Literally got something similar to this last Friday. Sounded legit. My one weird trick that works every time - give me a ticket # and an official phone number to call back to and I can confirm the phone number is legit. This way you can continue the conversation if it is actually legit, and if it's not legit then all good.
The guy who called me said "I can send you an email to show it's official" and I thought of that immediately when I read this article. No dice, he refused to give me a number to call back on, so I knew it was fake.
EDIT You can spoof from email addresses and you can spoof phone numbers - if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.
vunderba 301 days ago [-]
I personally don't even allow them an opportunity to give a "phone number" either. I always ask them to identify their company and the branch that they are with - and then personally go to the official website of the company (i.e. https://amazon.com, etc.) and look up the phone number there.
A little less convenient for a LOT more security.
bigiain 301 days ago [-]
For some reason I can't seem to find my local Google branch's phone number on their website...
MobileVet 301 days ago [-]
This was so much funnier than I wish it was… ugh. Contacting Google. Good luck.
cwmoore 301 days ago [-]
Wonder why I've never had that problem.
tempodox 301 days ago [-]
Are you saying you can find Google’s phone number?
cwmoore 301 days ago [-]
Yes.
figassis 301 days ago [-]
You’re probably worth a lot of money rn. I would start an entire business just selling people Google’s number. Heck, I would start an entire Google support company rn, publish a phone number and proxy calls to Google. I’d screen calls then also sell Google my services. You’re welcome. Build this in 2 months. I want 30% ownership.
marklubi 301 days ago [-]
I make them hundreds of thousands a year even with their commission from my app sales. Still don't have a contact there (same with Apple).
They're happy collecting their commissions and avoiding you. The only good thing is that (for the most part) the payment method is just a password/faceid/touchid away.
cwmoore 301 days ago [-]
Duh.
EDIT: also thank you, but and 0.0% is fine.
BobbyTables2 301 days ago [-]
It’s not (248) 434-5508 ?
II2II 301 days ago [-]
I have the fun of making outbound calls to offer people a public service and collect payment if people desire it. Most people gladly hand over their credit card details. A few years ago, someone wisely asked why they should trust me. (It only happened once in a decade!) I said they don't have to. They could look up our phone number at an easily verifiable government website, then call back; they could call any facility operated by the department; or they could visit any facility. Said individual provided their credit card details right then and there. Virtually noone cares about security.
rapind 301 days ago [-]
I don’t trust anyone calling me who isn’t already in my contacts.
Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.
Now try and convince your family to do the same (especially parents who are prime targets).
II2II 301 days ago [-]
> Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.
Not to justify their behaviour, but: most businesses are not set up to allow for callbacks or they're set up to actively discourage them. For example: they may be contracting out to call centers or employee performance may depend upon making a sale. My situation is unique since all calls our handled internally and my performance is not based upon making a sale.
That's said, the current situation pretty much dictates that a secure option should be offered to clients.
benmanns 301 days ago [-]
The trouble is, you have to place the outbound call to those contacts to trust them. People could spoof an incoming call from numbers in your contacts and it will look as legitimate to you as a receiver as if the real number was calling you. With voice spoofing, it's now possible to call someone as [grandchild] with [grandchild]'s voice with a pretty horrible story about what's going to happen if some Bitcoin or Google Play gift cards are not purchased and handed over immediately.
rapind 301 days ago [-]
I'll give you an example. When the Bank calls me about something important, I tell them to give me their department / extension and I'll call them back. I then look up the bank's phone number on their website (it's actually in my phone already, and on my bank cards) and call them back.
This process doesn't care about them calling from a spoofed number. We've had big problems with spoofed number scams and the CRA (Canadian version of the IRS) recently.
0xffff2 300 days ago [-]
So in other words, you don't trust any incoming calls, even if they appear to be from a number saved in your contacts?
rapind 299 days ago [-]
No. If it's someone I know, and I can tell that's who they are from their voice, and they aren't suddenly trying to pry a bunch of financial information from me, then I trust them. I also don't even accept calls from unknown numbers by default, unless I explicitly turn that off temporarily because I'm expecting a call from someone not in my contacts. There are plenty of other ways to get ahold of me.
AI speech still has some noticeable quirks (I cloned my voice earlier this year to produce some tutorials). Once those are ironed out, I may increase my paranoia a bit. It's going to be hard for an AI faking a relative to get my bank password, if that even happens. There are far more lucrative targets with that level of investment.
I think just being on guard and not trusting potential anonymous sources is "good enough" for now.
intrasight 301 days ago [-]
I've not once had a legitimate company not say "good for you in taking the extra security precaution of calling us back".
nothrabannosir 301 days ago [-]
No kidding!? I have never had someone take this in stride. Responses have ranged from surprise to defensive condescension. It rarely even works at all, and the two worst offenders were both banks. One UK, one USA. I almost had the check for my rent bounce after three days of this rigmarole and ended up having to just go with it.
Where do you bank? I'm looking for recommendations.
plasticchris 301 days ago [-]
Even better, once I had a financial institution tell me I needed to read them a one time code someone would text me. They were actually surprised I had a problem with it when it’s the scam playbook.
GoblinSlayer 300 days ago [-]
Isn't that just 2fa? It's not limited to web.
plasticchris 294 days ago [-]
In a way, but this was also on an incoming call, and the text came from yet another number, there were a lot of red flags despite being legitimate.
BobbyTables2 301 days ago [-]
I suspect far more people question the moon landing than the authenticity of caller!
nothrabannosir 301 days ago [-]
To be fair I give just about anyone and their dog my CC number. Chargebacks work and my life is that little bit easier for it.
Playing Jason Bourne with your credit card number is not worth the effort if you ask me.
I would even say this is a net positive for the economy: the cost of fraud is outweighed by the lower barrier to payment. I'm sure you'd have made fewer sales had people been more worried about security. Net positive then, right?
alvah 301 days ago [-]
Depending on which country you're in and which bank you're with, chargebacks are nothing like as straightforward as they used to be. I just completed yet another one, which involved 2 separate phone calls totalling over an hour (so probably not worth it on a $/hour basis), accepting the risk that if Visa rejects the claim I'm liable for a further $50 charge (this is new), and generally 3 months of hassle until I got most of the money back (less the international transaction fee, as the merchant had fraudulently claimed to be in the same country as me, but charged me from the UK).
nothrabannosir 301 days ago [-]
For the record what kind of chargeback are you initiating, and why does it have to go through visa rather than the bank who issued you the card? Unauthorized card-not-present transaction initiated by a third party? Some cbs are harder than others to get ruled in your favor, but the one where a criminal takes your card and uses it without your knowledge is by far the easiest one to get awarded. It involves one call to your bank and you get a new card, all fraudulent charges reversed.
If your bank doesn’t want to honor the request yes you’ll have to contact the payment network (visa/mastercard) and I’m sure there’s someone in this thread who has experienced that for an unauthorized transaction chargeback but it’s exceedingly rare.
Merchant error chargebacks , on the other hand… very different situation.
OkayPhysicist 300 days ago [-]
The US makes chargebacks exceptionally easy. Non-Americans have a much less useful credit card system, which is why debit cards are more common in most of Europe.
alvah 300 days ago [-]
Merchant fraud this time. Done through the (soon-to-be-ex) bank but they brought up the charge from Visa.
It’s possible that my current bank is particularly bad at this, as they are bad at everything else. I have had the runaround with merchant error and stolen card number chargebacks with other banks though.
danielktdoranie 301 days ago [-]
“I have the fun of making outbound calls to offer people a public service and collect payment if people desire it.”
Oh so you’re a telemarketer.
II2II 301 days ago [-]
Nope. I only sell services that people previously requested, though it is often months earlier. (As I suggested, it's a government job.) Sales is just one of the things tacked onto my job description over the years.
And to further crush that cynicism: most people are overjoyed when I call them.
reaperducer 301 days ago [-]
Oh so you’re a telemarketer.
Not everyone who makes outbound calls is a telemarketer.
The healthcare company I work for has a whole department of very nice people who make outbound calls to offer free health and nutrition classes to poor people.
Yes, they're free. As an employee I am also required to take one of the classes each year, so I know what they entail. Yes, they cost our company money. No, they're not sponsored by some corporation or ad company, and no we don't sell people's information on (HIPAA and all that).
The real world isn't a tech bubble cage fight.
BikiniPrince 301 days ago [-]
In the rare case something worms it's way to collections I just ask for the certified letter. Now in ten years that only happened once. I even called the hospital asking where my bill was and they said I didn't owe anything. Three months later collections!
nradov 301 days ago [-]
The great thing about credit cards (as opposed to obvious scams for suckers like cryptocurrency) is that consumers don't have to care about security. They can dispute fraudulent charges and never be out any money.
misnome 301 days ago [-]
There are a lot of contact numbers for e.g. banks and often it’s not obvious how to re-contact the department you are talking to. So, I’m happy to take a number, but I have to be able to find it on the conpany site somewhere (will also accept generic e.g. “call the bank fraud line and supply this reference number”)
docmars 301 days ago [-]
I simply don't answer my phone for anyone not already in my contacts, unless I'm expecting a call from a contractor or local service.
I assume if I have a problem with any of my accounts, I'll eventually find out and self serve to go and fix it, as much as possible.
cortesoft 301 days ago [-]
But this is google, who don’t have a phone number to call them.
marklubi 301 days ago [-]
Just to add on, never say "yes" when you get a call from an unknown number (or maybe from all numbers, just be careful).
"This is he(or she)", or "who are you trying to contact" handle most situations.
Just don't let scammers get you saying something in the affirmative.
avidiax 301 days ago [-]
What happens if you say "yes"?
marklubi 301 days ago [-]
They have you acknowledging something at that point. Doesn't really matter what it is when they can take it out of context.
Edit: Many of them are scammers, they don't play by the rules.
tpxl 301 days ago [-]
How does that help them? It's not gonna pass any legal scrutiny. If they were going to lie, it doesn't matter whether you said yes or not at any point in the call.
marklubi 300 days ago [-]
> It's not gonna pass any legal scrutiny
Probably going to cost a lot to get to that point, probably more than they will scam you for. They're after the quick hit that gets them something right away while also believing that you won't take it that far.
It's like knowing how to pick a lock vs just throwing a rock through the window that's next to the door to gain access. They both get you there.
tpxl 300 days ago [-]
Scenario 1: You don't say yes and they lie you acknowledged something. You sue or you don't.
Scenario 2: You say yes and they lie what you acknowledged. You sue or you don't.
The math on your end doesn't change, no matter what you said.
hedora 301 days ago [-]
I usually ask for the phone number, find it on the corporate site, then call the branch office.
Alternatively, ask for their license number, check the license, then call the number it lists. (Kills two birds with one stone for licensed professionals.)
Gud 301 days ago [-]
Yes, why would you accept the phone number given to you by this stranger calling you as legit?
0xffff2 300 days ago [-]
You don't, but large organizations can have a lot of entry points (or none... but that's a different topic), so you let the caller pick the inbound number that will actually reach them or their department, but then you still independently verify that the number belongs to the organization before trusting it.
dec0dedab0de 301 days ago [-]
Be careful with checking official numbers too, or at least tell any non-tech friends. Fake numbers have been ending up in search results on official looking websites. It's a real knife fight out there.
Waterluvian 301 days ago [-]
I find that when it’s legit a consistent thing happens, which smells of careful training: they instruct me to call the number on the back of the card, or on a bill.
TOMDM 301 days ago [-]
Obvious next step to me is malicious bills sent to an address
Only worth it for a targeted attack. Even then I might just read the number off a genuine bill instead of their fake one. And that's assuming they have linked my address and number - lots of scam calls are low effort dial every number.
skygazer 301 days ago [-]
It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google. The web is untrustworthy, and Google transparently passes it to users. We'd probably be better off if Yahoo's quaint curated list of sites had won out.
301 days ago [-]
mschuster91 301 days ago [-]
> It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google.
Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale.
But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned.
At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of.
But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks.
And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work.
Yes, and that same lack of lawyers/friction is what also allows legitimate small businesses to thrive. I've worked for many, and out of those many, none of them had lawyers involved at all.
It is all about balance. Google could do more here, however the answer is not as obvious as you might think. Especially in an age where identities get stolen often and the lag time on catching said fraud is quite long.
The issue is that the entities mentioned are doing...nothing at all. Not even basic MANUAL identity checks and payment checks. Automated checks work very well until they don't.
mschuster91 301 days ago [-]
> Google could do more here, however the answer is not as obvious as you might think.
Oh it is. A basic background check alone done by an actual human to see if the business is actually real, let's say this costs Google 1h @ 40 dollars plus 20 dollars for credit bureau fees. Google can offload that cost to the advertiser - even for a small cookie store, that's hardly an expense.
And after that, vet the campaign material for each asset. When you have 200 dollars in ad spend (which isn't much), 10 dollars should go pretty far in having a human see if the "pizza store" didn't just place an ad for penile enlargement.
> Automated checks work very well until they don't.
The key thing is, the entire ad industry is amoral. No one cares about fraud or brand reputation any more, not when you see chumbox ads on "reputable" newspapers. So everyone seems to think "why should I leave a few dollars on the table?".
bcrl 300 days ago [-]
At what point does Know Your Customer kick in for ads?
avidiax 301 days ago [-]
Yes, especially do not google the number that you were given on the phone. That is completely certain to turn up the scammer's official looking page and "confirm" the phone number.
I have seen Microsoft support forum articles that list the "Facebook official phone number". The fact that it's not from Facebook doesn't make it less authoritative in a panicked person's mind.
Google, Meta, Microsoft, and Apple really must start publishing an "official phone number". It is perfectly OK that this phone number just plays a repeating message saying that the user should browse google.com/phone. That website can explain that there is no phone support offered, and provide a bunch of links for common scamming hooks that leads to anti-phishing material.
gblargg 301 days ago [-]
This happened to me once. I was calling Amazon and did a Google search on mobile. I called the big number that was at the top of search results. After I had given my account email, but nothing critical, I started becoming wary of the questions I was asked because they weren't relevant. I hung up and searched again and the result did not come up again, and Amazon's number was totally different. I looked up the number I called and it didn't find any results. So I'm guessing an ad scam. I definitely don't trust Google results with featured answers for things like that anymore.
bcrl 300 days ago [-]
This happened to my father while I was around during the beginning of the COVID lock down. He searched for an Apple support number and was served a targeted ad for a phishing site. Because of the change in search a few years prior, ads now look very much like search results compared to the obvious visual distinction back in the Don't-Be-Evil days. The ad was sufficiently targeted that it only showed up on his device for the search -- nobody else would see it.
Ephemeral ads are not a good thing.
GoblinSlayer 300 days ago [-]
Ironically today even network engineers of all people can't type speedtest.net without google's help. Set your search engine to wikipedia and see them struggle.
bcrl 291 days ago [-]
I feel like we lost the battle for any semblance of hope in matters of security when the URL bar blurred everything into search. There is simply no way to ensure that the browser does what one expects anymore.
klik99 301 days ago [-]
Good to know.
The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.
kevin_thibedeau 301 days ago [-]
They also typosquat support numbers for people who misread them or assume things like toll-free is always 800 when it can be other area codes. Just because someone answers, don't give them enough PII to use your identity elsewhere.
