have such that this last step did it?

My guess is that the attacker had the google password, and also the login for Coinbase was somehow stored in Google, so the attacker getting into google also exposed Coinbase. I just looked at Coinbase, and it does have a "Sign In With Google" feature.

If you want to live the stripped-down TOTP lifestyle, you have to love this 20 line Python solution. Does not depend on weird libs, and the last edit is 4 years ago. Write the seed on a Post-It and you're all set. Not so convenient, but sound sleeping! https://github.com/susam/mintotp

cpncrunch7• 10 months ago

It would be helpful to see the relevant headers to understand how it was spoofed, and if it would have been obvious from looking at the headers.

jrflowers• 10 months ago

Out of curiosity, does anyone know if there is any scenario where Google would legitimately call you? I assume the answer is no, but it would be interesting if some extreme edge case existed.

Edit: Obviously not “you work at Google and your boss calls you” or whatever

sublinear• 10 months ago

On June 19th, my life changed with a phone call. I was doing yard work when my phone rang. The number showed up as Pacifica, CA — (650) 451-5708. I answered.

I'm not trying to undermine the idea behind this article, but I was raised to never answer the phone and that was in the 90s

Joel_Mckay• 10 months ago

Spoofing email and phone caller ID is actually really common these days, but line-tapping is also active in some places.

Call the persons extension back from an out-of-band line, but after checking the contact phone number on the old web page or government business registry.

This is effective against most forms of line tampering, as targeting an unknown random line number is much more difficult to predict.

Most nuisance calls we get are the classic foreign operator message repurposed language translations trying to get people to "press 1 if you like ice cream" which bills 3rd party long distance calls. There was a local dubious calling card scammer arrested twice for this con. Just hang up, and report/block the number =3

LeonM2• 10 months ago

My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google.

I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google legitimately. By reading back the code in that email, the attacker was able to claim the Google account as theirs, thus access the Gmail inbox to reset the Coinbase password and access the authenticator backups from the Google Drive.

I would be very curious to see the original message headers of the email though.

furyofantares2• 10 months ago

Yeah, that part doesn't add up. If the email was sent by the attacker, why did it have a code he needed to give the attacker?

wmf6• 10 months ago

I think the attacker asked him to read an SMS code.

davidscoville10• 10 months ago

Yes, at least two emails. One was the spoofed email from legal@google.com (which sadly convinced me this was legit) and the other was a Google recovery code email.

The spoofed email was deleted by the attacker, but I have a copy because I forwarded the email to phishing@google.com (something ChatGPT told me to do). The attacker then deleted the original but when I got my account back an hour later, Google bounced back the email. So that is the copy I have and the headers are not super helpful.

Beijinger2• 10 months ago

"reset the Coinbase"

You must be insane to use gmail for anything like banking, crypto, domains.

I lost access to my gmail account. I know the PW but I can't access the 2 factor authentication anymore.

kevin_thibedeau5• 10 months ago

This is why 2FA isn't all it's cracked up to be. Strong passwords kept in your head are less brittle than managing something you can lose. If you have a real support channel (like employer IT) to deal with loss it's workable. Online services with no support is just asking for trouble.

digianarchist2• 10 months ago

1password + hardware keys - I am not a large target though and use crypto transactionally.

nixosbestos5• 10 months ago

I'd certainly be insane to take security advice from people who don't use password managers

freeplay• 10 months ago

I don't think that email he posted from legal@google.com is legit.

Look at the first sentence of the first paragraph and the first sentence in the second paragraph. Two grammar errors which are a dead giveaway it's fraudulent.

Thank you for your assistance and understanding during your recent support call, regarding a ficticious request aimed at accessing your Google account.

Comma doesn't belong there and "fictitious" is misspelled.

To follow all guidelines of the internal review properly. Please keep a secure note with the temporary password which your support representative has provided to you.

Out of place period. Should be a comma.

Legit, canned emails like this (especially from legal@google.com) would be proofread much better than this. It's fake.

monkpit• 10 months ago

I was doing yard work when my phone rang. The number showed up as Pacifica, CA — (650) 451-5708. I answered.

