Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

151–160 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#151

Post by icedchai »

kerpal wrote: post #142

Use a password manager and use a SEPARATE second factor authenticator not tied to the password manager. I personally use Authy (though I think it's been deprecated) and Bitwarden. I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my t…

Same. I don't store my 2FA with my passwords. I also use Authy, I'd like to move to something else but as long as it's working. I was annoyed they got rid of the Mac app.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#152

Post by hvb2 »

ajross wrote: post #136
ghurtado wrote: post #113

Earlier quoted context omitted.

> Criminals can just hold a gun to your head and demand your keys. Sure, but this is Hacker News, not Mugger News.

You miss the point. You can't mug someone for their Vanguard account. Robbery risk is limited to cash on hand, or arguably whatever the ATM limit is on your bank account.

Aren't elderly phone scammed out of huge amounts from bank accounts often??

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#153

Post by Avamander »

neuronflux wrote: post #127
Avamander wrote: post #105

Earlier quoted context omitted.

Can't practically require both SPF and DKIM with DMARC anyways. Doing so would also be dumb as it would break forwarding (even when DKIM would otherwise remain intact). Deprecating SPF would do everyone a favour though. Especially for reasons like these.

SPF alignment ensures the MAIL FROM domain matches the From header. DKIM alignment ensures the From header matches the domain in the DKIM signature header. In the DMARC policy, you can set both adkim=s and aspf=s. Google owns and manages all of this, so they can send emails with a google.com MAIL FROM, a google.com header, and signed with a google.com DKIM key. And they could do likewise with gmail.com emails. I'm no…

DMARC specifies that SPF alignment is checked for the domain in the MIME From. The domains in SMTP and MIME From do not have to be the same (nor both align).

Your MTA can still check alignment for both HELO and SMTP From as specified by SPF's RFC(s) though and spam filters often do for extra information/signal.

DMARC's adkim/aspf aren't basically supported in practice. Nor they should be. For reasons already mentioned, as you already read.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#154

Post by ameliaquining »

thrill wrote: post #90
fn-mote wrote: post #82

Earlier quoted context omitted.

The difference is that you have leverage to force the banks to care. There isn't any federal regulation at all covering your Bitcoin.

Fraud is fraud. There’s plenty of laws against it.

The question is not whether it's legal to defraud someone, but what a financial services provider's obligations are if their customer gets defrauded. The answer here is quite different for banks and brokerages than for crypto exchanges.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#155

Post by ajross »

Something isn't adding up here. The author is excruciatingly rigorous with documenting lots of stuff here, including the screenshots. Then glosses over this bit awfully fast:

> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did

This was an account with authenticator enabled. I'm no expert, but I really don't think there's a recovery process that works as simply as "read back a code". Certainly not in the SMS 2FA sense I'm sure we're all expected to interpret.

Honestly it seems like the author is trying to blame Gmail's UI, when some other more involved phishing technique was actually the novel part here.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#156

Post by blindriver »

acdha wrote: post #102
blindriver wrote: post #98

Sorry but it’s stupid to blame Google when it’s 100% your fault. This is a scam that is 10+ years old and you fell for it in 2025. It’s not googles fault at all.

This is like saying it’s not Ford’s fault that they didn’t put in seatbelts and safety glass because people knew driving was unsafe. When bad outcomes happen at scale, you need a system-level fix. EDIT: to be clear, the fix has arrived: had he used passkeys, this attack would have been impossible and every login would’ve been faster and easier. There are edge cases but this is literally the reason why U2F was created…

The author knew that the scam existed and he even was skeptical. Then chose to rely on it being true despite all the red flags. That’s his fault.

At some point people have to accept responsibility for their own stupid actions.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#157

Post by craftkiller »

aj7 wrote: post #124
paleotrope wrote: post #49

Earlier quoted context omitted.

I have a 1-2 second rule. I pick up I say hello, if someone doesn't respond in 1-2 seconds, I hang up. They have the scammers working off phone queues, it takes a little bit of time to get the call to the scammer, who has to start off with a script, so there's a delay. Remember, the scammer, also likely not a native english speaker, also probably bored out of their mind, has to spin up, they have to read the name, un…

I use a variation of this. I answer but do not speak. A legitimate caller will speak immediately.

Not always true. My landlord recently had a contractor call me. I did my usual "pick up and don't say anything" routine for unrecognized numbers, and the contractor silently hung up and never called back. Thankfully my roommate actually answered the call, but pick-up-shut-up prevents legit people from leaving voicemails and sometimes prevents legit people from reaching you entirely.

Personally, I would utter a confused "hello?" if I was calling somone, the ringing stopped, and no one said anything, but I guess not everyone would.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#158

Post by kerpal »

icedchai wrote: post #151
kerpal wrote: post #142

Use a password manager and use a SEPARATE second factor authenticator not tied to the password manager. I personally use Authy (though I think it's been deprecated) and Bitwarden. I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my t…

Same. I don't store my 2FA with my passwords. I also use Authy, I'd like to move to something else but as long as it's working. I was annoyed they got rid of the Mac app.

Same, the desktop app worked great. Probably for the best though, ideally you want to pull your codes from a phone and password from your desktop device.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#159

Post by ameliaquining »

wmf wrote: post #121
acdha wrote: post #108

Earlier quoted context omitted.

Passkeys also solve this even if they’re not hardware backed. He was able to give them a code but wouldn’t have been able to do a passkey handshake for a domain which isn’t Google.com. Plus they’re easier to use and faster.

I don't know about that. If they can hack your Google/iCloud account they can add a new device, sync all your passkeys to that device, then log into all your other accounts.

But they can't hack your Google or iCloud account if it's secured with a passkey, unless they have some other non-phishing means of doing so, which the attacker in this story presumably did not.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#160

Post by janalsncm »

ajross wrote: post #136
ghurtado wrote: post #113

Earlier quoted context omitted.

> Criminals can just hold a gun to your head and demand your keys. Sure, but this is Hacker News, not Mugger News.

You miss the point. You can't mug someone for their Vanguard account. Robbery risk is limited to cash on hand, or arguably whatever the ATM limit is on your bank account.

Actual risk is lower than that since you’ll possibly get your money back from a real bank.
Post reply on HN