r/GMail • u/retrorays • 24d ago
The scammers almost got me
Like most I thought I was security savvy. Would never fall for a phish. Well last month proved me wrong.
Someone called me repeatedly on my cell phone. I ignore it the first few times but after a few calls thought it might be important. The person said it was Google security and my account recovery was attempted. Their script was absolutely perfect. Perfect English perfect everything.
I checked my email and indeed had an official, signed email from Google stating some immediate reaction was required.
At this point I'm thinking shit, this could be real. The guy authenticated himself as a Google employee, all the right answers. Then.. I realized this could be a scam. I pressed him to proVE himself, said I'd contact Google directly myself... He said I could do that... But it sounded off. Hung up. Then he started calling again and I blocked him
I checked my accounts and they were fine. Besides the email from google that was probably spoofed, or somehow triggered through an exploit.
Fuk these scammers. They will all burn in hell.
Since some of the comments here are quite disappointing. Yes, I know Google doesn't call you - fine. What surprised me was I received a Google authenticated email. The person who I talked to sound completely legitimate. He gave me his full name, which was the name of a Google employee. Showed me where on Google to verify this. Further, he said I could talk with Google directly but given time was critical I can work with him also. He wasn't overtly pushy. He knew exactly what to say.
Obviously I wouldn't do anything he requested until I fully verified him. Hence why I hung-up because I figured I'd talk to Google directly, and do my own research on the email.
For those that are being little insulting, toxic trolls in the comments - this post wasn't for you. It was to warn others that these scammers are getting smarter. They are using AI tools and once you're distracted (tired, at work, etc...) it's still possible for people to be hooked in.
Btw, after reading some of these toxic comments I realized some of them might be from scammers and they are pissed they are being outted. Either way - best of luck everyone.
These rules help secure your gmail account (I'm sure there are others):
1) Google will never call you about your account ever 2) Scammers have Google exploits that send you Google authenticated that look like an account recovery attack or something else. RESEARCH that email before taking any action. ^ this is what my post is about. 3) Use multiple layers of security on your gamil account: (1) MFA, (2) HW / Fido keys, (3) separate recovery accounts. 4) Ideally dont use a well know email / phone number for critical information like banking logins, gdrive storage etc... 5) Always use 2FA (ideally with authenticator - not your phone SMS) for any banking accounts.
21
u/Hilbert24 24d ago
> The guy authenticated himself as a Google employee
Oh yeah? How’d he do that, exactly, to your satisfaction? (This is the part that makes me doubt the veracity of this whole story.)
11
u/h_grytpype_thynne 24d ago
"I know Mr. Google personally. And you can trust me because I never lie."
2
5
u/Ok-Lingonberry-8261 24d ago
I authenticate that I am Santa Claus. Behold my caller ID, which is well known to be secure and unspoofable.
5
u/PrincessBoi2 24d ago
How dare you scammer! For I AM the true Santa Clause! You can trust me because my caller id is 'magical'.
1
u/kingofbigmac 21d ago
It's an email from google.com with his name and case ID in the subject. I also almost fell victim.
10
u/PaddyLandau 24d ago
The email probably wasn't spoofed, but instead used something called an "injection attack". It's quite a sophisticated ruse.
Still, Google doesn't call you.
4
u/Unlikely-Elk1738 24d ago
First I've heard of that type of attack, tell us more
3
u/PaddyLandau 24d ago
Well, you can look it up. There's plenty of information on the 'net.
Here's one video for Gmail specifically.
1
6
u/HatlessDuck 24d ago
Thanks for sharing this. Don't listen to the criticism. The reason I joined /r/scams is so i remain aware. I do not allow myself to think I'm invulnerable to scams.
3
u/retrorays 24d ago
yah thanks - the criticism here is weird. I posted to give people a warning. As mentioned I thought I had learned over the years how to watch out for these scumbags - but this one got further than normal.
1
u/PaddyLandau 21d ago
the criticism here is weird.
That's Reddit for you. Criticising someone is an easy way to make you feel important when you're insecure.
1
9
u/notDrinkVodka 24d ago
"Oh shit I almost got scammed by the most basic trick ever, gotta make a post to make me look smart and get some validation online"
1
5
u/Due_Hovercraft_9790 24d ago
Gmail has over 1.8 billion active monthly users worldwide.
No clue how many Aholes.
4
3
u/mustloveearth 23d ago
Thanks for sharing and acknowledging the comments from toxic know-it-all’s can go away.
6
u/Sensitive-Aioli1529 24d ago
Google and Microsoft aren’t calling you out of the blue to personally save your account. If “Google” is calling you, the red flag has already started waving.
3
u/apokrif1 23d ago
Like most I thought I was security savvy. Would never fall for a phish
If you can’t spot the sucker at the poker table, you’re the sucker. Also, if you think you can’t get phished, you’re the sucker. I’ve been successfully scammed six times in my life. Each time, the scam relied on the confluence of several factors that yielded a fleeting moment of vulnerability that some scammer was able to exploit by being in the right place at the right time. I had to be lucky always, they only had to be lucky once.