Ah yes, and all millennials are immune to the attack in one fell swoop.

kaiokendev• 10 months ago

I was targeted by this exact same attack several months ago. It sounded incredibly real, the emails looked legit, down the domains, Google even has a process for this exact scenario. The only thing that tipped me off is that they sent a login request to my phone. Nothing about the login request seemed off- it even originated from a Mountain View IP. But it was the fact they had sent me a login request which prompted me to drill the voice on why they needed a login request instead of some other form of verification. The disembodied voice soon became agitated and eventually told me that I should expect to lose access to my Google account soon since I hadn't complied with their request.

It was only after I checked Twitter that I saw Garry Tan's callout of the exact same scam. After experiencing it myself, I wouldn't fault anyone who fell for it. The only other tip-off was that the voice was pretty monotone and unemotional, but that only appears obvious in hindsight, not in the moment where you're slightly panicking that someone might be trying to claim access to your account.

lavezzi2• 10 months ago

Lucky for you Coinbase have set up a fund for people who got scammed through social engineering attacks due to their recent security fuckup.

Regardless of whether you received an email from Coinbase notifying that you were affected, the attack they suffered is much larger than they let on to the SEC.

https://www.coinbase.com/blog/protecting-our-customers-stand...

jbrooks84• 10 months ago

Do not answer unknown numbers ever. I repeat ever.

neya• 10 months ago

On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

This should be the real highlight of the issue here. I always check headers on my Samsung whenever I feel suspicious.

cannolicannon• 10 months ago

This sounds like a classic account recovery scam where the scammer uses Google's account recovery feature to gain access to the account. Once they have the 2FA code, they're in. This time the scammer used an account takeover as the pretense for needing the code.

As for the email, this blog post ( https://sammitrovic.com/infosec/gmail-account-takeover-super... ) from about a year ago notes that somehow scammers were/are using Salesforce to spoof emails from Google that appear legitimate. Seems like something similar happened here, but there's no way to be sure without the headers which the scammer seemingly cleaned up.

The FTC reported that scam losses totaled 12.5 billion last year. These scams are elaborate and convincing even for folks who make a living in tech. ( https://www.ftc.gov/news-events/news/press-releases/2025/03/... )

At any rate, sorry this happened OP. Stay safe, folks.

sgammon3• 10 months ago

why were you synchronizing your 2fa codes? that requires opt in, even in the form of a signed in google account combined with google authenticator as a choice of 2FA code storage

why were your coins not in a cold wallet? that is how you stop this permanently

why did you acknowledge any kind of inbound communication? ignore it. always. or call outbound to a confirmed number to make sure.

btw you were scammed out of $80k, as you admit in your article, the headline is misleading for seemingly no reason except the larger number

sgammon3• 10 months ago

an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator.

it is still a second factor, because it is something you have instead of something you know; it's just that you converted it to something you know when you read it and transmitted it to someone else

all that being said, yeah, legal@google.com (as a homograph attack) should probably be blocked.

sgammon3• 10 months ago

convenience is nearly always a tradeoff with security

blactuary3• 10 months ago

He posted about it on Twitter and the replies are full of those "this company helped me get my funds back" scammers, hilarious

duxup• 10 months ago

Even HN has a few of those guys who just don't stop posting, they're banned so no harm, but man they keep at it.

pdonis4• 10 months ago

I don't answer calls from numbers I don't know, period. (In fact I routinely have my phone in Do Not Disturb mode so only a few numbers, the ones I have in my favorites, will make the phone ring at all.) If it's urgent enough to the caller (either because they're legit or because they're a scammer and are trying particularly hard), they'll leave a voice mail. (I've had plenty of fraudulent voice mails.) If they claim to be from some company I have a relationship with, I check independently to see if something's up. This incident illustrates why, even if it seems like a call is legit, if you didn't initiate the call, you shouldn't even be talking.