Braxton1980 301 days ago [-]
How can he spoof an email address without Gmail or the like flagging it? I'm not talking about the common name but the actual email address.
stavros 301 days ago [-]
That's what I'm curious about too. DMARC should make that impossible.
hedora 301 days ago [-]
The last I heard, Google relied on spam filters for this.
Supposedly, people have been fired after being falsely accused of harassment. The scam works as follows:
Send a message to bob@gappsdomain.com and notavictim at the same domain. Arrange for the headers to be “from” bob. Now, notavictim reports Bob to HR. If the google admin is competent, they look at the headers, and note that Bob didn’t send the email. (Not sure if they catch the offender or not.)
If they’re incompetent, they see the message in Bob’s from box, and recommend he be fired.
This is a feature that enables dubious workflows, where Bob configures spam bots to bother his coworkers, but wants those messages to be auto filed in his sent box.
I didn’t think it worked when spoofing unrelated domains like Google though. That’s just dumb. Maybe the attacker had the author’s IMAP gateway password and moved the message into the inbox?
calmworm 301 days ago [-]
Google spam filters are terrible because they filter way too much legitimate email. I have been a paying business Gmail user for years, all DMARC, DKIM, etc… in place. My messages still go into client Gmail spam folders. It’s extremely infuriating. Google knows I’m not sending spam. They can’t deliver my email properly to their own inboxes? Nonsense.
mihaaly 301 days ago [-]
I have no time and energy for the level of paranoia present web services RQUIRE. I started to cut back. One of the firsts: not accepting Terms and Conditions for a site my company delegated for the sole purpose of delivering my payslips (probably some others too, but marginal compared to this). I'd need to revisit the details to tell what was that exactly, but some sort of sharing some of my data with thrid party (subcontractor) thing. It is a recent develpment, I will see how it flies with my organization, but I'd be surprised if I could be forced to accept T&C just for receiving payslips. We have 2 other admin accounts for reporting time, absence, no more for me with some arbitrary service provider, thanks. (in the previous job of mine our absence tracking system sent me incentivised ads in the dashboard to attract others to their platform and some sort of weird discount system if I buy things here or there, quite repelling)
glxxyz 301 days ago [-]
> if someone is calling from a legit number on caller id it means NOTHING
I had to tell my bank this once a few years ago, when they called me up and then expected me to give them personal information to confirm my identity.
301 days ago [-]
beeflet 301 days ago [-]
> official phone number
Great idea unless the attacker has SS7 access.
klik99 301 days ago [-]
Yeah, if you're a high profile target then you need extra layers of security, but for regular folks that one weird trick is enough to make you just enough of an annoyance to make another target preferred.
But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.
beeflet 301 days ago [-]
I imagine it will be like SIM swapping attacks where attackers will pool all their money together, gain temporary SS7 access and conduct a ton of attacks in a short window of time. Reducing the per-attack cost.
The phone network is just not a secure channel for any sort of communication
kevin_thibedeau 301 days ago [-]
They currently lease temporary access to specific numbers from crooked middlemen for the weak claim that they're not "buying" the numbers.
wil421 301 days ago [-]
Explain how SS7 access can allow someone intercept my call back to an official number like Bank of America or a number on Fidelity a 401k support page.
I don't know. Google could solve this all in an afternoon. It controls e-mail delivery, it is the e-mail delivery monopoly. Why deliver these e-mails? It just shouldn't.
But because Google delivers spam from senders who spend a lot on Google ads; and e-mail traffic gets laundered into web ads traffic; they just can't do it. And because Superhuman charges more than $0, it can't do it either. Nobody can fix e-mail. If you can't see how phishing and Google Ads are related... you know, this is why it is hard to "just" pass a law. It's not because the law wouldn't fix the problem. It would, if you permit the status quo where Google is the e-mail monopoly. It's this whole A16Z "just pass a law" nonsense, where someone thought he was saying something really insightful because he didn't like Jon Stewart, getting in the way of my inbox zero, and simply never receiving non-personal e-mails at all.
8cvor6j844qw_d6 301 days ago [-]
> if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.
This reminds me of one time where I got a call from a number I don't know, got yelled at something about spamming calls. Yelling includes threats about getting reported to police or whatever, which was confusing since I never had any history with this number.
I suspect my number was spoofed. I'm not sure if there's any defense against that.
Now my default is to ignore any unknown numbers.
sroussey 301 days ago [-]
A few reminders bear repeating:
— no support group from a big company is going to call you. Ever.
— never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!
— Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party like 1Password or similar.
— Don’t have the same email you use banking and investments be the email that the world knows. Create a new email for that. If you use Chrome, even use a separate profile with that email, and only have your password manager as an extension. No others.
fxtentacle 301 days ago [-]
Except that a few weeks ago, I got a phone call
- from a number with no results on Kagi search
- claiming to be the online banking support of my bank
- asking me to read them a code sent to me via SMS
and when I refused to do that, they blocked my login credentials for online banking and sent me a sternly worded (paper) letter that my account could not be upgraded automatically for their software system migration because I had refused to engage with their support agent.
I then had to create a new login in their app, call the phone number on their letter and read that guy the SMS code and, to my surprise, that was the only !!! authentication needed to activate the new login credentials that I had just created.
(BTW, this was one of the top 100 largest banks worldwide)
It's almost like some companies are training you to fall for scams.
EDIT: This specific instance was Deutsche, but Chase has the exact same horrible habit of calling and then asking for an OTP code.
apparent 301 days ago [-]
I've gotten calls from my bank before, where they tried to get me to authenticate after I answered the phone. I said "look, you called me, I'd be crazy to just answer the phone and give out personal info." They refused to provide any info that I could have used to validate that they were legit (like telling me something about my account number, when my account was created, etc.). They said I had to authenticate with them before they would tell me anything.
Sometimes the rep is understanding, and acknowledges that he would have the same reaction, but other times it's like they don't realize they're asking their customers to do something Very Stupid™.
red369 301 days ago [-]
Over a decade ago, I worked in a bank call centre, first as one of the people who would occasionally make those outbound calls and have those crazy conversations, and then later in their customer experience team. It was well known that those outbound calls to customers were a mess, but it was thought of as tricky to fix. The dilemma was that the risk department felt they needed to identify people, but not only were those people often hesitant to provide any info, we wanted them to be - for everyone else who called them, but not for us.
It was also difficult that when people asked whether they could call back, we encouraged them to, but couldn't guarantee they'd then speak to the same person. They'd need to just talk to whoever they got. That was usually enough to put the person off and they would just take the risk (unfortunately).
Edit: Just wanted to add that I personally didn't want the people to make an exception to their unknown caller scepticism. Perhaps this bugged me more than others, but I would strongly encourage them to call back, and then do my best to get the call-back transferred to me. For that and many other reasons which I like to think of as preferring quality over quantity, my stats were as bad as you'd imagine!
When that bank did really try to tackle this issue, they quickly realised that there was more than one level of risk, and for the vast majority of the calls, we could get by with very little of that customer verification process - basically just that we had called them on a number they had provided, and they stated their name (which I think was more as a recorded verification that they were at least stating they were the correct person). For the much smaller number of outbound calls with more risk, we could then ask the person to call back. Once the risk peeps were on board, it was vastly improved fairly easily.
I'm not in that space at all now, but it seems far easier than it was back then. A few banks I'm a customer of send notifications right into the online banking app, which the customer approves, confirming that they at least have access to that. I don't know what they do if you don't have the app installed. I do find it a little sad that it is yet another thing pushing you to need a smartphone (and to install yet another app). On the other hand, I think all of those banks require me to have the app to use as an authentication token to do any kind of online banking even on a desktop browser, so if you're going to do that, may as well take advantage of it everywhere.
ww520 301 days ago [-]
It happened with Schwab. I've enabled option trading in one of my accounts and got a call from Schwab, asking to authenticate me. I told them I couldn't trust it's a legit call; give me a number and case number and I'd call back.
kevin_thibedeau 301 days ago [-]
It gets fun being on a 3-way call with bank M, talking to a Schwab rep for verification and trying to explain why Schwab uses a Chase account number.
jagged-chisel 301 days ago [-]
> … I had to authenticate with them before they would tell me anything.
Sensible. But this whole “we called you now prove to us who you are” mess is stupid.
“Hey, this is Carol from Le Bank. Please just give us a call back at our main number found in the app or on our website. Then you can reach me directly at extension 123.”
gcr 301 days ago [-]
Which bank was this? Please name them so I can avoid doing business
From 25 August 2025, you will benefit from the upgrade for online banking and Deutsche Bank app.
[..]
From 25 August, you will be able to simply reset your PIN yourself.
[..]
after logging in, you can also see accounts for which you are an authorised signatory."
But out of fairness, let me just mention that Chase behaves the same way. I think all of them just don't really care about small- and medium-sized businesses.
anonymousiam 301 days ago [-]
I've had this same issue with BECU (Boeing Employee's Federal Credit Union). They're a really good financial institution, but like many, they suffer from nearsightedness. They know that they're "the good guys", so they feel that it's unnecessary for them to properly authenticate themselves to you. So it's asymmetrical security and asymmetrical trust.
The worst part of this (for BECU) is that they've been warning their customers about phishing attacks from entities claiming to be BECU.
dec0dedab0de 301 days ago [-]
My old insurance company (Cigna) used to call me and demand information to verify it was me. I eventually figured out it was a thing to try to convince me into getting cheaper cancer treatment so they could save money.
danielktdoranie 301 days ago [-]
Jesus, insurance companies are so gross
rightbyte 301 days ago [-]
Ye. I called my bank to unblock my Mastercard after they blocked it due to Blizzard charging 10USD or something for Star Craft. I just told them my name and they unblocked it.
On another occasion the bank called me regarding my house insurance and asked me to identify myself with their dongle.
Like, there is a wonder I have any money at all in my account. But then again, giving away plastic cards with a magic number on that you gave to strangers for them to withdraw an amount of their choosing from your account was the norm for decades ...
Maybe the wisdom is "Security through no security"?
brewdad 300 days ago [-]
I had to call Chase about an issue with my credit card. I called them and knew I was talking to a legit agent. At least as sure as one can ever be. Still, at one point she asked me to read back the code she texted me. I started to do so then stopped. I explained that the text she sent me specifically states "We will never ask you for this number (over the phone". I refused to read it back since it violated their own stated policy.
She had to do some additional work to resolve my issue but it did get fixed.
john_the_writer 301 days ago [-]
My local medical clinic sent me an sms with a link, asking me to change my medical info. I called them to point out how they were training their patients to fall for sms scamms.
zeven7 300 days ago [-]
At my (very large) bank, they have asked me to read them a code from text that literally said "Do not share this code with anyone over the phone" in the text message next to the code. I'm 100% sure it was my bank asking for the code. I called them from a number I found on their site over HTTPS and verified from another source, they knew my account information. I gave it to them while telling them they need to fix this. This was a few years ago. Nothing bad ever happened. Just bad security practices.
Arrowmaster 298 days ago [-]
I had this happen with fucking Google.
I called them about my Fitbit warranty and the rep needed to verify my account and wanted me to give him the code from SMS that explicitly said in the SMS not to give it to anyone!
No my account did not get hacked afterwards. Yes it was a legit service rep because afterwards he was able to pull up info on my previous warranty claim.
jlarocco 301 days ago [-]
I know Wells Fargo gets a bad wrap (and rightly so) for some of their behavior, but IME they've always had their stuff together with online access and banking.
This is the same Wells Fargo that silently truncated everyone's online banking passwords?
Edit: My bad, I misremembered. It wasn't that they truncated them, it was that they were case insensitive. Which is... objectively worse.
Pesthuf 300 days ago [-]
Did the OTP message they sent you state that this code was specifically to authenticate on the phone?
If it did and even included details like the person‘s name, that would make me feel safe. If it’s a generic OTP that could be used to log into my account or reset its password, though…
300 days ago [-]
joshuamorton 301 days ago [-]
Yes, I've also had wells fargo require me to read codes that were emailed back to them, and while this was mitigated by me calling them, it sketched me out every time I had to do it.
carlosjobim 301 days ago [-]
They treat you as you deserved to be treated: As a serf. You let them stomp all over you and still come crawling back to plead with them to let you bank with them. Even though there's hundreds of banks you can switch to.
If anything even remotely similar happened to me, I'll instantly close all accounts and move my business to another bank.
ryandrake 301 days ago [-]
Same. Find a different bank not full of morons. It's not like there's a shortage of banks out there.
301 days ago [-]
UltraSane 301 days ago [-]
They should really send the code in a letter.
thrtythreeforty 301 days ago [-]
I mean just get a new bank at that point. They're telegraphing that they're gonna cause you more inconvenience in the future.
mandeepj 301 days ago [-]
At least, you took the right steps. However, they were stupid to begin with.
andy99 301 days ago [-]
The bank's policies and those like it are the root cause of these scams. There are countless things like this where real "legit" behavior is completely indistinguishable or sometimes even worse than scams.
There will always be people that are "wallet inspector" stupid that you can't really shield from scams. But common sense practices and consistent messaging would solve a lot of the problem. There needs to be better accountability for companies that have these insecure practices. The same way they'd be held accountable for a data breach. Oh, wait...
golem14 301 days ago [-]
This seems obligatory: Identity Theft, by Michell and Webb
Google support actually did ask me for that code when I had them disable energy savings on my nest thermostat. (it's insane that this had to be done through support, it's the setting where the power company can essentially control your thermostat in exchange for savings)
To their credit/discredit, when I said no I'm not giving that out it says not to they just moved on. Not sure why they even asked then.
fvgvkujdfbllo 301 days ago [-]
Yes, it is so easy to enable this setting, they even keep sending us notifications to enable it. But once enabled, it is impossible to disable it.
It is a setting that let your power company to change your temperature settings when grid is under load. We wouldn’t mind it but they turned our heat way down during one freezing night while we were sleeping. Everyone woke up with cold next day.
dragonwriter 301 days ago [-]
The asymmetry in activating/deactivating may be because power companies discount rates (don't know if it is automatic or you have to contact the provider) for people with that setting active, and removing it dusqualifies you from the discount, so there is at least potentially an asymmetrical financial impact of toggling it one way vs the other.
MrDarcy 301 days ago [-]
> — no support group from a big company is going to call you. Ever
> - never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that.
Chase bank still, as of last week, asks for these codes over inbound calls. Drives me mad. They do so when calling me about fraud alerts, not the other way around.
bdangubic 301 days ago [-]
NEVER answer - like NEVER :) absolutely NEVER answer... calls or text... it is really simple. I also have Chase and I have blocked just about every single number they called me from (probably like 12 over the last decade)
schneems 301 days ago [-]
You can hang up and call the number on the back of your card
gennarro 301 days ago [-]
100% this. Do it every time.
kevin_thibedeau 301 days ago [-]
If you initiated the call (to the correct number) then SMS verification has a low likelihood of being a scam.
krashidov 301 days ago [-]
My phone is set to Do Not Disturb by default. Only 5 numbers can reach me direct to ring and that is immediate family only. I never answer calls from unsaved numbers. If they really need to reach me they can leave a voicemail.
