Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

311–320 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#311

Post by beeflet »

klik99 wrote: post #301

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…

> official phone number

Great idea unless the attacker has SS7 access.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#312

Post by jenadine »

nradov wrote: post #230
shocks wrote: post #62

Earlier quoted context omitted.

Incorrect. Author may not have had the required savings to rebuy the position he wanted.

The author can simply buy a "position" in Monopoly Money instead. It's just as useful as cryptocurrency, and as a bonus harder to steal!

But harder to resell for a multiple of the buying price later.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#314

Post by klik99 »

dec0dedab0de wrote: post #306
klik99 wrote: post #301

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…

Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.

Good to know.

The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#315

Post by teraflop »

neuronflux wrote: post #47
rwmj wrote: post #10

Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?

They probably sent it from gmail which would pass the SPF check (google.com and gmail.com have the same SPF). They wouldn't have it signed to pass DKIM, but google doesn't use strict alignment checking so to pass DMARC either SPF or DKIM are acceptable. ~ dig _dmarc.google.com txt +short "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com"

So any message from Gmail is treated as legitimate for google.com, and yet Gmail can't do its own checks on outgoing mail to ensure that unauthorized people don't put legal@google.com in the From: header? Seriously?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#316

Post by dec0dedab0de »

fxtentacle wrote: post #269
sroussey wrote: post #126

A few reminders bear repeating: — no support group from a big company is going to call you. Ever. — never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that! — Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party…

Except that a few weeks ago, I got a phone call - from a number with no results on Kagi search - claiming to be the online banking support of my bank - asking me to read them a code sent to me via SMS and when I refused to do that, they blocked my login credentials for online banking and sent me a sternly worded (paper) letter that my account could not be upgraded automatically for their software system migration bec…

My old insurance company (Cigna) used to call me and demand information to verify it was me. I eventually figured out it was a thing to try to convince me into getting cheaper cancer treatment so they could save money.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#317

Post by edu4rdshl »

> And Google helped it happen No, it doesn't, you were just stupid. That field has always been modifiable.

Every action you did is what you hear multiple times every week about people falling in pishing, and you continued.

Finally, it was just some crypto shit so not a big deal.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#318

Post by klik99 »

beeflet wrote: post #311
klik99 wrote: post #301

Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good. The guy who called me said "I can send you an email to show it's official" and I thought of tha…

> official phone number Great idea unless the attacker has SS7 access.

Yeah, if you're a high profile target then you need extra layers of security, but for regular folks that one weird trick is enough to make you just enough of an annoyance to make another target preferred.

But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#319

Post by zoover2020 »

dist-epoch wrote: post #270
calmbell wrote: post #66

Earlier quoted context omitted.

And transferring money from a bank or brokerage account takes time. Enough time that anyone paying attention should be able to report the transfer as fraudulent before it completes and have the account frozen.

It depends. In UK a transfer is instant. In most of EU it happens the same day, many times in hours.

EU is mostly instant too,IBAN at least.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#320

Post by beeflet »

Legend2440 wrote: post #212
hvb2 wrote: post #152

Earlier quoted context omitted.

Aren't elderly phone scammed out of huge amounts from bank accounts often??

Yes, but it's more involved. They typically get the victim to withdraw the money themselves, then send it to the scammers via wire transfer. Like crypto, wire transfers are difficult to track and irreversible.

So what is stopping someone from holding a gun to your head and forcing you to conduct a wire transfer over the phone or internet?
Post reply on HN