I also don't leave any information I'm worried about someone stealing in my Google account. I find it hard to understand how anyone in tech could fail to see how risky that is.

fsckboy2• 10 months ago

I understand the dangers of answering scam calls, don't explain it to me

but you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number. maybe they don't, you may know that, but I sure don't.

apsurd• 10 months ago

ignorance is not a defense.

It's true, unknown calls are 99% spam. That's on you if you'd want to believe otherwise; by your own admission, you don't know.

Yes, important companies you do business with you will come to store those in your contacts. You'll have specific account reps even. Services, apps, don't call you, for this very reason, they have in-app confirmation flows.

torton• 10 months ago

They can leave a voicemail.

joe_the_user3• 10 months ago

I don't think security at most bank will ever call you about a transaction. At best they may text you. But if you get some communication there's a problem, if you talk to someone, you should call the official number rather than someone who calls you.

pdonis4• 10 months ago

you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number

I'm assuming no such thing. I have indeed gotten calls and texts from my bank and my credit card companies alerting me to fraudulent transactions, that were legit calls and not scams.

But I didn't answer those calls or texts directly, or try to figure out whether the number that was calling me or texting me was the right one. What I did was to call a number that I already know, independently, leads to my bank, or to my credit card company's fraud department. Or I independently logged into the bank's or credit card company's website to see if there were any alerts. And if there were, I acted on them.

I described this in my earlier post: "If they claim to be from some company I have a relationship with, I check independently to see if something's up."

spixy• 10 months ago

Bank or government use to call me about important stuff (when I messed up tax report, because of my mortgage, etc.), so not answering is not always a good idea.

And nobody use voice mail in EU, it seems to be an US thing.

pdonis4• 10 months ago

not answering is not always a good idea.

Sure it is. Just because you get a call about an issue that turns out to be legit, doesn't mean you need to resolve that issue by answering the call.

I describe upthread what I've done when I've received calls or texts from my bank or credit card companies about issues.

anigbrowl• 10 months ago

Change your passwords today. Don’t wait. 16 billion passwords have leaked recently, and yours is probably among them.

Never share a verification code. Scammers use urgency and fear (“you must resolve this in the next hour”) to get you to act.

Based on the second warning, I've decided not to trust the first.

endgame• 10 months ago

This is the world we're building for everyone, if passkeys + attestation get baked in everywhere and the bigtechs hold everyone's authentication keys.

sjy• 10 months ago

I'd complain to Google about this, maybe through a lawyer if needed to get them to take it seriously. They won't accept full responsibility, and in general people need to be aware of the risk of spoofed email, but Google should be able to stop fake emails from google.com from appearing in a Gmail inbox. You'd think they would also have the ability to recover an email deleted immediately after an account takeover, or at least work out how the spoofed email was delivered from other internal logs. Google should investigate whether their negligence contributed to the success of this attack.

eviks3• 10 months ago

The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

How is this basic fail still possible?

rkj93• 10 months ago

If you have not done it yet, file a case with the FBI

mensetmanusman• 10 months ago

Is it an advantage of crypto that someone can rob you with no recourse?

pea• 10 months ago

I got a nasty one of these recently. Attacker had my wife’s CC, and made purchases they knew would flag our bank and look sus and pop up on the app. Then I get a call from my “bank”, correct number, I ask them to verify and they say look at the number. All they ask for is the customer support code in my banking app to cancel to fraudulent transactions. At that moment I insist on calling back and they hang up, but I was very close.

giveita• 10 months ago

Coinbase not doing MFA? That makes them the other kind of MFA.

But yeah tel tell with Google is if someone from Google calls you then you know it is a scam by the fact that Google called you. Google doesnt give a fuck about you. Even if you spend millions on ads.

jimt1234• 10 months ago

There needs to be a standard way for customers to authenticate employees representing companies, sorta like a reverse-text-message-code. Maybe, as a customer of a website, I can login to the site (authenticate myself), then generate a code that only myself and someone inside the company can see. Then, I can ask him to read the code back to me so I know he's legit. Does that already exist? I've never heard of it.

joe_the_user3• 10 months ago

It seems unfair, yeah.