When you answer a call your brain kinda loses its ability to step back and think. Almost like the same trick that those people who ask for directions and steal your watch do.
Security is not the main reason I do this but it has been nice knowing I can't be reached directly by scammers and hackers.
anal_reactor 301 days ago [-]
I stopped answering unknown numbers because everything that's important comes via email anyway. But a friend of mine has a job that requires them to answer calls from weird numbers, so it's tough.
everybodyknows 300 days ago [-]
Doesn't any legit caller always leave a message? That way, you can think through the security issue before responding.
wiredpancake 301 days ago [-]
[dead]
gpt5 301 days ago [-]
> never give out codes sent to use via sms or push notifications to someone requesting them via phone
Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).
sroussey 301 days ago [-]
I’ve personally never had that happen. It should go on a name and shame list.
jasode 301 days ago [-]
>I’ve personally never had that happen. It should go on a name and shame list
The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center.
For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card.
That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.
NikolaNovak 301 days ago [-]
I agree with everything you said.
Note, however, that those are two "totally different sequences of steps" to you and I, and "completely analogous / equivalent sequences of steps" to my father in law :-/
vehementi 301 days ago [-]
Justifiable in a vacuum, but the end result is grandma knows "sometimes it's OK to give the code to the person on the phone"
cced 301 days ago [-]
They should have users receive the code and then submit said code into the application for verification, with clear instructions that this code is produced as a result of a support call, and to confirm you are on an existing call when submitting the code.
Doing so would not force users to divulge codes over the phone, and enable support staff to verify identity all without training users that reading codes over the phone is acceptable.
Thoughts on that?
301 days ago [-]
Ajedi32 301 days ago [-]
Still not foolproof. Attacker can MITM the connection by initiating their own call to the real support line and relaying instructions between the user and support.
Ajedi32 301 days ago [-]
How else are you supposed to do identify verification over the phone?
I think if the war against phishing online has taught us anything, it's that humans can't be trusted to not reveal secrets to scammers. Only machine-to-machine public key authentication (like TLS or WebAuthn or U2F) is truly phish-proof.
dpifke 301 days ago [-]
The signin 2SV SMS verbiage used by Chase is: "Chase: DON'T share. Use code 12345678 to confirm you're signing in. We'll NEVER call to ask for this code. Call us if you didn't request it."
I assume in the case where the customer initiates the call and support is verifying their identity via SMS, they use different text (i.e. not "to confirm you're signing in"). Otherwise, that'd be pretty ridiculous.
eep_social 301 days ago [-]
found today’s optimist, congrats you win one warm fuzzy feeling.
the verbiage is the same.
ameliaquining 301 days ago [-]
I think I at one point ran into this with Chase and the verbiage was not the same. Are you speaking from experience?
eep_social 297 days ago [-]
I am; I seem to recall it was Chase (and I do have a Chase account) but it could have been another bank or financial institution.
My reply involved the effort of sending a test message from my Chase account, to capture the exact text used. If you want people to engage with you in good faith, you should put similar effort into your replies, rather than just use Reddit-speak for "I think you're wrong."
UncleMeat 301 days ago [-]
Chase did this to me. A million alarm bells but even after hanging up and restarting the conversation from a phone number publicly listed on their website as a support contact they still did it. Wild.
scrollaway 301 days ago [-]
Stripe Support does it for certain specific cases (email & phone). However, whenever they do it, it's a bilateral code generation: The support agent also gets a code they have to read out to the end user, which is featured prominently to them, saying the agent will have to read it out to get authentified.
rscrawfo 301 days ago [-]
Fidelity does as well, although the message switches to state only read the code if you've called them directly.
delfinom 301 days ago [-]
A lot of credit unions using a certain call center / credit card provider use this exact authentication mechanism over the phone.
adrr 301 days ago [-]
My bank does it. Chase will send OTP via the bank app to verify you're identity for phone support.
clysm 301 days ago [-]
Chase bank…
troc 301 days ago [-]
- godaddy
octo888 301 days ago [-]
Who still uses GoDaddy LOL
koakuma-chan 301 days ago [-]
Small business owners
jay_kyburz 301 days ago [-]
Also me. Every 10 years my domains expire, and I can just pay a few hundred bucks again and forget about it, or I can do a bunch of work to move them somewhere and adjust A records and fuck around with stuff I don't remember and potentially have downtime.
UltraSane 301 days ago [-]
Use AWS Route53 it is so much better.
koakuma-chan 301 days ago [-]
Better than CF?
UltraSane 300 days ago [-]
If you mean cloudflare I have never used it.
koakuma-chan 300 days ago [-]
Check it out, it's much easier to use and they don't charge any markup.
UltraSane 300 days ago [-]
One thing I like about Route53 is how granular the permission can be. This lets you automate things more easily and securely.
koakuma-chan 300 days ago [-]
Yeah AFAIK people use Route53 when, e.g., there is a need to automate making subdomains for customers and stuff like that.
UltraSane 300 days ago [-]
IAM permissions are almost always a pain to get right but they can be so useful when you can create an API key with permissions to do only exactly what it needs to do.
Loughla 301 days ago [-]
Google business support called me to close the loop on an issue I had with a business listing. It was from a very busy and loud call center, and was made by someone with a heavy accent.
It's like they want us to get scammed?
IshKebab 301 days ago [-]
Yeah except I used to get legitimate calls from my bank's fraud department starting with "can you confirm your date of birth and address".
Yeah, insane. I think it was HSBC. This was a couple of decades ago so maybe they've fixed that. I don't bank with them any more.
ajsnigrutin 301 days ago [-]
Yep.
But over here our bank has also been sending out leaflets on how to avoid scams, and the top two are "if you need to call, call the number written on the back of the card" and "if you're not sure, come to the bank in person".
Same thing I tought my parents, and my mom actually got a call about some "personal info they needed to verify", said she'll come to a bank in person, they said "ok", she went in person, and they actually needed to verify some data (some EU regulation, she hasn't visited a bank in years).
ctennis1 301 days ago [-]
I'm in the midst of a transfer of enterprise account ownership with with Apple, and I can assure you, the only way to complete it is to wait for a phone call from Apple Support from 1-512-884-5022. You can call this number back and verify it is indeed Apple Support and get notified it does not accept inbound calls, only outbound.
odie5533 301 days ago [-]
During a Tracfone support call I made recently, they sent a 2FA text to me. I said to the rep, "The text says 'Don't share this code with anyone.' Can I share it with you?" They laughed and said yes. It was completely legit as I had called Tracfone for some service changes.
So some of these systems are very poorly designed.
traceroute66 301 days ago [-]
> Always use a third party like 1Password or similar.
Or even better, don't rely on a third-party hosted service.
I've been a Codebook[1] user since the old-days when they used to call it Strip.
They are old-school, local-system storage. With sync/backup done how you like it (all three encrypted before it leaves your computer):
- Dropbox
- Google Drive
- Local folder (which you can then sync with using your own mechanism)
- Recently (only this year) they introduced a totally optional hosted subscription cloud-sync option for those who want it
There’s something to be said for the setup and largely forget it nature of 1Password
There’s good reasons to use it over self managed solutions, just like there are other good reasons to use a self managed system like this.
Neither should be strictly dictated as better without first ascertaining what the user is looking for
lokar 301 days ago [-]
The backup of a TOTP is just the seed, right? Print it out and keep it with your other sensitive papers
827a 301 days ago [-]
Honestly if someone from Google Support calls me, my immediate response would be: "Google... Support? Now there's two words I've never heard in the same sentence before."
cmurf 301 days ago [-]
AMEX fraud support group called me. A real live agent.
Capital One texts codes during live calls and requests the customer read the code to them.
A health care provider sends emails with links to 3rd party domain to provide encrypted email, because a) regular email isn’t supposedly not HIPAA compliant and b) apparently the health care provider’s web and app infrastructure which provides secure messaging is not secure enough for certain messages. It’s indistinguishable from a phishing attack.
Hospital direct invoicing by email, also includes 3rd party links, which takes the user to a site asking for personal information including SSN. It’s certainly phishing. Right? Nope, it’s legit, and no option to get a mailed bill once volunteering an email address.
I think half of mobile device users don’t know or can’t handle a best practices workflow.
The reality is the tech industry sucks, it’s bad at its job, gives shitty advice to everyone then goes and violates all of it
leading to loss of trust.
reaperducer 301 days ago [-]
regular email isn’t supposedly not HIPAA compliant
It isn't.
I work in healthcare, and if anyone in the company sends an email with PHI or PII in it, we're supposed to alert the Security department, or lose our jobs.
zamadatix 301 days ago [-]
The danger with stating this in terms of absolutes like:
> no support group from a big company is going to call you. Ever.
Is, eventually, you probably will get a call from a support group at a big company, as many have noted in response, and then all of the other absolutes in the list also become "well, people say never, but I think this is one of those exceptions" instead of "it's never worth taking the risk of assuming it's the company who really called you".
A company, even big one people joke about having a complete lack of actual human support agents, may really call you one day. The other 364 days of the year it's probably a scam. The safe bet is to take the issue they called about and contact the official support channel yourself (being careful to get a real one and not an ad/fake site if you need to Google it). It may not always seem the most convenient, but it only takes one mistake to end up in a much more inconvenient place one day.
mandeepj 301 days ago [-]
Include SPAM call blocker in that list! Notably, both iOS and Android have that feature. Never pick the first call from an unknown number! If it's urgent and they are genuine, they'd leave either a voicemail or a text.
sowbug 301 days ago [-]
Has anyone invented something like the TLS three-way handshake, or a U2F challenge, that can use spoken words as a transport layer? People could then be "safely" tricked into reading back "correct-horse-battery-staple" or whatever, because they actually wouldn't have the ability to generate a usable sequence unless the attacker first provided something that only the real site owner could provide.
I'm imagining something with the non-phishability of U2F but the usability of an SMS 6-digit code. Maybe that's U2F.
speeder 301 days ago [-]
I used to manage the Google Ads account of a business I had in the past.
Google Support would call me all the time, and then first thing they would do is ask me to open the interface and repeat some code or another.
klik99 301 days ago [-]
I am a big fan of keepass which I sync with dropbox, good apps exist for iphone/android/mac/windows/linux. But I don't know if that's more secure than a password provider like 1password. At least not fitting into the typical profile, and being able to control the data, open source code, and offline access feels like the optimal way for me.
LeafItAlone 300 days ago [-]
>never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!
Some services even say that when they are indeed codes you are _supposed_ to read back to them. Which clearly helps further train people to ignore that language.
ajross 301 days ago [-]
> — never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!
I tried making this point downthread but it bears repeating higher up. Per OP, this was account with Authenticator enabled. If you have a working authenticator setup, they aren't going to "ask for a code", since by definition you're already authenticated. And while I'm no expert, I really don't think there is such a thing. Recovery for a lost account never goes back to device-in-hand once you have enabled full 2FA.
Something is being skipped in the description of the phish here. I don't think OP is being completely honest.
davidscoville 301 days ago [-]
The code I read to them was a Google account recovery code. That’s how they accessed my Google account. I, mistakenly, believed they needed to confirm I was still alive and the rightful owner of the account.
Then the attacker used Google SSO to perform the initial log in to my coinbase account. Then they opened Google Authenticator, signed in as me, to get the coinbase auth code so they could complete coinbase’s 2fac.
ajross 300 days ago [-]
But... that's an email that would be sent to a non-gmail address, the one on file that you originally registered your account with. And while I don't have copies of the transactions in front of me, these things are not unclear as to their purpose or intent. They tell you straight up that they're resetting the authentication for the account and to be sure you are doing it intentionally. They're also accompanied by warnings that would be simultaneously sent to your active gmail address and to the Authenticator app.
I really think you're reaching here trying to ascribe blame. You... just got phished.
thinker1972 301 days ago [-]
[dead]
LeonM 301 days ago [-]
My best guess is that this attack was purely social engineering, and that no email spoofing actually happened. I think that the email message in question is actually a legit email from Google.
I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google legitimately. By reading back the code in that email, the attacker was able to claim the Google account as theirs, thus access the Gmail inbox to reset the Coinbase password and access the authenticator backups from the Google Drive.
I would be very curious to see the original message headers of the email though.
freeplay 300 days ago [-]
I don't think that email he posted from legal@google.com is legit.
Look at the first sentence of the first paragraph and the first sentence in the second paragraph. Two grammar errors which are a dead giveaway it's fraudulent.
> Thank you for your assistance and understanding during your recent support
call, regarding a ficticious request aimed at accessing your Google
account.
Comma doesn't belong there and "fictitious" is misspelled.
> To follow all guidelines of the internal review properly. Please keep a
secure note with the temporary password which your support representative
has provided to you.
Out of place period. Should be a comma.
Legit, canned emails like this (especially from legal@google.com) would be proofread much better than this. It's fake.
furyofantares 301 days ago [-]
Yeah, that part doesn't add up. If the email was sent by the attacker, why did it have a code he needed to give the attacker?
davidscoville 301 days ago [-]
Yes, at least two emails. One was the spoofed email from legal@google.com (which sadly convinced me this was legit) and the other was a Google recovery code email.
The spoofed email was deleted by the attacker, but I have a copy because I forwarded the email to phishing@google.com (something ChatGPT told me to do). The attacker then deleted the original but when I got my account back an hour later, Google bounced back the email. So that is the copy I have and the headers are not super helpful.
What was the process for getting your account back?
wmf 301 days ago [-]
I think the attacker asked him to read an SMS code.
301 days ago [-]
Beijinger 301 days ago [-]
"reset the Coinbase"
You must be insane to use gmail for anything like banking, crypto, domains.
I lost access to my gmail account. I know the PW but I can't access the 2 factor authentication anymore.
kevin_thibedeau 301 days ago [-]
This is why 2FA isn't all it's cracked up to be. Strong passwords kept in your head are less brittle than managing something you can lose. If you have a real support channel (like employer IT) to deal with loss it's workable. Online services with no support is just asking for trouble.
TheDong 301 days ago [-]
2FA can be all it's cracked up to be. A Yubikey you have to physically possess, and physically touch, to login to a site is completely immune to this.
Yes, you need to buy hardware, yes you need 1 or more backup yubikeys in a bank safe somewhere in case your primary one breaks, but it is actually safe.
Strong passwords in your head are bad because they're even more phish-able. Like, with FIDO2, my yubikey will not login to "fake-coinbase.com", the attacker cannot proxy the data they get from the yubikey. For 2FA TOTP codes and for passwords, a phishing page can just proxy through the stuff to the real coinbase and login (as happened in this attack).
Beijinger 300 days ago [-]
Yubikey is great. But I would be scared as f. to lose it when traveling abroad.
Sure, have a second one at home that can be Fedexed to you.
commandersaki 300 days ago [-]
Eh just use a password manager; I use 1Password, it sync's to all my devices, I keep backups of everything (export primarily in json), autofills the 2fa codes, etc.
