Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

11–20 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#11

Post by fastest963 »

rwmj wrote: post #10

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#12

Post by QuadmasterXLII »

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#13

Post by barbazoo »

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly.

I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.

> The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.

Ugh, google

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#14

Post by throw_m239339 »

like_any_other wrote: post #4

> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment. Can somebody explain what exactly this means, and how it works?

It's my understanding that emails have headers, just like http responses, and the app might have displayed that fake header instead of verifying the provenance of the email and displaying where it actually came from. So it is a UI/UX issue.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#15

Post by goda90 »

like_any_other wrote: post #4

> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment. Can somebody explain what exactly this means, and how it works?

No clue how it works functionally these days. But it reminds me of tricks we pulled back in high school programming class. Our school was using Novell NetWare, and some students were given email addresses for various purposes. We discovered you could edit the From field, so it would display any text as your name and then your email address after it to the recipient on Novell's email client. If you added enough text, including whitespace, it would push the actual email address off screen(I don't remember if you could scroll to it or not).

We trolled each other in class with it a bit. But at one point some student not in our class sent out a mass email, which was against the rules. I replied with a From line as "Administrator" and a bunch of whitespace, telling the girl that she broke the rule and would be suspended for it. Our teacher made me apologize, and I was lucky that I didn't get into more trouble beyond that.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#16

Post by fkskammerz »

Same exact scam happened to me three weeks ago and I almost fell for it. The guy was very sharp and sounded very authentic.

Ever since then I've been getting hundreds or thousands of Google notifications I've had to decline. Anyone know how people are able to send out hundreds of 2FA gmail notification popups without Google blocking this?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#17

Post by layman51 »

Can someone please explain to me what it means for authenticator codes to be “cloud-synced”? Is that solely dependent on whether you’re using the Google Authenticator app while signed in to your Google Account? Is it possible to not have them “cloud-synced” if you are signed in?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#18

Post by traceroute66 »

fkyoureadthedoc wrote: post #8

oof that sucks. Luckily I'll never answer the phone

> Luckily I'll never answer the phone

One of the best features of Apple iOS 26 is the new call-screening feature[1].

[1] https://support.apple.com/en-gb/guide/iphone/iphe4b3f7823/io...

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#20

Post by jazzyjackson »

layman51 wrote: post #17

Can someone please explain to me what it means for authenticator codes to be “cloud-synced”? Is that solely dependent on whether you’re using the Google Authenticator app while signed in to your Google Account? Is it possible to not have them “cloud-synced” if you are signed in?

Google Authenticator app defaults to backing up the TOTP secrets so if you log in on a new device you have them there. Pretty poor default for security, and you can disable it, but not the first time I've heard of this biting someone.
Post reply on HN