Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scammed out of $130K via fake Google call, spoofed Google email and auth sync

bewildered.substack.com

Post reply on HN
Print view View original

81–90 of 677 posts

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#81

Post by zamadatix »

arethuza wrote: post #27
barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

I usually don't answer calls from numbers I don't recognise - but a couple of days back it was a scammer claiming to be from Amazon - said I had ordered an iPhone for £600 and was it a real order. I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was... I must have stayed on the call for 20 minutes, event…

Would (the actual) Amazon even agree to provide this kind of information over the phone to someone?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#82

Post by fn-mote »

bdangubic wrote: post #51
QuadmasterXLII wrote: post #12

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

the banks don’t give two shits about it :)

The difference is that you have leverage to force the banks to care.

There isn't any federal regulation at all covering your Bitcoin.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#83

Post by atlanta90210 »

atm3ga wrote: post #77
barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

I've set my phone to not answer unknown callers (those not in my address list) and more importantly, I've done this for my parents as well and further instruct them as often as possible to not believe anything they get in email. With all of this, my mom still will reach out at least once or twice a year in a panic about some scam email she thinks is real.

If you have an iPhone, the latest iOS 26 will answer unknown numbers not in your address book for you and ask what they want and then alert you to see if you want to take the call.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#84

Post by zamadatix »

paleotrope wrote: post #49
barbazoo wrote: post #13

> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly. I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know. > The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-sy…

I have a 1-2 second rule. I pick up I say hello, if someone doesn't respond in 1-2 seconds, I hang up. They have the scammers working off phone queues, it takes a little bit of time to get the call to the scammer, who has to start off with a script, so there's a delay. Remember, the scammer, also likely not a native english speaker, also probably bored out of their mind, has to spin up, they have to read the name, un…

I try to avoid picking up and saying anything because it seems like an advertisement "yes, this number is not only active but a real person who answers random calls - try calling back (possibly from a different number) later".

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#85

Post by 3D30497420 »

QuadmasterXLII wrote: post #73
QuadmasterXLII wrote: post #12

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

What I specifically mean by "care literally at all" : banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions. This creates sane, linear incentives: banks care 1000x more about a $100,000 fraud than a $100 fraud; they care 1000x more about a scam affecting 100 people than a scam affecting one person, etc. Unrelated, but for added spice, here's a thread from ten m…

This is one of the main reasons I don't like crypto. If you get hacked, even if you did everything right, then you're out of luck. The funds are (generally) unrecoverable.

With my bank, I've been able to recover several thousand after a thief was able to bypass the 2FA app used to verify large transfers. (I still don't know how they were able to bypass the verification, and after investigating our bank never told us. Not sure that makes me feel all warm and fuzzy, but at least I was made whole with minimal fuss.)

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#86

Post by mmmlinux »

zamadatix wrote: post #81
arethuza wrote: post #27

Earlier quoted context omitted.

I usually don't answer calls from numbers I don't recognise - but a couple of days back it was a scammer claiming to be from Amazon - said I had ordered an iPhone for £600 and was it a real order. I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was... I must have stayed on the call for 20 minutes, event…

Would (the actual) Amazon even agree to provide this kind of information over the phone to someone?

is talking to amazon on the phone at all even actually possible?

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#88

Post by wcoenen »

Thanks for sharing. I already had it in the back of my mind that this cloud sync thing in Google Authenticator was not very secure. I'm getting rid of it right now.

I do see why Google did it; it's going to be difficult to educate users to always set up 2FA both on a primary and a backup device. Much easier and convenient to automatically sync different devices. But your story makes it obvious that something isn't quite right here.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#89

Post by thrill »

QuadmasterXLII wrote: post #73
QuadmasterXLII wrote: post #12

The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.

What I specifically mean by "care literally at all" : banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions. This creates sane, linear incentives: banks care 1000x more about a $100,000 fraud than a $100 fraud; they care 1000x more about a scam affecting 100 people than a scam affecting one person, etc. Unrelated, but for added spice, here's a thread from ten m…

In my actual real world experience of digging my elderly mother out of $25,000+ of scam debt, banks do not care at all unless they can be shown to be at fault, and then they weigh the loss expense vs the likely legal expense.

Re: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

#90

Post by thrill »

fn-mote wrote: post #82
bdangubic wrote: post #51

Earlier quoted context omitted.

the banks don’t give two shits about it :)

The difference is that you have leverage to force the banks to care. There isn't any federal regulation at all covering your Bitcoin.

Fraud is fraud. There’s plenty of laws against it.
Post reply on HN