301 days ago [-]
digianarchist 301 days ago [-]
1password + hardware keys - I am not a large target though and use crypto transactionally.
nixosbestos 301 days ago [-]
I'd certainly be insane to take security advice from people who don't use password managers
john_the_writer 300 days ago [-]
I mean. I have a little book on my desk with password hints. "2nd grade best friends phone number", "birthday of first dog". It also has a grid of random numbers/letters on the front page, so I can write "first_crush_b4*5". You'd have to have physical access to the book, and know what the hint leads to. It's un-hackable. I mean aside from social, or physically breaking into my house.
nixosbestos 299 days ago [-]
Which doesn't do a darned thing to keep your from getting phished. Which again, keeps popping up on HN, over and over and over.
nixosbestos 300 days ago [-]
downvote all you want, this is third time in a month that basically "opsec" failure would've been prevented by a password manager that binds to domains, or passkeys. Both of which people regularly kvetch about here.
barbazoo 301 days ago [-]
> Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly.
I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.
> The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.
Ugh, google
arethuza 301 days ago [-]
I usually don't answer calls from numbers I don't recognise - but a couple of days back it was a scammer claiming to be from Amazon - said I had ordered an iPhone for £600 and was it a real order.
I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was...
I must have stayed on the call for 20 minutes, eventually they ended up swearing at me - all the time I could hear other people in the same room trying the same lines on different people. I have no idea why I stayed on for so long....
unyttigfjelltol 301 days ago [-]
Even when you know it’s fake, the whole thing is very disconcerting. I received a scam call ostensibly from a local utility and filed an identity theft report with local police naming the utility as “victim”. The caller even told me where they (probably really) were. Police do nothing, scams continue until something breaks.
arethuza 301 days ago [-]
A few years back I got a call from a scammer selling a device that would help stop scam phone calls - that actually took me a while to realise it was a scam (this is like 15 years ago).
zamadatix 301 days ago [-]
Would (the actual) Amazon even agree to provide this kind of information over the phone to someone?
mmmlinux 301 days ago [-]
is talking to amazon on the phone at all even actually possible?
giantrobot 301 days ago [-]
That's the easiest way to spot a scam: "Hello this message is from Google customer service..."
nebezb 301 days ago [-]
Yes, and it’s the best way to get support too! They’re real helpful.
galaxy_gas 301 days ago [-]
I get this kind of call about 5-15 times a day
I do not answer calls
arethuza 301 days ago [-]
A lot of them phone me and ask for my wife by name "Can I speak to XYZ" - I usually reply "No" and end the call. Actually, for the last few calls I've not even been saying the "No".
Maybe 3 or 4 of these a day <sigh>
tartoran 301 days ago [-]
You should not even respond to these. Responding gives them some valuable information about your phone number. Just junk it + report as spam.
galaxy_gas 301 days ago [-]
I wonder, how this in affects modern software stack that have AI with the AI Call Screening which will ask questions, you can automatically identify certain dimensions: phone is active -- phone has a plan,-- phone is a Pixel or iPhone with a specific minimum model and OS ver ?
Then because of the leak side channel effect they can further future target calls such as coming from google about your problem with "your pixel 9 or 10?"
crawftv 301 days ago [-]
The biggest red flag in all these stories is getting a call from a customer support person trying to help you.
When it seems like it’s impossible to get ahold of them in a real emergency.
jfim 301 days ago [-]
I've actually gotten legitimate calls from the bank, although the correct way to handle those is to say that you won't give any information to them but you'll call them back.
kimixa 301 days ago [-]
When my account had a fraud alert they called me just to say I should call them back immediately on the number on the back of my card.
I assumed this was normal.
john_the_writer 300 days ago [-]
This is awesome. Great job your bank..
301 days ago [-]
lo_zamoyski 301 days ago [-]
Amazing they would call and request information, given how many institutions advise never to do that.
What a shit show.
speckx 301 days ago [-]
I get legitimate calls from my health insurance company. When they call, they are not allowed to say the company they call from, it's a HIPAA thing. Once I say the name of the health insurance company, they will confirm it. It's weird, but it's the way it is now.
e40 300 days ago [-]
My health insurance company asks for me by name (“is this …?”). And it’s to a number they know.
fkskammerz 301 days ago [-]
It doesnt seem to be a red-flag. The caller was calling as an Attorney from Google General Counsel responding to an estate request. They followed up with a spoofed @google.com email with their name corroborating the call.
ghurtado 301 days ago [-]
You're missing the point.
They're saying that the least likely part of the cover story is that Google would proactively reach out to you in order to help you personally with the service you are (most likely) paying zero dollars for, and assign one of their most expensive employees to the case.
golan 301 days ago [-]
As of late, I have one rule: Any unknown number I'm not expecting I let it go to voicemail, where I have a message along the lines of: leave your message and your number, and if it's important I'll call you back. The only time I pick up is when I am expecting, say, a delivery, or a doctor's call, etc, and in those cases I'm only expecting to hear about a delivery or a doctor's call, etc. Hoping that can filter and help on this front.
paleotrope 301 days ago [-]
I have a 1-2 second rule. I pick up I say hello, if someone doesn't respond in 1-2 seconds, I hang up.
They have the scammers working off phone queues, it takes a little bit of time to get the call to the scammer, who has to start off with a script, so there's a delay.
Remember, the scammer, also likely not a native english speaker, also probably bored out of their mind, has to spin up, they have to read the name, understand how to say it and then say it out loud. Their is a mental startup time that a normal conversation doesn't have.
If someone calls you and isn't ready to immediately respond to "hello" it's a scammer.
zamadatix 301 days ago [-]
I try to avoid picking up and saying anything because it seems like an advertisement "yes, this number is not only active but a real person who answers random calls - try calling back (possibly from a different number) later".
tejohnso 301 days ago [-]
I don't even pick up calls from unknown numbers. I use call screen. Most people hang up as soon as they hear it, or they don't say anything at all. Once somebody did start speaking sensibly and a personal matter and I picked up and continued the call normally. Probably my favourite feature since upgrading to a reasonably modern phone.
In those 2 seconds, do you count the inevitable preamble of "Hellooooo... Hello? ... Heeeello? Yes now I can hear you." or is that just me?
rightbyte 301 days ago [-]
Whenever I have bluetooth headsets in a 20m radius from my phone I do that too.
aj7 301 days ago [-]
I use a variation of this. I answer but do not speak. A legitimate caller will speak immediately.
craftkiller 301 days ago [-]
Not always true. My landlord recently had a contractor call me. I did my usual "pick up and don't say anything" routine for unrecognized numbers, and the contractor silently hung up and never called back. Thankfully my roommate actually answered the call, but pick-up-shut-up prevents legit people from leaving voicemails and sometimes prevents legit people from reaching you entirely.
Personally, I would utter a confused "hello?" if I was calling somone, the ringing stopped, and no one said anything, but I guess not everyone would.
brewdad 300 days ago [-]
I could easily see someone like a contractor calling from the road or otherwise not paying full attention to their phone. They likely never realized you answered and needed the "hello" to refocus their attention.
lo_zamoyski 301 days ago [-]
Let it go to voicemail.
nerdsniper 301 days ago [-]
As with 'craftkiller, I've noticed that I do need to make some kind of noise. I've settled on subtle light coughs or grunts (nothing anyone would think twice about, but which will definitely trigger a "oh this is a human!"). I figure it might still fool some percentage of automated systems which detect whether a human (and which human) is actually there or not based on automated transcription.
mihaaly 301 days ago [-]
In my experience organizations providing services to me for money nowadays ususally just send mail instructing me calling a central number where I can be in the 15th place of the call queue. In case they call they do whenever they please, which is the most inopportune occasion in most cases (in the loo, in transit, in a conversation, basically busy with life!). In best case leaving a message mumbling quickly in a sound quality sounding like sitting in a bucket in ungoverned Afghanistan, with the suspected sense of calling them back on the central number (incomprehensible).
Getting a procative call for my benefit would make me very suspicious about the authenticity of that call!
atm3ga 301 days ago [-]
I've set my phone to not answer unknown callers (those not in my address list) and more importantly, I've done this for my parents as well and further instruct them as often as possible to not believe anything they get in email. With all of this, my mom still will reach out at least once or twice a year in a panic about some scam email she thinks is real.
general1465 301 days ago [-]
Well easy to say, but if you are working in the real world, then unknown callers may be important - i.e. FedEx trying to push your package through the customs and if they can not contact you, your package goes either back or is destroyed.
yulker 301 days ago [-]
Legitimate callers for events you initiated leave messages. The correct avenue for critical notifications not initiated by you is still paper mail.
RHSeeger 301 days ago [-]
But your child's school nurse might not, in an emergency.
yulker 301 days ago [-]
Your child's school nurse would be exactly the type of person who would leave a message
brewdad 300 days ago [-]
Not necessarily. Ours would work down the list of numbers she had for me, my wife, and other emergency contacts without leaving a message. My wife got pulled out of a meeting at work once despite me being the parent at home because I missed a call from the school and they didn't bother to leave a message.
john_the_writer 300 days ago [-]
They might not.. But you'd very likely have their number saved on your phone. Might even have them as an un-mutable contact. My wife/kids and their school are all on the "never mute" list.
RHSeeger 298 days ago [-]
> But you'd very likely have their number saved on your phone.
I certainly don't. Every call I get from the school seems to come from a different number. And the camp she was at when she hurt her leg and had to be taken for immediate medical attention.
I get it, in your world, in your experience, it all works out. But in mine, it just doesn't. From experience, I _know_ this is true.
atlanta90210 301 days ago [-]
If you have an iPhone, the latest iOS 26 will answer unknown numbers not in your address book for you and ask what they want and then alert you to see if you want to take the call.
throwaway7783 301 days ago [-]
I didn't quite understand this part. Attacked has access to Google accounts because Google had cloud-synced my codes? What does that mean?
riffraff 301 days ago [-]
The other way around.
The attacker had access to the Google account which includes passwords from Chrome and also the 2fa codes stored in Google Authenticator, because those were synced to Google without the author noticing it.
So with passwords and 2fa the attacker could login to Coinbase too.
remus 301 days ago [-]
They gained access to the Google account by stealing the verification code over the phone, but then they had easy access to other accounts (e.g. coinbase) because they had access to 2FA codes because Google authenticator was backed up to the users Google account.
throwaway7783 301 days ago [-]
Ah, makes sense. The victim was social engineered first.
prawn 301 days ago [-]
“never answering my phone when someone calls unless I'm expecting a call”
Friend’s mother got scammed. She’d contacted tech support and they said they’d call back. Then a scammer just happened to call her within that next hour…
everybodyknows 300 days ago [-]
Call center worker with a sideline business?
prawn 300 days ago [-]
Tech support scam calls are common enough that I'd believe it just being coincidental timing.
thebytefairy 300 days ago [-]
> Ugh, google
In my experience most authenticators cloud sync automatically, at least on iOS. For most people, this is a benefit. Otherwise, lose your phone and you're stuck, I doubt most people secure recovery codes properly either.
pc86 301 days ago [-]
> I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.
The answer is almost certainly greater than 0.
AJ007 301 days ago [-]
If you have to have use a phone, at minimum disable notifications and never answer it. First it removes all of the urgency. Second, the caller has to provide some way for you to contact them, which gives you a second point of contact to validate.
Never, ever, use a cloud password manager, that's just dumb. Combining these things together in some sort of master account -- be it Google, Apple, Microsoft -- is also terrible. It's like leaving all of your savings accounts, checking, and investments at a single bank.
All of this stuff is going to get way worse because of AI. You'll be talking to real people you know personally who are 100% not AI but were tricked in to asking you to do something by other AI enabled scammers. However aggressive I've suggested people be in the past probably isn't going to be enough for 5 years from now.
These things have always been possible, and have been done, but now they can be done at scale, with advanced testing to figure out what works on who, whereas before it was targeting the guy who kept posting pictures of expensive watches on his public Instagram.
pavel_lishin 301 days ago [-]
> If you have to have use a phone, at minimum disable notifications and never answer it.
Great advice for someone who doesn't have children or family members with health conditions.
GoatInGrey 301 days ago [-]
The charitable interpretation is that they meant to not answer a call from someone not already in your contacts.
drillsteps5 301 days ago [-]
> Never, ever, use a cloud password manager, that's just dumb. Combining these things together in some sort of master account -- be it Google, Apple, Microsoft -- is also terrible. It's like leaving all of your savings accounts, checking, and investments at a single bank.
Do people actually downvote this? Seriously???
vehementi 301 days ago [-]
It's honestly irresponsible to pick up phone calls at this point. Phishers are really good, and every human has some weakness, so you can't guarantee you wouldn't fall for something -- perhaps one day a new vulnerability comes out and your old guidance is no longer perfect. Answering the phone at all is just putting yourself at risk
pdonis 301 days ago [-]
I don't answer calls from numbers I don't know, period. (In fact I routinely have my phone in Do Not Disturb mode so only a few numbers, the ones I have in my favorites, will make the phone ring at all.) If it's urgent enough to the caller (either because they're legit or because they're a scammer and are trying particularly hard), they'll leave a voice mail. (I've had plenty of fraudulent voice mails.) If they claim to be from some company I have a relationship with, I check independently to see if something's up. This incident illustrates why, even if it seems like a call is legit, if you didn't initiate the call, you shouldn't even be talking.
I also don't leave any information I'm worried about someone stealing in my Google account. I find it hard to understand how anyone in tech could fail to see how risky that is.
fsckboy 301 days ago [-]
I understand the dangers of answering scam calls, don't explain it to me
but you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number. maybe they don't, you may know that, but I sure don't.
pdonis 300 days ago [-]
> you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number
I'm assuming no such thing. I have indeed gotten calls and texts from my bank and my credit card companies alerting me to fraudulent transactions, that were legit calls and not scams.
But I didn't answer those calls or texts directly, or try to figure out whether the number that was calling me or texting me was the right one. What I did was to call a number that I already know, independently, leads to my bank, or to my credit card company's fraud department. Or I independently logged into the bank's or credit card company's website to see if there were any alerts. And if there were, I acted on them.
I described this in my earlier post: "If they claim to be from some company I have a relationship with, I check independently to see if something's up."
joe_the_user 301 days ago [-]
I don't think security at most bank will ever call you about a transaction. At best they may text you. But if you get some communication there's a problem, if you talk to someone, you should call the official number rather than someone who calls you.
pdonis 300 days ago [-]
I've gotten both calls and texts from my bank and credit card companies about fraudulent transactions. Indeed, I want them to do that, so I'm alerted as soon as they spot something fishy.
But if I get such a call or text, I don't answer it. Instead I do what you describe--call the official number that I already know independently. (Or I log in to their website to check for alerts.)
apsurd 301 days ago [-]
ignorance is not a defense.
It's true, unknown calls are 99% spam. That's on you if you'd want to believe otherwise; by your own admission, you don't know.
Yes, important companies you do business with you will come to store those in your contacts. You'll have specific account reps even. Services, apps, don't call you, for this very reason, they have in-app confirmation flows.
torton 301 days ago [-]
They can leave a voicemail.
spixy 301 days ago [-]
Bank or government use to call me about important stuff (when I messed up tax report, because of my mortgage, etc.), so not answering is not always a good idea.
And nobody use voice mail in EU, it seems to be an US thing.
pdonis 300 days ago [-]
> not answering is not always a good idea.
