Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

181–190 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#181

Post by aqme28 »

ajross wrote: post #136
ghurtado wrote: post #113

Earlier quoted context omitted.

> Criminals can just hold a gun to your head and demand your keys. Sure, but this is Hacker News, not Mugger News.

You miss the point. You can't mug someone for their Vanguard account. Robbery risk is limited to cash on hand, or arguably whatever the ATM limit is on your bank account.

People do get taken hostage until they give up their crypto accounts sometimes. There was a prominent one in NYC recently that was on the news again due to--basically-- the alleged involvement by one of the stars of a popular reality tv show.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#182

Post by joshuamorton »

____tom____ wrote: post #163

> Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator. So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth. Example: If you log in from a Macbook, and the second auth is sent to your phone,…

Two factor usually means "something you have + something you know". So your MacBook + your password is two factors.

I've seen references to "three factor" auth which is often a push notification to a phone, and then there's more secure second factors, like yubikeys or code-protected passkeys.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#183

Post by UncleMeat »

____tom____ wrote: post #163

> Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator. So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth. Example: If you log in from a Macbook, and the second auth is sent to your phone,…

There’s threats and there are threats. Second factors largely exist to prevent password stuffing from password reuse. Even if the second factor is the same device as the device where you are initiating a login this works just fine.

If your goal is to stay safe even after one of your devices is owned then you’ve got a rarer (and way more difficult) threat model.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#184

Post by PaulHoule »

____tom____ wrote: post #163

> Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator. So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth. Example: If you log in from a Macbook, and the second auth is sent to your phone,…

It doesn’t work because people don’t understand it. They understand they are getting harassed all the time and in a state of terror because you might get locked out from your accounts because you lost a device or because something went wrong with your relationship with Apple, Google, Microsoft and other large unaccountable vendors —- something you may or may not get an explanation of.

Since you’re getting harassed all the time and dealing with opaque rules it is no wonder people are fatigued, make mistakes, are inclined to panic when they get a scary call and hand over the keys, etc.

To add to that, having anything to do with crypto is to put a big target on your back and make yourself vulnerable.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#185

Post by pc86 »

barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

> I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.

The answer is almost certainly greater than 0.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#186

Post by Loughla »

sroussey wrote: post #126

A few reminders bear repeating: — no support group from a big company is going to call you. Ever. — never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that! — Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party…

Google business support called me to close the loop on an issue I had with a business listing. It was from a very busy and loud call center, and was made by someone with a heavy accent.

It's like they want us to get scammed?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#187

Post by adrr »

bdangubic wrote: post #51
QuadmasterXLII wrote: post #12

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

the banks don’t give two shits about it :)

Banks do care because they are on the hook. If someone commits identity theft and steals money from the bank via your account, its on them.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#188

Post by jasode »

sroussey wrote: post #130
gpt5 wrote: post #129

Earlier quoted context omitted.

> never give out codes sent to use via sms or push notifications to someone requesting them via phone Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).

I’ve personally never had that happen. It should go on a name and shame list.

>I’ve personally never had that happen. It should go on a name and shame list

The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center.

For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card.

That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#189

Post by petcat »

QuadmasterXLII wrote: post #73
QuadmasterXLII wrote: post #12

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

What I specifically mean by "care literally at all" : banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions. This creates sane, linear incentives: banks care 1000x more about a $100,000 fraud than a $100 fraud; they care 1000x more about a scam affecting 100 people than a scam affecting one person, etc. Unrelated, but for added spice, here's a thread from ten m…

> banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions

In USA, banks are actually required by law to reimburse fraudulent account activity if reported within 60 days. However, this does not cover cases where the account holder themselves made the transfers even if they were tricked into doing so.

But if someone gets your login and liquidates your bank account, in USA a least, the bank is 100% responsible for that fraud.

Credit card companies are 100% responsible for fraud regardless. Even if they try to market it as a perk "You're never responsible for unauthorized transactions". Yeah, no shit. It's the law.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#190

Post by jp191919 »

kerpal wrote: post #142

Use a password manager and use a SEPARATE second factor authenticator not tied to the password manager. I personally use Authy (though I think it's been deprecated) and Bitwarden. I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my t…

Absolutely. If you are looking for a new 2FA/TOTP app- Aegis is good, also Proton Authenticator as it's independent of a Proton account.
Post reply on HN