Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

511–520 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#511

Post by trog »

beeflet wrote: post #360
3D30497420 wrote: post #85

Earlier quoted context omitted.

This is one of the main reasons I don't like crypto. If you get hacked, even if you did everything right, then you're out of luck. The funds are (generally) unrecoverable. With my bank, I've been able to recover several thousand after a thief was able to bypass the 2FA app used to verify large transfers. (I still don't know how they were able to bypass the verification, and after investigating our bank never told us.…

If you got hacked, you didn't do everything right

This is elitist nonsense. Maybe this user didn't do everything right but people are hacked regularly through zero fault of their own.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#512

Post by intrasight »

rapind wrote: post #478
II2II wrote: post #469

Earlier quoted context omitted.

I have the fun of making outbound calls to offer people a public service and collect payment if people desire it. Most people gladly hand over their credit card details. A few years ago, someone wisely asked why they should trust me. (It only happened once in a decade!) I said they don't have to. They could look up our phone number at an easily verifiable government website, then call back; they could call any facili…

I don’t trust anyone calling me who isn’t already in my contacts. Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number. Now try and convince your family to do the same (especially parents who are prime targets).

I've not once had a legitimate company not say "good for you in taking the extra security precaution of calling us back".

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#513

Post by kevin_thibedeau »

Beijinger wrote: post #473
LeonM wrote: post #439

My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google. I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google l…

"reset the Coinbase" You must be insane to use gmail for anything like banking, crypto, domains. I lost access to my gmail account. I know the PW but I can't access the 2 factor authentication anymore.

This is why 2FA isn't all it's cracked up to be. Strong passwords kept in your head are less brittle than managing something you can lose. If you have a real support channel (like employer IT) to deal with loss it's workable. Online services with no support is just asking for trouble.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#514

Post by rapind »

benmanns wrote: post #489
rapind wrote: post #478

Earlier quoted context omitted.

I don’t trust anyone calling me who isn’t already in my contacts. Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number. Now try and convince your family to do the same (especially parents who are prime targets).

The trouble is, you have to place the outbound call to those contacts to trust them. People could spoof an incoming call from numbers in your contacts and it will look as legitimate to you as a receiver as if the real number was calling you. With voice spoofing, it's now possible to call someone as [grandchild] with [grandchild]'s voice with a pretty horrible story about what's going to happen if some Bitcoin or Goog…

I'll give you an example. When the Bank calls me about something important, I tell them to give me their department / extension and I'll call them back. I then look up the bank's phone number on their website (it's actually in my phone already, and on my bank cards) and call them back.

This process doesn't care about them calling from a spoofed number. We've had big problems with spoofed number scams and the CRA (Canadian version of the IRS) recently.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#516

Post by kevin_thibedeau »

ww520 wrote: post #490
apparent wrote: post #334

Earlier quoted context omitted.

I've gotten calls from my bank before, where they tried to get me to authenticate after I answered the phone. I said "look, you called me, I'd be crazy to just answer the phone and give out personal info." They refused to provide any info that I could have used to validate that they were legit (like telling me something about my account number, when my account was created, etc.). They said I had to authenticate with…

It happened with Schwab. I've enabled option trading in one of my accounts and got a call from Schwab, asking to authenticate me. I told them I couldn't trust it's a legit call; give me a number and case number and I'd call back.

It gets fun being on a 3-way call with bank M, talking to a Schwab rep for verification and trying to explain why Schwab uses a Chase account number.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#517

Post by apsurd »

fsckboy wrote: post #494
pdonis wrote: post #491

I don't answer calls from numbers I don't know, period. (In fact I routinely have my phone in Do Not Disturb mode so only a few numbers, the ones I have in my favorites, will make the phone ring at all.) If it's urgent enough to the caller (either because they're legit or because they're a scammer and are trying particularly hard), they'll leave a voice mail. (I've had plenty of fraudulent voice mails.) If they claim…

I understand the dangers of answering scam calls, don't explain it to me but you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number. maybe they don't, you may know that, but I sure don't.

ignorance is not a defense.

It's true, unknown calls are 99% spam. That's on you if you'd want to believe otherwise; by your own admission, you don't know.

Yes, important companies you do business with you will come to store those in your contacts. You'll have specific account reps even. Services, apps, don't call you, for this very reason, they have in-app confirmation flows.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#518

Post by layman51 »

traceroute66 wrote: post #18
fkyoureadthedoc wrote: post #8

oof that sucks. Luckily I'll never answer the phone

> Luckily I'll never answer the phone One of the best features of Apple iOS 26 is the new call-screening feature[1]. [1] https://support.apple.com/en-gb/guide/iphone/iphe4b3f7823/io...

Would this actually work if it's more of a targeted attack? It seems like not, because they could just kind of lie to your call-screener.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#519

Post by nebezb »

mmmlinux wrote: post #86
zamadatix wrote: post #81

Earlier quoted context omitted.

Would (the actual) Amazon even agree to provide this kind of information over the phone to someone?

is talking to amazon on the phone at all even actually possible?

Yes, and it’s the best way to get support too! They’re real helpful.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#520

Post by layman51 »

fkskammerz wrote: post #46
atallahw wrote: post #5

What did the account did the email actually come from? Was it legit from legal and he just submitted the request or was it a real spoofing

It was not legit from legal, I had the same attack on me two weeks ago. They were pretending to be from Google General Counsel responding to an estate request to my Google account being handed to another party who was supposedly the inheritor. What clued me in was that he said he couldnt share the estate documents with me until I gave him my popup 2FA code.

Were there any further login attempts that they tried to do to access your Google Account? It almost seems like the attack being described in the article is very sophisticated that the attackers aren't just contacting random people but might have certain people in their radar.
Post reply on HN