Sure it is. Just because you get a call about an issue that turns out to be legit, doesn't mean you need to resolve that issue by answering the call.
I describe upthread what I've done when I've received calls or texts from my bank or credit card companies about issues.
gargan 301 days ago [-]
You don't need a spoofed email to steal someone's crypto. Criminals can just hold a gun to your head and demand your keys.
It's happened lots of times and it's why traditional banks are way more secure than crypto.
Well done to the author for talking about it, but I hope the real lesson is learned that crypto isn't a real store of wealth and can be stolen at any time....
pavel_lishin 301 days ago [-]
True - but a phone call scales much easier than driving to someone's house with a gun.
lo_zamoyski 301 days ago [-]
I've been told that scammers aren't interested in making scams too good, the idea being that you want to select for people who are bad at recognizing a mediocre scam, because they'll be more likely to play along for the entire scam.
prawn 301 days ago [-]
Not just scale either. On the phone you're dealing with people having less fear from local repercussions, from reprisal, less care for the community, etc.
ghurtado 301 days ago [-]
> Criminals can just hold a gun to your head and demand your keys.
Sure, but this is Hacker News, not Mugger News.
ajross 301 days ago [-]
You miss the point. You can't mug someone for their Vanguard account. Robbery risk is limited to cash on hand, or arguably whatever the ATM limit is on your bank account.
hvb2 301 days ago [-]
Aren't elderly phone scammed out of huge amounts from bank accounts often??
Legend2440 301 days ago [-]
Yes, but it's more involved. They typically get the victim to withdraw the money themselves, then send it to the scammers via wire transfer.
Like crypto, wire transfers are difficult to track and irreversible.
carlosjobim 301 days ago [-]
There's nothing easier to track than a wire transfer. Banks just don't want to do it.
beeflet 301 days ago [-]
So what is stopping someone from holding a gun to your head and forcing you to conduct a wire transfer over the phone or internet?
Legend2440 301 days ago [-]
Online banking wire transfers are subject to a relatively low daily limit. You must appear in person and show ID to wire large amounts of money.
The victim may also have a chance to cancel the transfer, because they’re not instant. (especially outside of business hours)
It’s just not an attractive way to mug someone, it’s easier to take them to an ATM.
hvb2 301 days ago [-]
This is only true in the crappy system of the US.
In Europe a wire is instant with no recourse.
Most banks have processes for giving money back in some of these cases.
fabbbbb 301 days ago [-]
Not sure about the distribution, often it’s cash or jewelry that’s already home. Bank tellers and even taxi drivers get increasingly educated to stop such suspicious withdrawals/meetings.
doctorpangloss 301 days ago [-]
you're suggesting that the poster is shoving his hate of crypto currencies into this conversation, and not making a sincere statement about security that withstands even the tiniest amount of scrutiny?
janalsncm 301 days ago [-]
Actual risk is lower than that since you’ll possibly get your money back from a real bank.
aqme28 301 days ago [-]
People do get taken hostage until they give up their crypto accounts sometimes. There was a prominent one in NYC recently that was on the news again due to--basically-- the alleged involvement by one of the stars of a popular reality tv show.
beeflet 301 days ago [-]
In cryptocurrency, you can use a multi-signature account to define your own security setup.
For example, even a 2-of-2 setup with a trusted authority like a bank is straight-forward improvement in security over the conventional bank system.
You can go further, for example consider a 3-of-5 setup with 2 keys in security deposit boxes, 1 key on a laptop, 1 key on a phone, and 1 key on a hardware token. You can set the hardware token to erase its keys when the wrong pin is entered, making it pretty rubber hose proof.
hvb2 301 days ago [-]
But no one will require that. When you do, no new money will flow into crypto and the music stops. And no one in crypto wants that.
So you want there to be as low of a barrier of entry as possible, which is how we get here...
Especially when transactions can't be traced
beeflet 300 days ago [-]
It doesn't need to be required of anyone. People are responsible for their own funds and have their own security/effort profiles. The "right way" of doing things will be discovered through natural selection.
If some idiot leaves all of their funds on an exchange like this, and it gets hacked, then good. That's how the market evolves and money moves out of the hands of the incompetent and into the competent.
ProllyInfamous 301 days ago [-]
Multisignature wallets are the answer to this. Also helps spendthrifts (to require group concensus for bitcoin redemption).
Of course, this doesn't help if you don't have trusted associates — and can be (even more) dangerous with multiple people responsible for crypto custody.
Also helps if you have offline ("cold wallet") storage, which would require hours to importPrivKey and redeem. Slow them down...
There's a non-zero chance someone can just roll a new key and it happens to be yours, and poof, your money is gone with no recourse.
It's a tiny, infinitesimal chance: but it's a heck of a lot greater of a chance than the same thing happening with a bank account, especially the "no recourse" part.
Jleagle 301 days ago [-]
I think you're misunderstanding how small the chance of creating the same wallet as someone else is.
There are 2^256 wallets. There are 2^72 grains of sand on earth.
The chance of your bank screwing up is a lot higher, by trillions.
vkou 301 days ago [-]
Let's be realistic.
I'm a huge critic of the cult of crypto, but the odds of a key collision are smaller than the odds of <some highly improbable series of mistakes/coincidences/malice happening that result in you losing your money in the traditional banking system>.
The odds of a 'someone gets access to your account/wallet and instantly drains it with no recourse' are much higher in the crypto space, as the author of the post experienced.
beeflet 301 days ago [-]
The odds of the bank making an error related to your account and crediting you money is far greater than the odds of generating the same keypair as someone else.
QuadmasterXLII 301 days ago [-]
The load bearing question is, why didn't the attacker also clear out OP's bank account, retirement savings, and max out his credit cards? Unfortunately, the difference is that banks care literally at all about their customers accounts being emptied.
QuadmasterXLII 301 days ago [-]
What I specifically mean by "care literally at all" : banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions. This creates sane, linear incentives: banks care 1000x more about a $100,000 fraud than a $100 fraud; they care 1000x more about a scam affecting 100 people than a scam affecting one person, etc.
Unrelated, but for added spice, here's a thread from ten months where everyone agrees you're a fool unless you secure your coinbase account with google authenticator
It's not linear at all. We had our identity stolen through an insurance scam (somebody used our bank account and somebody else's name to open a policy with Progressive, which apparently does not validate ACH debits). This resulted in premiums of ~$300, $300, ~$500, $1002.96, ~$900, ~$900, and ~$3000 as the attacker presumably racked up huge fraudulent claims on the insurance company. The first 3 bills were reversed by Wells Fargo because their fraud policy covers fraudulent charges under $1000. The 5th and 6th were reimbursed because they were reported within 60 days of being made (and were under the limit anyway). The 7th didn't go through because we had detected the fraud and closed the account by then. But the 4th was just over the $1000 limit that they would reimburse, and so they were like "Sorry, nope, you're on your own for that one." We even filed a police report and waved that at them, and they said "We don't care. Company policy." So the very counterintuitive and non-linear result was that they paid for the $300, $500, $900, $900, and $3000 charges, and stuck us with the $1000 one, just because it was $2.96 over their limit. (Part of me really regrets declining to prosecute, but I had a ton of other stuff going on at the time and the last thing I wanted to do was get involved in a court case.)
3D30497420 301 days ago [-]
This is one of the main reasons I don't like crypto. If you get hacked, even if you did everything right, then you're out of luck. The funds are (generally) unrecoverable.
With my bank, I've been able to recover several thousand after a thief was able to bypass the 2FA app used to verify large transfers. (I still don't know how they were able to bypass the verification, and after investigating our bank never told us. Not sure that makes me feel all warm and fuzzy, but at least I was made whole with minimal fuss.)
beeflet 301 days ago [-]
If you got hacked, you didn't do everything right
trog 301 days ago [-]
This is elitist nonsense. Maybe this user didn't do everything right but people are hacked regularly through zero fault of their own.
beeflet 300 days ago [-]
It's your responsibility to secure your own hardware
I'll take the $5 wrench and $10,000 hitman attack that I'm aware of instead of the $0 push-button attack that you don't discover until it's too late.
thrill 301 days ago [-]
In my actual real world experience of digging my elderly mother out of $25,000+ of scam debt, banks do not care at all unless they can be shown to be at fault, and then they weigh the loss expense vs the likely legal expense.
SpicyLemonZest 301 days ago [-]
What kind of scam debt in particular? I’m not blaming your mom, but there’s a big difference for a bank between “someone stole my identity to falsely authorize this transfer“ and “someone tricked me into authorizing this transfer”.
janalsncm 301 days ago [-]
Never thought about it this way before, but phishing an individual is way higher ROI than identity fraud. So we should be extra vigilant about the former.
With the former, your recourse is essentially zero. Banks won’t do anything, cops are useless.
With the latter, banks try to prevent it and it’s harder and riskier.
petcat 301 days ago [-]
> banks have a policy of reimbursing people who had their accounts emptied despite taking reasonable precautions
In USA, banks are actually required by law to reimburse fraudulent account activity if reported within 60 days. However, this does not cover cases where the account holder themselves made the transfers even if they were tricked into doing so.
But if someone gets your login and liquidates your bank account, in USA a least, the bank is 100% responsible for that fraud.
Credit card companies are 100% responsible for fraud regardless. Even if they try to market it as a perk "You're never responsible for unauthorized transactions". Yeah, no shit. It's the law.
jcalvinowens 301 days ago [-]
Banks really don't mind fraud, because they can use fraud to justify higher fees, which they ultimately make more money off of than the fraud actually costs them.
ycombinatrix 301 days ago [-]
yubikey is better
Tharre 301 days ago [-]
The flip side of that of course being that they increasingly force you to do your banking on a locked down smartphone for the same reason.
Doesn't seem like there's a lot of middle ground between being responsible for your mistakes and being treated like you can't be trusted to make your own decisions.
calmbell 301 days ago [-]
And transferring money from a bank or brokerage account takes time. Enough time that anyone paying attention should be able to report the transfer as fraudulent before it completes and have the account frozen.
dist-epoch 301 days ago [-]
It depends. In UK a transfer is instant. In most of EU it happens the same day, many times in hours.
zoover2020 301 days ago [-]
EU is mostly instant too,IBAN at least.
bdangubic 301 days ago [-]
the banks don’t give two shits about it :)
fn-mote 301 days ago [-]
The difference is that you have leverage to force the banks to care.
There isn't any federal regulation at all covering your Bitcoin.
wmf 301 days ago [-]
Bitcoin exchanges like Coinbase are regulated by the CFTC in the US. This case is more of a Google problem though.
ameliaquining 301 days ago [-]
I don't believe the CFTC has any rules requiring crypto exchanges to reverse fraudulent transactions.
bdangubic 301 days ago [-]
this isn't fradulent - you being silly and allowing someone full access to your account is your fault as much as leaving a wallet a strip club and calling owner joe for a refund
otterley 301 days ago [-]
It is absolutely fraudulent. If you intentionally misrepresent yourself as the real account holder to the financial institution (by presenting credentials that do not belong to you), the institution relies on this misrepresentation, and damages result, that is fraud. Full stop.
wmf 301 days ago [-]
It's generally impossible to reverse crypto transactions so such regulation would be pointless. CFTC could force Coinbase to use 2FA but that was already enabled.
bdangubic 301 days ago [-]
what federal regulation is there where it is your fault that you allowed someone access into your account? name a statute (any state or federal)? :)
thrill 301 days ago [-]
Fraud is fraud. There’s plenty of laws against it.
ameliaquining 301 days ago [-]
The question is not whether it's legal to defraud someone, but what a financial services provider's obligations are if their customer gets defrauded. The answer here is quite different for banks and brokerages than for crypto exchanges.
bdangubic 301 days ago [-]
it really is not. no bank is going to refund you money cause you are a moron (we have all been morons, I am not trying to disparage the person that got scammed, I sympathize with him)
Banks do care because they are on the hook. If someone commits identity theft and steals money from the bank via your account, its on them.
beeflet 301 days ago [-]
There is no such thing as identity theft. That is a term made up by banks to pass the blame for their insecure means of authentication.
otterley 301 days ago [-]
There is such a thing, if you equate “identity theft” with the fraud it enables. Stealing credentials just the first step.
bdangubic 301 days ago [-]
this is not identify theft :)
adrr 301 days ago [-]
As long as he didn't give out credentials to his bank account, he's well covered.
bdangubic 301 days ago [-]
he's most definitely not covered. I would run this scam 24/7 with every bank in America if I was "covered" :)
insane_dreamer 300 days ago [-]
but crypto exchanges/wallets give even fewer shits :)
ratorx 301 days ago [-]
I’m struggling to understand the chain of events, because the story starts midway. Is the claim that JUST the 2FA code was enough to pwn everything with no other vulnerabilities? If that’s the case, then that’s a way bigger problem.
Or (given the password database link at the end), is the sequence:
1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then password reuse?)
2) attacker has access to password
3) attacker phishes 2FA code for Google
4) attacker gains access to Google account
5) attacker gains access to Google authenticator 2FA codes
6) attacker gains access to stored passwords? (Maybe)
7) attacker gains the 2nd factor (and possible the first one, via the chrome password manager?) to a bunch of different accounts. Alternatively, more password reuse?
I guess the key question for me, was there password reuse and what was the extent, or did this not require that?
Disclaimer: work at Google, not related to security, opinions my own.
davidscoville 301 days ago [-]
I think the attacker had my password, and they just needed a recovery method, which was the code I read over the phone.
I have no idea how they had my password, I never share passwords or use the same password. But I hadn’t changed my Google password in a while.
cpncrunch 301 days ago [-]
No, if they had had the password they wouldn't have needed to do all of that. They could have just logged in, perhaps just needed the 2FA code. However, you say that you gave them both enhanced security codes (I'm guessing this was a gmail backup key), and you also gave them the 2FA SMS code. These are the only two things you need to take over any gmail account, and it doesn't require knowing the password. It's just purely social engineering.
The only question mark is the email from google. It sounds like it was a scam email, so it would be interesting to know whether/how it was spoofed.
ratorx 301 days ago [-]
Gotcha, thanks for clarifying!
And did you have passwords using chrome password manager as well (which were also compromised by the Google account access, and this is how they got access to e.g. Coinbase?), or did they get passwords through some other means and just needed 2FA?
davidscoville 301 days ago [-]
I did have saved passwords in Chrome password manager but they were old. My guess is that the attacker used Google SSO on Coinbase (e.g., "sign in with Google"), which I have used in the past. And then they opened up Google's Authenticator app, signed in as me, and got the auth code for Coinbase.
By enabling cloud-sync, Google has created a massive security vulnerability for the entire industry. A developer can't be certain that auth codes are a true 2nd factor, if the account email is @gmail.com for a given user because that user might be using Google's Authenticator app.
ratorx 301 days ago [-]
Hmm, I see what you mean, although technically this is still a 2 factor compromise (Google account password + 2FA code). Just having one or the other wouldn’t have done anything. The bigger issue is the contagion from compromising a set of less related two factors (the email account, not the actual login).
Specifically, the most problematic is SSO + Google authenticator. Just @gmail + authenticator is not enough, you need to also store passwords in the Google account too and sync them.
