Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

21–30 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#21

Post by alaithea »

throw_m239339 wrote: post #14
like_any_other wrote: post #4

> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment. Can somebody explain what exactly this means, and how it works?

It's my understanding that emails have headers, just like http responses, and the app might have displayed that fake header instead of verifying the provenance of the email and displaying where it actually came from. So it is a UI/UX issue.

Why email clients have started hiding/not providing access to headers is beyond me. It seems like an anti-pattern. There have been many times recently where I've wanted to check the headers because an email was suspicious, only to find I couldn't.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#24

Post by sequin »

How did they get the passwords to his Google and Coinbase accounts? He reused passwords? The same one for Google as for Coinbase? Or did they reset his Coinbase password via his Gmail? The post doesn't make this explicit, but it warns against password reuse.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#25

Post by matsemann »

like_any_other wrote: post #4

> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment. Can somebody explain what exactly this means, and how it works?

Dmarc/spf https://en.m.wikipedia.org/wiki/DMARC

Basically, the from field on an email can be anything you want. It's like sending physical mail and using a fake letterhead with someone else's info, just type what you want. No verification.

That's sometimes a good feature. Like, a third party provider can send newsletters on behalf of company A. But can also be bad, when used for phishing.

However, the email doesn't just appear in your mailbox. It comes to your email provider by another server connecting to it and sending the email. Spf allows the owner of A.com to specify which IPs/servers are actually acting on their behalf. So if I get an email from something@A.com, I can lookup and verify that the sending server is one to trust. If not, the email client should reject or warn the user somehow.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#26

Post by nsriv »

traceroute66 wrote: post #18
fkyoureadthedoc wrote: post #8

oof that sucks. Luckily I'll never answer the phone

> Luckily I'll never answer the phone One of the best features of Apple iOS 26 is the new call-screening feature[1]. [1] https://support.apple.com/en-gb/guide/iphone/iphe4b3f7823/io...

Pixel Call Screen has been a godsend for me since its debut, akin to using uBlock Origin for browsing.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#27

Post by arethuza »

barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

I usually don't answer calls from numbers I don't recognise - but a couple of days back it was a scammer claiming to be from Amazon - said I had ordered an iPhone for £600 and was it a real order.

I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was...

I must have stayed on the call for 20 minutes, eventually they ended up swearing at me - all the time I could hear other people in the same room trying the same lines on different people. I have no idea why I stayed on for so long....

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#28

Post by traceroute66 »

rwmj wrote: post #10

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

> Wouldn't the Apple account reject it because it fails DKIM/etc?

Yeah, I would be curious to see the actual email headers of what was received.

As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#29

Post by youngtaff »

fastest963 wrote: post #11
rwmj wrote: post #10

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).

From the article he uses gmail I think

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#30

Post by loloquwowndueo »

londons_explore wrote: post #6

[flagged]

No it wouldn’t have.

OP said the coin base account was drained within “minutes”. Server thief bait can take up to 24h to notify you when someone takes the bait.

> We'll put a tiny amount of cryptocurrency in a wallet, but probably still enough to attract the attention of automated scripts. We notify you when it's taken within 24 hours.

Post reply on HN