But the main way to know is that companies never call you these days. No company should have and few do have a workflow where an employee will call you "cold" with a problem. Instead, companies email, snail mail or text about a problem and you call them back.

But if someone somehow sounds legit, you ask for the official number and whatever info is need to identify your supposed problem. Then go to the website and verify. Call the number at the website (that you find from your own search, not the caller's info) and then have them verify you.

tacker2000• 10 months ago

2 weeks ago, I got these SMS messages via the official Bitpanda SMS number (the one that sends you the 2FA normally):

——-

Your sign-in code was successfully reset. If this wasn't you, contact us immediately on +43 1 3950657516

Reference: FPQ92

——

And this one

——-

You signed in from a new device in Beijing (China) through a Ledger Live API. If this is NOT you, call us on +43 1 3950657516

Reference: FPQ92

—-

Looks completely legit and I was really spooked at first. I can see how people fall for this stuff.

joe_the_user3• 10 months ago

The scary thing is that the only filter people have now is "workflow". If someone calls you, you can't tell who they are but if you call them, from a number you find one the official website (that you find rather than someone telling you), then they're likely legitimate.

But that's hard because many people work on markers of legitimacy, not algorithms.

1f60c• 10 months ago

There are some weird things (like the fact that Google doesn't tend to call the owners of consumer-level accounts and the fact that the email is phrased very oddly), but wow.

I wonder, though, did "Norman" just guess you had tens of thousands in crypto lying around, or was this step two of a phishing attack?

nottorp• 10 months ago

Holy Ahriman. Google does not call you.

Any call from Google is a scam.

mvdtnz2• 10 months ago

If you're gullible enough to "invest" in cryptocurrency you're certainly gullible enough to send your 2fa codes to a scammer.

john_the_writer5• 10 months ago

I've had a few calls where they are from legit places (I confirmed later) and they ask me verify my identify. I counter, that they need to verify who they are. They were confused and we couldn't go forward, because I wouldn't answer their questions until they answered my question.

franciscojs• 10 months ago

TLDR: You should NEVER sync your Authenticator 2FA codes with a Google account.

pipes• 10 months ago

Can someone explain how reading the code from the spoofed email compromised his account?

thayne• 10 months ago

I've noticed a lot more phishing emails making it through gmails filters recently.

A lot of them ultimately (if carefully inspected) come from @gmail.com addresses. And many of them look pretty convincing.

Did gmail change something for the worse, or have phishers found a new way to circumvent Google's spam filters?

everybodyknows3• 10 months ago

The attacker spoofed the “From” field ... On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

Is this a victory of Google's UI designer's quest for a "clean look", over basic security essentials?

more_corn• 10 months ago

They reached out to you. Created a sense of urgency.

Let this be a lesson to everyone who hasn’t been scammed yet.

pjdemers• 10 months ago

I get 5 calls and texts a day about my Google and Coinbase accounts. So many that if either Google or Coinbase really did try to contact me, I wouldn't see it.

chemodax• 10 months ago

I think there is relatively cheap way to reduce such scams: make it mandatory for banks etc to perform “training” of the clients. Regularly make a call to clients asking for sensitive data. Then block account if client provides this data.

account42• 10 months ago

Isn't the bigger issue here that you didn't actually have 2FA and your Google account (which receives recovery mails and syncs "2FA" tokens) was the only thing required to access your Coinbase account?

shemar123• 10 months ago

Subject: How I Recovered My Stolen Funds After a Crypto Scam.

Hello everyone I'm here to share my experience so others can avoid what I went through. A few months ago, I lost my entire life savings to an online group who posed as cryptocurrency investors. They were convincing and professional, and I only realized it was a scam after I have invested a lot of funds and when I tried to withdraw my money they disappeared.

I felt devastated, but I reported the crime to my bank and local authorities right away. After researching reputable resources, I eventually found a licensed financial-fraud recovery service that works with law enforcement. They helped me trace the transactions and recover a portion of my stolen funds. it gave me hope and some justice. If you've ever find yourself in a similar situation, kindly contact them in their email below: easytouchcryptocurrencyrecover@gmail.com

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

Related Stories