Although, this is functionally the same as using a completely unrelated password manager and storing authenticator codes there (a fairly common feature) - a password manager compromise leads to a total compromise of everything.
blactuary 301 days ago [-]
You used Google SSO for Coinbase?
301 days ago [-]
lokar 301 days ago [-]
Did you reuse that password on another site?
I don’t see how this happens if you use strong passwords without reuse.
nixosbestos 301 days ago [-]
500+ comments in this thread and there's still no information as to what the hella actually happened.
I sleep fine at night, this is a Hallmark of these "omg I got owned and it could happen to you!" posts that never quite add up.
pluc 301 days ago [-]
Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.
ratorx 301 days ago [-]
But if you get access to the inbox, then you have a compromised device or the password via some other means right?
Inbox access is a fairly big compromise, even without the 2FA codes.
bdangubic 301 days ago [-]
Inbox is the biggest compromise of them all IMO. I realized this a decade ago and use a different email for every account that I have. None of them have anything to do with my name in any way, I use 4 random words to create new email for any new account that I need. Accidental takeover of any one account does not lead to total take over of my life :)
pluc 301 days ago [-]
You're right, seems they already had his inbox credentials.
cpncrunch 301 days ago [-]
No, it sounds like they got him to create backup codes, which (along with SMS 2FA code, which he also gave them), that is all they need to take over the gmail account. Job done.
301 days ago [-]
oliwarner 301 days ago [-]
We're a bit light on detail here but it's worrying that it's 2025 and Google isn't flagging "looks like" @google.com messages.
I'm assuming this is a dirty unicode hack and not something worse: no DKIM or an actually compromised sender.
The whole thing stinks.
rs186 301 days ago [-]
I never considered Unicode domain names a good idea. Looking at it today, it appears that the only people who use Unicode in domains are scammers and criminals.
Thanks ICANN!
carodgers 301 days ago [-]
I can't believe he omitted that detail. How did they appear to send an email from a google domain? This is especially puzzling given that he says he works in security.
iLoveOncall 301 days ago [-]
Looks like the attacker set "legal@google.com" as expeditor name, so that's what showed on the author's phone, that's it.
oliwarner 301 days ago [-]
Which should trigger every automated alarm bell, as well as SPF/DKIM checks. Which is where this falls apart slightly because in my experience, Gmail is pretty alert about flagging basic things like this.
The headers uploaded are the report email being sent to Google, not the original incoming email. We still don't know how this was spoofed.
karakot 301 days ago [-]
I just put it into subject and that's how it looks like in my inbox
minimal efforts, won't pass any scrutinity but someone panicking might miss it.
Thanks OP for the thread, very enlightening.
oliwarner 301 days ago [-]
The screenshot in TFA shows the subject was "Recent Case Status" and the sender was Google <legal@google.com>. This wasn't as simple as a dodgy subject.
I wonder how many people would fall for that though.
cpncrunch 300 days ago [-]
What exactly is "expeditor name"?
Imnimo 301 days ago [-]
I notice none of the pieces of advice are "don't keep a hundred thousand dollars in a Coinbase account".
atm3ga 301 days ago [-]
I split my crypto assets between Coinbase and what is now a corrupted hard-drive I've yet to recover.
madaxe_again 301 days ago [-]
I keep mine on a broken raid 5 array (seagate flood drives - two failed within hours of each other) in a shoe box. It’s super secure.
beeflet 301 days ago [-]
RAID is cool but It's not much of a backup then if it's always plugged into a running computer. Half of risk comes from some process "intentionally" the erasing the data.
I use the super-sophisticated method of manually copying everything important to an external storage another every 5 weeks or so. That has never failed me.
_-_-__-_-_- 301 days ago [-]
I do the same, but then you should have two copies, encrypted-at-rest and one offsite.
hcknwscommenter 301 days ago [-]
The funniest hacker news comment I've read all year. Funny because I'm essentially in the same situation. I'd bet we are legion.
otterley 301 days ago [-]
I recommend not investing in crypto at all because it’s an attractive nuisance and has no useful purpose other than speculation and money laundering.
vkou 301 days ago [-]
As soon as I read the headline, I knew that the problem was...
> In just 40 minutes, the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.
One of the many, many benefits of irreversible transactions.
> I made mistakes, yes
His first mistake was keeping six figures worth of 'cash' in a wallet that anyone with less than 40 minutes of access to can swipe.
fortran77 301 days ago [-]
Also if you have crypto you should never mention anywhere that you do. No forums, social media, etc.
RandomBacon 301 days ago [-]
They still attack tech professionals living in California. Saying you have crypto will probably move you to the top of the list, but they'll still get to you eventually.
My brother (a tech professional in California) does not have any crypto or social media, and attackers still stole his phone number, which they used to steal his email account, which they then tried to get into a non-existent Coinbase account. He was only out of the time it took to get his phone number back (a couple of hours later).
____tom____ 301 days ago [-]
> Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator.
So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth.
Example: If you log in from a Macbook, and the second auth is sent to your phone, Apple will helpfully forward that code to the Macbook, completely removing the second factor.
UncleMeat 301 days ago [-]
There’s threats and there are threats. Second factors largely exist to prevent password stuffing from password reuse. Even if the second factor is the same device as the device where you are initiating a login this works just fine.
If your goal is to stay safe even after one of your devices is owned then you’ve got a rarer (and way more difficult) threat model.
commandersaki 301 days ago [-]
How did this user Coinbase account get hacked anyways? Did they reuse passwords? Did the attacker even have passwords?
PaulHoule 301 days ago [-]
It doesn’t work because people don’t understand it. They understand they are getting harassed all the time and in a state of terror because you might get locked out from your accounts because you lost a device or because something went wrong with your relationship with Apple, Google, Microsoft and other large unaccountable vendors —- something you may or may not get an explanation of.
Since you’re getting harassed all the time and dealing with opaque rules it is no wonder people are fatigued, make mistakes, are inclined to panic when they get a scary call and hand over the keys, etc.
To add to that, having anything to do with crypto is to put a big target on your back and make yourself vulnerable.
cindyllm 301 days ago [-]
[dead]
joshuamorton 301 days ago [-]
Two factor usually means "something you have + something you know". So your MacBook + your password is two factors.
I've seen references to "three factor" auth which is often a push notification to a phone, and then there's more secure second factors, like yubikeys or code-protected passkeys.
jenadine 301 days ago [-]
I don't know my passwords: They are stored on my MacBook.
joshuamorton 301 days ago [-]
Does your MacBook require you to enter a password to log in?
jiveturkey 301 days ago [-]
MFA is a cargo cult these days.
jimt1234 301 days ago [-]
There needs to be a standard way for customers to authenticate employees representing companies, sorta like a reverse-text-message-code. Maybe, as a customer of a website, I can login to the site (authenticate myself), then generate a code that only myself and someone inside the company can see. Then, I can ask him to read the code back to me so I know he's legit. Does that already exist? I've never heard of it.
joe_the_user 301 days ago [-]
It seems unfair, yeah.
But the main way to know is that companies never call you these days. No company should have and few do have a workflow where an employee will call you "cold" with a problem. Instead, companies email, snail mail or text about a problem and you call them back.
But if someone somehow sounds legit, you ask for the official number and whatever info is need to identify your supposed problem. Then go to the website and verify. Call the number at the website (that you find from your own search, not the caller's info) and then have them verify you.
Empact 301 days ago [-]
My mantra: trust no inbound communications. If something is in fact urgent, it can be confirmed by reaching out, rather than accepting an inbound call, to a number publicly listed and well known as representative of the company.
These scams will only get better, they will impersonate your loved ones, your best friends, your children, and plead with you to save them by handing over money or information, but it will all be a ruse. The only things that can prevent this outcome are: positive ironclad proof of identity / personhood / company representation, or ongoing rejection of belief in inbound communications.
lo_zamoyski 301 days ago [-]
I used to think sophistication was the game, but when I brought up the obviousness of Nigerian prince scams with someone, I was told that the poor quality is a tactic. That is, these scams use scale, so the idea is that mediocre scams will weed those people out who are able to discern the scam and select for those who are easily manipulated. This increases the chances that you'll be able to scam the person.
```
By sending an email that repels all but the most
gullible the scammer gets the most promising marks to
self-select, and tilts the true to false positive ratio in his
favor.
```
ipython 301 days ago [-]
It's so frustrating reading this, because this blog has about 75% useful information, with 25% just left there unsaid.
> On iOS, Gmail doesn’t let you view full headers
True! But Gmail on desktop does provide full headers. Why not post them so the rest of the community can step in and help out?
davidscoville 301 days ago [-]
I lost the original email—the attacker deleted all evidence and then cleared my trash (and yes I tried using the Google tool to find deleted emails, but the attacker cleared that too). The reason I have this email is because I forwarded this email on to phishing@google.com, before the attacker deleted everything. When I got control of my account, and removed the scammer recovery methods (he added a windows device—I don’t use windows, and a Brazil phone number), the email bounced back from phishing@google.com (apparently Google doesn’t accept that address). So what I have is the bounced-back copy.
davidscoville 301 days ago [-]
I updated the post and include the headers & html of the bounced-copy, although I don't think it's very useful.
cpncrunch 301 days ago [-]
I'm not seeing the headers anywhere in the post.
cpncrunch 301 days ago [-]
Ok, I see them now...for some reason it took a while for the article to be updated.
vehementi 301 days ago [-]
They're not saying they can't get the headers, the point is that if you're using iOS you don't have access to the headers to validate
blevinstein 301 days ago [-]
I avoided this exact scam. The most important thing is to never trust an incoming phone number. If they can't give you a publicly posted phone number that you can call inbound, they are a scammer.
Google has dozens of properties and it is easy to generate an email from one of them that seems to confirm the attacker's identity. Never trust any of these to identify a legitimate representative.
vessenes 301 days ago [-]
I too avoided it; I had an interesting interaction with the (American) call center scammer -- he called, said his story; he gave me a callback number when asked; I asked him for a web page I could verify a callback number. He quickly rattled off a legitimate Coinbase webpage URL, I believe their ToS page, which does include a phone number. He then hung up rather quickly.
Sadly for the scammers, that number didn't match. But, I note it was part of his script to sound confident and give a working URL. Pretty strong.
____tom____ 301 days ago [-]
They frequently have nicely done webpages, which have this phone number on them. So you need to find the URL yourself.
bo1024 301 days ago [-]
It's already hard to verify if a phone number is legitimate, and I think it will get harder. And on the other hand, easier to get a search engine AI to incorrectly spit out the wrong number.
rwmj 301 days ago [-]
Does anyone know how the email from (or appearing to be from) @google.com works? Wouldn't the Apple account reject it because it fails DKIM/etc?
fastest963 301 days ago [-]
Yeah, I don't understand how it passed DMARC and why it wasn't rejected immediately by his mail server (Apple Mail?).
youngtaff 301 days ago [-]
From the article he uses gmail I think
neuronflux 301 days ago [-]
They probably sent it from gmail which would pass the SPF check (google.com and gmail.com have the same SPF).
They wouldn't have it signed to pass DKIM, but google doesn't use strict alignment checking so to pass DMARC either SPF or DKIM are acceptable.
Yes, SPF (the original design) is horribly broken and trivially bypassed. The most prominent design flaw is that the inbound SMTP service uses the SMTP (rfc5321) MailFrom address for SPF validation, which is not the same sender address shown to the recipient, they can only see the the message (rfc5321) 'From' header address. SPF originally didn't require the domains in the MailFrom and From addresses to match, so an attacker would simply use a domain they control in the MailFrom address, and the 'spoofed' domain in the From header.
That was in 10 years ago though. DMARC fixed this by adding the alignment requirement, meaning that the domains in the MailFrom and From address must match. By default the alignment policy is 'relaxed', meaning that the MailFrom and From domains can differ in subdomain, as long as they share the same organizational domain. Setting the SPF alignment to strict (aspf=s) like you mention in your post requires the domains to match exactly, with no subdomain differences allowed.
So, it doesn't matter that Google doesn't use strict SPF alignment in the DMARC policy, the fact that they have DMARC already adds the requirement to SPF validation that the domains must match.
Yes, google.com and gmail.com use the same IP ranges in the respective SPF policies, but Gmail will never allow you to send email addresses from a domain that you do not own. This is why domain validation is required when you set up Gmail with a custom domain.
The only scenario where your explanation would hold up, is if the attacker was able to gain control of the DNS of a subdomain of the google.com domain, and successfully validated it as a custom domain in Gmail, then send emails from that subdomain in rfc5321.MailFrom address and the google.com domain itself as the rfc5322.From domain.
BCM43 301 days ago [-]
I'm pretty confident gmail's servers don't let you send with headers matching @google.com email addresses you don't control though.
Avamander 301 days ago [-]
Can't practically require both SPF and DKIM with DMARC anyways. Doing so would also be dumb as it would break forwarding (even when DKIM would otherwise remain intact).
Deprecating SPF would do everyone a favour though. Especially for reasons like these.
neuronflux 301 days ago [-]
SPF alignment ensures the MAIL FROM domain matches the From header.
DKIM alignment ensures the From header matches the domain in the DKIM signature header.
In the DMARC policy, you can set both adkim=s and aspf=s.
Google owns and manages all of this, so they can send emails with a google.com MAIL FROM, a google.com header, and signed with a google.com DKIM key. And they could do likewise with gmail.com emails.
I'm not clear on why this isn't practical, perhaps there is something I'm missing though? I would appreciate your viewpoint.
Edit: I see you added a point about forwarding.
Avamander 301 days ago [-]
DMARC specifies that SPF alignment is checked for the domain in the MIME From. The domains in SMTP and MIME From do not have to be the same (nor both align).
Your MTA can still check alignment for both HELO and SMTP From as specified by SPF's RFC(s) though and spam filters often do for extra information/signal.
DMARC's adkim/aspf aren't basically supported in practice. Nor they should be. For reasons already mentioned, as you already read.
teraflop 301 days ago [-]
So any message from Gmail is treated as legitimate for google.com, and yet Gmail can't do its own checks on outgoing mail to ensure that unauthorized people don't put legal@google.com in the From: header? Seriously?
cpncrunch 301 days ago [-]
No, gmail will never let you send from an address you don't own.
Flimm 301 days ago [-]
I've received a phishing email from an @paypal.com email address. (The From: header showed an @paypal.com email address.) Fortunately, the text of the email itself was fishy enough to make me realise it wasn't legitimate. I have no idea how it passed spam filters. I reported the email to both PayPal and my email provider, and I never heard back.
noname120 301 days ago [-]
Can you download the email as EML and paste the content here?
traceroute66 301 days ago [-]
> Wouldn't the Apple account reject it because it fails DKIM/etc?
Yeah, I would be curious to see the actual email headers of what was received.
As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.
valleyer 301 days ago [-]
> this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer
A few do, but most do not, and certainly Apple's automated-system e-mails do not.
Avamander 301 days ago [-]
How would recipients know to expect an S/MIME signature though. It's not like it's enforced by MTAs like DMARC is.
traceroute66 301 days ago [-]
IIRC, if you're using Apple's Mail client it gets validated against the root cert shipped with MacOS/iOS. You get a little black tick next to the sender.