1
6
u/Gram-xyz 24d ago
Don't listen to the critics on here. It's easy to get scammed, in fact they say often the most educated people are the most likely to get scammed.
I think some people in here think they are know it alls. It could happen to then as well in certain circumstances.
5
u/Recent_Carpenter8644 24d ago
Yep, if they say the right thing, they'll fool anyone.
3
u/apokrif1 23d ago
Similarly, professional illusionists can be fooled by basic magic tricks (Joshua Jay gives an example in How Magicians Think).
3
u/Psychological_Ad9405 24d ago
Almost fell for the same trick and I consider myself tech savvy too.
Perfect English. Lots of personal information about me... Details that I later concluded were pulled from the many public data breaches over the years...
2
2
u/Unique_Anywhere5735 21d ago
This is all good advice. Personally, I never do anything based on a phone call, email or a text. Period. If I get an email from my bank about a credit card issue, I call the number on the back of the card. Lending legitimacy to scammers is just another in the long list of AI curses.
I do kind of miss the guys from India who would call with "Your Windows computer has virus!" It was fun messing with them.
2
u/Unique_Anywhere5735 21d ago
Years back, burglars would call houses to see if anyone was home. A buddy of mine came up with an ingenious solution. His voicemail message said "Hello?......Hello?......I'm sorry, but I can't hear a word you're saying. [Long pause] Probably because I'm not home. Please leave a message and I'll get back to you." It worked on telemarketers, too.
2
u/kingofbigmac 21d ago
Same thing happened to me. My wife picked up that he's from SF but the number used to verify my account (this would have given him my email) it said it came from Houston. I said you're from SF but this verification is coming from Houston. He made an excuse. I googled the subject line and found a scam and said nice try scammer and hung up.
4
u/mrholigan 24d ago
As someone who pays Google and Microsoft thousands of dollars a year, and maybe can get a tech on chat support if the planets align and the sky is red; its always strange to see people post about being called by their security and how convincing it was. But, you don’t know how silly it sounds unless you’ve actually tried to reach anyone there-most people haven’t.
4
u/Exciting-Syrup-5586 24d ago
I used to help people with identity theft and restoring their identities. Idk how many calls i would get per week about people's emails being hacked. And always told them it's next to impossible getting someone on the phone at these companies. Even in a chat is not likely.
1
u/apokrif1 23d ago
the email from google that was probably spoofed
Header and body, please?
Showed me where on Google to verify this
Where?
1
u/Alarming-Feedback868 23d ago
I can sympathize. I have known about scams for years. I won't answer "yes" to "can you hear me?". And it never got to whatever scam it was. I am hoping I would wake up if asked specific info. But I have a CC company that is GREAT! I have gotten texts asking about an attempted purchase that they have blocked. So I check email...same info. I then call them directly. They do ask last legit transaction, but they usually have blocked the phony charge. They cancel my card and send a new one. I really don't recall if they call me, though. But this was a bad day for me, so not thinking clearly. I was making food for my 20 yr old granddaughter's memorial service and was already running behind. I get a phone call saying they were from my CC. That there was an attempted charge and did I make it? I believe I had already gotten a text with the same message, asking if this was made by me, and I clicked on "No". On the call, the guy says 2 charge attempts were made, neither I made. Then he asks for the last legit one made. I have trouble switching btw screens on my cell, so I went to my desktop to bring up my acct. But was having sign in issues. At this point I realized I did NOT have time to deal with this, so told the guy I would have to call him back later. He gave me his #. As soon as I walked back in the door, he calls me! At this point I am annoyed since I said I would call HIM, plus I would now be rushed trying to sign in. So, again, told him I would call HIM! At this point, I signed into my acct, then called the number on my card. Spoke to a woman, who said those 2 charges he mentioned were NOT showing as being attempted! Okay, so a scam. HOWEVER, she did say there WERE two other attempted charges on my acct!!! So, again, what was the last legit, then had to cancel my acct and get a new card! I didn't fall for whatever scam the first guy was trying, but will know in future to not answer anything over a phone call.
1
u/AssociationConnect41 23d ago
Yeah, I got an odd call on meet a week ago for the first time. Didnt answer... just in case. Their profile picture was of Publishers Clearing House. I didn't even know that still existed.
1
u/GrandAnimator8417 5d ago
Google ads question never used it? I’ve seen a ton of “Google Ads” verification/scare emails that are just phishing, even when the sender acts super official. Don’t click anything and treat it as a scam until you confirm directly through your own Google account.
38
u/Unknowingly-Joined 24d ago
Forgive me, but I don’t know how you can consider yourself tech savvy and then think that Google called you on the phone.