In theory, third-party places like gmail could (should ?) automagically verify S/MIME sigs where a root cert is readily available.
Avamander 301 days ago [-]
Support for verification is indeed widespread, but if it's missing there's nothing to verify.
There's no system in place to warn the user when there is no signature and that there should be one.
bradly 301 days ago [-]
Probably not the same attack vector, but I've gotten phising emails from a real googlemail.com addresses by the scammer abusing backscatter spam and the reply-to address.
fkskammerz 301 days ago [-]
I use gmail and i was attacked almost identically and the email came thru to my gmail with a @google origin account
davsti4 301 days ago [-]
More details would be great, like the headers.
beambot 301 days ago [-]
There have been cases recently of exploits that successfully spoof valid DKIM credentials too:
I’ve heard scammers use Google tools like Google forms or Google cloud to send out fraudulent emails that appear like they come from Google.
thrill 301 days ago [-]
The latest attempted scams I’m getting on my gmail account are fake postmaster bounces “from” google.com.
narrator 301 days ago [-]
I got scammed because somebody put a fake bank location into Google Maps and so the Google voice caller ID said it was my bank. Luckily, I realized I got scammed and called the bank up right away and they got the charges reversed, which is why I still use that bank. Moral of the story: never trust inbound calls. They are the easiest vector for scammers to spoof.
themafia 301 days ago [-]
It's insane that telephone service companies aren't getting greater scrutiny in all of this. For marginal profits they're allowed to create giant financial craters in the lives of citizens.
Why do banks have to "know their customers" and telephone providers don't?
ianburrell 301 days ago [-]
Telephone companies are required to implement the STIR/SHAKEN protocols to authenticate phone calls. But it doesn't seem to have stopped the flood of scammers.
I have read that one problem are VOIP systems which can spoof outgoing phone numbers. It sounded like these are easy to attack. Or maybe scammers just make fake VOIP calls from overseas.
BizarroLand 301 days ago [-]
Same for emails. If you didn't reach out to the person first, don't trust ANY email with alarming call-to-action text, especially if it contains a link to where you can take care of the issue.
quantified 301 days ago [-]
Mistake cost him 80k. Author is feeling burnt, but the cost is the cost at transaction time.
saaaaaam 301 days ago [-]
Extending this further, based on the stated value it looks like he probably had 40 or 50 ethereum. He might have bought them for a fraction of today's price - say $50 - so might only be out $2500 based on cost at transaction time...
thevillagechief 301 days ago [-]
If someone made away with all my retirement savings, I wouldn't say I was only out the cost basis.
saaaaaam 301 days ago [-]
That was pretty much my point!
thevillagechief 301 days ago [-]
Yeah, I missed that.
vehementi 301 days ago [-]
Your analogy is different. They bought for X, then when it was stolen it was worth 80k, and at this random time today, it's worth $120k and he's saying he lost $120k.
saaaaaam 301 days ago [-]
Value is arbitrary, and only crystallises at liquidation. I have a painting I paid £300 for. Works by that artist are now selling for £10000. Does that make my painting worth £10000? I can send it to be appraised but even if it is valued at £10000 that value could only ever be realised if I send it to auction. If I wait too long the artist may fall out of fashion and the work may be worth less than I paid. The real value is the pleasure it gives me each day when I look at it. Is that worth more or less than £10000?
vehementi 297 days ago [-]
Be that as it may, it's missing the illogical point the other person raised. If your $300 painting was worth $10k when it got stolen from you, but 7 years later the market value is $1M, you don't say "I was robbed of a million"
elAhmo 301 days ago [-]
I have a feeling if ETH went down in the meantime, blog post would reflect 80k, not the lower value.
shocks 301 days ago [-]
Incorrect. Author may not have had the required savings to rebuy the position he wanted.
nradov 301 days ago [-]
The author can simply buy a "position" in Monopoly Money instead. It's just as useful as cryptocurrency, and as a bonus harder to steal!
jenadine 301 days ago [-]
But harder to resell for a multiple of the buying price later.
like_any_other 301 days ago [-]
> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
Can somebody explain what exactly this means, and how it works?
goda90 301 days ago [-]
No clue how it works functionally these days. But it reminds me of tricks we pulled back in high school programming class. Our school was using Novell NetWare, and some students were given email addresses for various purposes. We discovered you could edit the From field, so it would display any text as your name and then your email address after it to the recipient on Novell's email client. If you added enough text, including whitespace, it would push the actual email address off screen(I don't remember if you could scroll to it or not).
We trolled each other in class with it a bit. But at one point some student not in our class sent out a mass email, which was against the rules. I replied with a From line as "Administrator" and a bunch of whitespace, telling the girl that she broke the rule and would be suspended for it. Our teacher made me apologize, and I was lucky that I didn't get into more trouble beyond that.
Basically, the from field on an email can be anything you want. It's like sending physical mail and using a fake letterhead with someone else's info, just type what you want. No verification.
That's sometimes a good feature. Like, a third party provider can send newsletters on behalf of company A. But can also be bad, when used for phishing.
However, the email doesn't just appear in your mailbox. It comes to your email provider by another server connecting to it and sending the email. Spf allows the owner of A.com to specify which IPs/servers are actually acting on their behalf. So if I get an email from something@A.com, I can lookup and verify that the sending server is one to trust. If not, the email client should reject or warn the user somehow.
tryauuum 301 days ago [-]
DMARC does check the from field in the mail, so I don't know how could this happen
matsemann 301 days ago [-]
Yeah, sorry if that wasn't clear in my explanation. Without these in place, you will accept anything from anyone claiming to be @A.com,but with dmarc the whole point is to flag when they're only pretending to be.
I'm pretty surprised gmail didn't flag this at least. When I did it for a class in Uni, it always let me know that the FROM header didn't match the sender since that's a clear attack vector
like_any_other 301 days ago [-]
His phrasing is very confusing - claiming the "from" field was spoofed, but that if he could see the "full header", he could have spotted the spoofing.
I would also assume something as prominent as the Gmail website/app for iOS, and the google.com domain, would have all possible email security features correctly configured.
So.. is this not the case? Or is it, but due to bad UI, despite all this security, any schmoe can send email appearing to come from google.com, and I have to pore over unspecified details in the "full header" to spot a fake?
Avamander 301 days ago [-]
It could indeed be that some MUAs only display the comment section. In theory you can use a MIME from like '"Google <google@google.com>" foo@example.com'. Though most spam filters heavily frown upon garbage like that. Things like '"Foo (google@google.com)" <foo@example.com>' will likely pass though. (It's commonly done by shit forwarders.)
Apple Mail does allow you to see the actual sender if you tap on the name though. Outlook has been way worse in that aspect, by not letting you see the full sender. At some point it even saved these fake addresses automatically in your address book if it matched a contact's name or something. (I couldn't find the thread about it right now, but it has been discussed elsewhere.) It's a disservice to everyone except attackers to be honest.
vehementi 301 days ago [-]
On obvious spoofs I see "legal@gmail.com <via scamdude@askjdfaskldfj.net>". I think he means that it didn't indicate the latter. And if gmail phone app didn't fail to display headers he could have looked
throw_m239339 301 days ago [-]
It's my understanding that emails have headers, just like http responses, and the app might have displayed that fake header instead of verifying the provenance of the email and displaying where it actually came from. So it is a UI/UX issue.
alaithea 301 days ago [-]
Why email clients have started hiding/not providing access to headers is beyond me. It seems like an anti-pattern. There have been many times recently where I've wanted to check the headers because an email was suspicious, only to find I couldn't.
m4tthumphrey 301 days ago [-]
> I answered
This is honestly the cause IMO. I refuse to any call from any number not in my phone book, UNLESS I am expecting a very specific call and if it’s not who I expect, I hang up with no conversation.
sequin 301 days ago [-]
How did they get the passwords to his Google and Coinbase accounts? He reused passwords? The same one for Google as for Coinbase? Or did they reset his Coinbase password via his Gmail? The post doesn't make this explicit, but it warns against password reuse.
davidscoville 301 days ago [-]
I believe they logged into coinbase with Google SSO. And then they used my Google Authenticator codes which were cloud synced as the second factor auth method.
A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.
avree 301 days ago [-]
This isn't something "auth engineers" can control, there's no magic Google Authenticator flag on a 2fa code - it's all HMAC and numbers, you don't know if the code came from Authy, Google Auth, a homebrew code generator, a dongle, etc.
wmf 301 days ago [-]
It sounds like we're back to physical Yubikeys as the only secure auth.
moduspol 301 days ago [-]
Seems reasonable if you need to secure five figures or more in crypto.
acdha 301 days ago [-]
Passkeys also solve this even if they’re not hardware backed. He was able to give them a code but wouldn’t have been able to do a passkey handshake for a domain which isn’t Google.com. Plus they’re easier to use and faster.
wmf 301 days ago [-]
I don't know about that. If they can hack your Google/iCloud account they can add a new device, sync all your passkeys to that device, then log into all your other accounts.
acdha 301 days ago [-]
How do they do that if you are incapable of giving them a valid authentication code?
I don’t use Google but at least in the Apple world you also get a fairly different prompt for enrolling a new iCloud Keychain device than simply logging in. Obviously that’s not perfect but there is a good argument for not getting people accustomed to hitting okay for both high and low impact challenges using the same prompt.
ameliaquining 301 days ago [-]
But they can't hack your Google or iCloud account if it's secured with a passkey, unless they have some other non-phishing means of doing so, which the attacker in this story presumably did not.
Symbiote 301 days ago [-]
I had to reset the 2FA for a domain admin account for Google Apps earlier this year — I'm not sure if my password manager somehow lost the passkey, or if I missed creating one before some deadline. (It's a little-used domain.)
I think I requested the reset with various details, then had to wait 24 hours before continuing.
acdha 301 days ago [-]
I feel like a lot of things would benefit from that time delay and, perhaps, an in person check like the notary ID verification AWS used to use.
About a decade ago I had suggested to Google at an identity forum that they embrace a local government/organization model for their hard-landing account recovery process (since it can ultimately devolve to an ID check) by having a mechanism where you can start the account reset process and get something which could be taken to a third party to approve after they do an ID check. As people increasingly depend on things like email accounts for everything there are a constant stream of people who will lose access to their phones but could easily visit a notary, library, DMV, police station, etc. and pass a check against a pre-registered government ID.
davidscoville 301 days ago [-]
Exactly. Google created vulnerabilities for the whole industry by introducing cloud synced Authenticator codes.
commandersaki 301 days ago [-]
Similarly the SSO sign in, which I think is much worse. Though arguably Coinbase is at fault for that one.
haarolean 301 days ago [-]
>A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.
Incredible take. I don't know what's worse here — suggesting gmail address = google authenticator, thinking you can know the source of "auth codes", or the fact this is coming from an auth engineer. I'm switching to handwritten HMACs on paper napkins today.
em500 301 days ago [-]
Google/Chrome Password Manager?
IncreasePosts 301 days ago [-]
But how did they get his Gmail password in the first place?
I'm not sure if I have the same password reset flow as OP, but when I try to reset my password and even provide the 2fa code, it basically doesn't let me get past a certain point without contacting my backup email address or making me use a phone which I'm logged in on to complete the reset
zargon 301 days ago [-]
The article gives advice to change your passwords because of leaks. So as the post above suggests, it really sounds like they reused their google password somewhere. Then had Google sign-on for Coinbase, or had their Coinbase password in Google.
tehwebguy 301 days ago [-]
Heck of a job, Google!
Email spoofed from legal@google.com and he read it in Google's Gmail app for iOS. The original title was correct: "Google Helped It Happen"
edm0nd 301 days ago [-]
except its not a spoofed email. It's really from Google. You cant spoof emails from Google that inbox.
You can use Google Cloud or Google Sites to trigger emails to anyone that legit come for Google email addresses and servers or submit forms on Google that will send legit emails to Gmail users/targets.
They simply either just embed their scam text into these emails or use the emails from legal@ as a scare tactic and pretext for their scam when they call you.
ac29 301 days ago [-]
> except its not a spoofed email. It's really from Google
Read the text shown in the screenshot in an article. I am 99.9% sure that is not from Google. The wording screams scam to me, most likely from someone who is not a native English speaker.
Among many many other red flags, it specifically says not to try and change your password for 6-12 hours and to not share the details of the email with anyone.
kaiokendev 301 days ago [-]
I was targeted by this exact same attack several months ago. It sounded incredibly real, the emails looked legit, down the domains, Google even has a process for this exact scenario. The only thing that tipped me off is that they sent a login request to my phone. Nothing about the login request seemed off- it even originated from a Mountain View IP. But it was the fact they had sent me a login request which prompted me to drill the voice on why they needed a login request instead of some other form of verification. The disembodied voice soon became agitated and eventually told me that I should expect to lose access to my Google account soon since I hadn't complied with their request.
It was only after I checked Twitter that I saw Garry Tan's callout of the exact same scam. After experiencing it myself, I wouldn't fault anyone who fell for it. The only other tip-off was that the voice was pretty monotone and unemotional, but that only appears obvious in hindsight, not in the moment where you're slightly panicking that someone might be trying to claim access to your account.
kwar13 301 days ago [-]
> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.
I am not clear how the account access occurred. What code did he read? He voluntarily read his own 2FA code from his Authenticator?
bingboingbang 301 days ago [-]
Seems likely to be an SMS code, Google will use a phone for recovery if you claim to have no other access.
This person read an SMS code — one that explicitly says not to give it to anyone — and then they said "I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes! And yet, I got phished."
This person's greatest mistake was answering the phone to a stranger. Who knows what hell can be unleashed on one's emotions nowadays with AI. One cannot expect to be rational in a lion's den.
They are royally fucking up their PSA by throwing Google under the bus rather than telling people to avoid answering their phone to scammers. I suspect this PSA will help approximately no one because of that. Not getting your voice captured (for AI synthesis) is, by itself, a great reason not to answer random calls like this.
vehementi 301 days ago [-]
> Who knows what hell can be unleashed on one's emotions nowadays with AI
This is key. I would "never" fall for a scam like this. But who knows for sure? I would also never cheat on my partner, but can I say with 100% certainty that some insane situation can't possibly ever come up where my many layered defenses are compromised? Can some sufficiently charismatic individual deliver a perfect AI script to me based on info from 5 other breaches, in my brother's voice, to make me give up a 2fa token in an emergency? Maybe! So just never answer the phone, ever
janalsncm 301 days ago [-]
Every day Google is trying to foist Gemini on me yet spam like this waltzes right through Gmail. Perhaps once we have finished our Dyson sphere powered AGI we will be able to block emails spoofed from @google.com.
slig 301 days ago [-]
I'm get tons of email from @google.com, not spoofed, but somehow they send some email to $myname@google.com, which doesn't exist, and it google server returns back to my $myname@gmail.com telling me that with a huge CTA from the spammer. That bypasses all spam filters since it's an actual email from google.
amradio1989 301 days ago [-]
The key takeaway is: we are all human. And humans are easily hackable under the right circumstances.
Your story is humbling, and a good reminder that anyone can get “got”. We shouldn’t think ourselves above such incidents.
edm0nd 301 days ago [-]
IMO the takeaway is the author had very poor security.
You can literally tie a yubi key to your Coinbase account and no one can withdraw funds unless a yubi key is physically plugged in and pressed.
One can also use the Coinbase Vault system where it would be impossible to steal any funds from his account had he enabled it.
You should also never use cloud sync for Google Authenticator as evidence here as why.
fkskammerz 301 days ago [-]
Same exact scam happened to me three weeks ago and I almost fell for it. The guy was very sharp and sounded very authentic.
Ever since then I've been getting hundreds or thousands of Google notifications I've had to decline. Anyone know how people are able to send out hundreds of 2FA gmail notification popups without Google blocking this?
thenickdude 301 days ago [-]
This means you should still have the email from legal@, right? In that case you can solve the mystery of how they managed to pass DMARC by sharing the headers from it.
nzeid 301 days ago [-]
> Google enabled Authenticator cloud sync by default.
Never understood this convenience and never will. This is exactly the wrong way to deal with people losing their authenticator secrets.
UncleMeat 301 days ago [-]
The convenience is that people don’t drop their phone in the toilet and suddenly lose access to all of their accounts.
drillsteps5 301 days ago [-]
Why would you have passwords/credentials to your accounts (including financial accounts with tens of thousands of dollars) on a device that not only you can drop in the toilet, but also lose, or get stolen, or hacked? Do you have any idea what access all your cute apps have to the contents of your device?
nixosbestos 301 days ago [-]
> Do you have any idea what access all your cute apps have to the contents of your device?
Yeah, I do. Do you? Because it's certainly not what you're implying
hocuspocus 301 days ago [-]
Both mobile OSes offer pretty strong app isolation and mitigation against malware, most people don't need to worry about Pegasus level of threats.
Google took forever before adding cloud-sync to their TOTP app even though pretty much all the other ones did it from day 1. And I bet a non-trivial amount of people got locked out of their accounts because they hadn't reliably stored recovery codes.
Financial services are actually the least of your worries since you can get ahold of customer service and eventually recover your credentials even if it takes a few days and some snail mail. However if you lose access to Gmail or Facebook, good luck unless you know an employee.
Flimm 301 days ago [-]
I agree. I wonder if there is a good compromise between convenience and security, though. For example, before allowing Google Authenticator to sync for the first time on a new device, maybe notify the user on all devices and enforce a 72-hour delay, or wait until the user approves the new device using an old device (in a way that is hard for a scammer to pass off as legitimate).
sega_sai 301 days ago [-]
I always read these stories and worry that I will fall for something like this at some point. With all the complexity around authentication, 2FA, backup codes, text messages, cloud-sync, pass keys etc, I find it impossible to be confident that you won't be phished/spoofed/hacked.
briHass 301 days ago [-]
I worry more about aging parents/relatives, many of whom aren't exactly tech-savvy to begin with. Many of these scams are becoming increasingly sophisticated, at the same time that being able to perform verification in meat-space is disappearing (companies don't have local support reps that answer phones, etc.)
niwtsol 299 days ago [-]
I just started a company in May to address exactly this! There is so much cyber security tech, but we just felt that no one has really focused on that aging group of users who are historically not technical and very susceptible to phishing attacks. I would love to chat with you about what kind of features you would want to see in that kind of product and/or invite you as a beta user
spapas82 301 days ago [-]
My two cents: 1. When somebody communicates with you and tells you it's urgent it's usually scam. They are trying to make you do stuff because of the urgency and so scam communication will always be urgent. Here in Greece one of the most common scams is to call older people and tell them that "your son has had a car accident and we need 5000 euros right now to operate on him, bring the money in a bag"
2. (More general) When a person initiates a communication with you it is for his benefit, not yours. If it was for your benefit then you'd initiated the communication to benefit from it. This is not only about scam but also about selling stuff or answering to polls or whatever. Be always sceptical when somebody you don't know contacts you.
arewethereyeta 301 days ago [-]
Greece is 20 years behind Romania with that scam
layman51 301 days ago [-]
Can someone please explain to me what it means for authenticator codes to be “cloud-synced”? Is that solely dependent on whether you’re using the Google Authenticator app while signed in to your Google Account? Is it possible to not have them “cloud-synced” if you are signed in?
jazzyjackson 301 days ago [-]
Google Authenticator app defaults to backing up the TOTP secrets so if you log in on a new device you have them there. Pretty poor default for security, and you can disable it, but not the first time I've heard of this biting someone.
rib3ye 301 days ago [-]
The risk of not syncing — when you lose/reset your phone, so does your OTP app. If you don't have backup codes saved, you're cooked.
themafia 301 days ago [-]
> you're cooked.
I've lost 2FA codes. It's complicated but if you have a financial relationship with the vendor you're going to be able to get everything sorted out. I imagine as this happens more there will be common internal policies which aid customers in this situation.
You have to weigh the amount of potential hassle against the value of potential losses. Why you would have $100,000 of value stored somewhere and only secured by a loose-lipped third party app is beyond me.
traceroute66 301 days ago [-]
> The risk of not syncing — when you lose/reset your phone, so does your OTP app. If you don't have backup codes saved, you're cooked.
Most clued-up places enable you to register a Yubikey as 2FA.
So then it doesn't matter if you loose your OTP app and your backup codes because you've still got a Yubikey.
(And those that don't allow Yubikey, almost certainly will have SMS as a secondary option).
jgilias 301 days ago [-]
You really shouldn’t use SMS 2FA. SIM swapping does happen. This kind of depends on the jurisdiction though. In some countries operators won’t reassign the phone number willy-nilly.
Still, better to just not do SMS auth. These days Yubikeys are not that expensive. Get three, register them all at the most important places, and put one at a parents’ place or similar.
traceroute66 301 days ago [-]
I agree entirely.
But the point I was making that IF the website does not allow Yubi THEN SMS is almost certainly available, and you should use that as a backup mechanism.
Why ? Some sort of backup mechanism is better than none at all.
ac29 301 days ago [-]
> Most clued-up places enable you to register a Yubikey as 2FA. So then it doesn't matter if you loose your OTP app and your backup codes because you've still got a Yubikey.
And what happens if you lose your Yubikey or it stops working? You're back to needing backup codes or an additional 2FA device
traceroute66 301 days ago [-]
> And what happens if you lose your Yubikey or it stops working?
That's why you own N+1 Yubikeys ;p
Any place that offers Yubikey auth will enable you to register multiple Yubikeys against your account.
In all my time on the internet I have only ever seen one place that allows Yubikeys but restricts you to one key.
Sayrus 301 days ago [-]
Which is why most apps with sync have two sets of credentials: one to login on the platform and one master password for encryption. That helps in those scenarios.
fortran77 301 days ago [-]
Yes. There are other ways of syncing (I have images of the setup QR codes save in an encrypted file) but most people wouldn’t be able to manage this.
jazzyjackson 301 days ago [-]
An alternative to syncing is to add the TOTP code on multiple devices, so that losing one device is not catastrophic.
layman51 301 days ago [-]
You mean to say that if it were enabled on my Google account, then the TOTP numbers for my other accounts are visible via authenticating into Google Account on some other unknown device? Sounds like it could be convenient if you lose your phone, but still risky if an attacker can sign into your Google Account.
jgilias 301 days ago [-]
Yeah. And this is on by default. Without an additional secret.
Google Authenticator can be local-only or synced to the cloud.
In local-only mode, the authenticator is bound to a specific device. You can manually sync it to additional devices, but if you lose access to all those devices, it's game over, you will get locked out of whatever accounts you secured with authenticator as the second factor.
In cloud-synced mode, it's synced to your google account, so if you lose your phone, you can restore authenticator state. But if your google account gets taken over, it's game over, the attacker has your authentication codes.
ajross 301 days ago [-]
Something isn't adding up here. The author is excruciatingly rigorous with documenting lots of stuff here, including the screenshots. Then glosses over this bit awfully fast:
> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did
This was an account with authenticator enabled. I'm no expert, but I really don't think there's a recovery process that works as simply as "read back a code". Certainly not in the SMS 2FA sense I'm sure we're all expected to interpret.
Honestly it seems like the author is trying to blame Gmail's UI, when some other more involved phishing technique was actually the novel part here.
InMice 301 days ago [-]
I also feel like the article doesnt completely explain what happpened. Where is this code from?
Did they send the fake legal email and at same time trigger a recovery code to be sent?
Is this like the same thing in discord where they ask you for your email to join a server then ask you for a code sent to verify you own that email but really they submitted the email for password reset. The victim doesn't realize it's a real recovery code sent by Microsoft, etc instead in the moment thinking it is a "discord code". Once you submit the code in discord they have your account stolen in seconds.
Is this what the article is attempting to describe?
LgWoodenBadger 301 days ago [-]
If the scammer is attempting to login to the actual account (which requires 2fa), asking the scammee for the code will allow the scammer to login and do all the things. The scammer is using the victim as the 2fa directly.
GioM 301 days ago [-]
I don't get this part either.
if the scammers had spoofed the email, they would already have that code, and if they hadn't spoofed that email... I mean it looks like a case ID, why would they need it?
Maybe the reading back the code was to get buy in, then there's a missing step here like they had him hit "allow" on a 2fa prompt. Or maybe the email was legit, since it references a "temporary code" and the case ID allowed access with that code?
Good chance my reading comprehension is shot and I'm missing something, I suppose, but I don't understand.
ajross 301 days ago [-]
> Good chance my reading comprehension is shot and I'm missing something, I suppose
That's more charitable than me. My UnreliableNarrator sense is tingling really badly here.
GioM 301 days ago [-]
Ah, I think I get it. Article says:
> In the Gmail app on iOS, it looked completely legitimate — the branding, the case number, everything. Even the drop-down still showed “@google.com.”
> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.
The sentences do not refer to the same thing.
The code was not in the email... The narrator was asked to read back "a code" not the case ID in the email. "A code" here referes to a 2fa push notification code. The email was used to rattle the narrator / build trust to get them to comply.
vehementi 301 days ago [-]
Yes, that is how I read it as well. Email was just for fun, and the code came by a different channel (of course). The email the scammer sent wouldn't contain a code they can use to take over his account (of course).
phendrenad2 301 days ago [-]
Oh, the fake email also contains a code, so I thought that was it.
phendrenad2 301 days ago [-]
I came to the comment section to see if anyone had (1) noticed this omission and (2) explained it. I see we're at 1 still...
stefap2 301 days ago [-]
I have a cell phone with an area code where I no longer have any connections or ties. Almost all the spam calls I receive come from that area code. By simply ignoring or blocking calls from that area code, I can avoid nearly all of the spam.
joshstrange 301 days ago [-]
I've enjoyed that state of affairs for over a decade but now I'm moving back to where my area code matches my physical location. I'm sad I'll be losing this easy filtering trick.
On the plus side, iOS and Android now have features for auto-answering and filtering so thankfully I have that.
RandomBacon 301 days ago [-]
Coinbase STILL doesn't freeze user accounts for a token amount of time, 24 hours or so, after resetting a password‽
Part of the blame should be levied on Coinbase if this is the case.
(I'm assuming this guy at least uses unique passwords...)
edm0nd 301 days ago [-]
Coinbase offers Vault though. You can lock your funds into a Vault and it takes like 2-3 days to unlock them + you have to get approval from multiple different email accounts to even begin the unlock.
Coinbase has many ways to secure your account if the user enables them
also physical Yubi Keys would prevent anyone from withdrawing or steals funds as it would have to be plugged in and tapped to process them.
riffraff 301 days ago [-]
The attacker had the passwords and 2fa codes from the Google account so Coinbase couldn't really distinguish them from the right person (tho presumably for large transfers they may require some extra checks, dunno)
RandomBacon 301 days ago [-]
The article is poorly written and not clear. It sounds like you're suggesting the author let Chrome save his Coinbase password and Google synced that to the attacker as well?
> Google had cloud-synced my codes.
> That was the master key. Within minutes, he was inside my Coinbase account.
The author wrote "codes", not "passwords".
sgerenser 301 days ago [-]
The author clarified that he had enabled Sign in with Google on his Coinbase account. So if the attacker was logged in with his Google account, then they had access to his Coinbase account without needing a password.
RandomBacon 300 days ago [-]
Isn't "Sign in with ______" (Google/Facebook/Etc) discouraged, because if for whatever reason Google/Facebook/Etc decides to ban your account, you can no longer log in to those services?
Havoc 301 days ago [-]
I believe you can lock it to specific outgoing addresses though & ones not on the list have a long delay - like a week
ninalanyon 301 days ago [-]
Always confirm such things by calling the official contact number that you already have and asking about the case. Do this before you discuss the matter further.
Never act based solely on an unsolicited telephone call or email.
blueflow 301 days ago [-]
If someone calls and claims to be from an big tech company, its is always a scam and you are going to loose money.
cannolicannon 301 days ago [-]
This sounds like a classic account recovery scam where the scammer uses Google's account recovery feature to gain access to the account. Once they have the 2FA code, they're in. This time the scammer used an account takeover as the pretense for needing the code.
As for the email, this blog post ( https://sammitrovic.com/infosec/gmail-account-takeover-super... ) from about a year ago notes that somehow scammers were/are using Salesforce to spoof emails from Google that appear legitimate. Seems like something similar happened here, but there's no way to be sure without the headers which the scammer seemingly cleaned up.
At any rate, sorry this happened OP. Stay safe, folks.
pea 301 days ago [-]
I got a nasty one of these recently. Attacker had my wife’s CC, and made purchases they knew would flag our bank and look sus and pop up on the app. Then I get a call from my “bank”, correct number, I ask them to verify and they say look at the number. All they ask for is the customer support code in my banking app to cancel to fraudulent transactions. At that moment I insist on calling back and they hang up, but I was very close.
wcoenen 301 days ago [-]
Thanks for sharing. I already had it in the back of my mind that this cloud sync thing in Google Authenticator was not very secure. I'm getting rid of it right now.
I do see why Google did it; it's going to be difficult to educate users to always set up 2FA both on a primary and a backup device. Much easier and convenient to automatically sync different devices. But your story makes it obvious that something isn't quite right here.
jgilias 301 days ago [-]
Authy has solved this though. The cloud sync is opt-in, and encrypted with a password. This makes it immensely more involved to compromise.
wcoenen 301 days ago [-]
Ironically, Authy's cloud sync feature may have been what pressured Google to add cloud sync[1].
And yes, Google could have added an extra encryption password. But users forget/lose passwords, especially if they normally never need them. So I can see why Google didn't go that route.
I don't understand. What combination of actions and app features allowed the scammer to send an email that is indicated to be from google's domain?
davidscoville 301 days ago [-]
That's the big question. I've heard attackers have used Google's own tools like Google forms or Google cloud to send the email through Google's servers so it wasn't flagged. This is a major vulnerability that Google needs to fix. I'm quitting Google because I'm worried about other vulnerabilities like this.
BXLE_1-1-BitIs1 301 days ago [-]
My favourite Pixel feature is Screen Call.
My primitive security precautions:
1. DO NOT use your Gmail for recovery. Use another email provider.
2. Use a family member's phone number for recovery.
3. DO NOT install your bank's app. Somehow the Royal Bank of Canada's app was used as an attack vector. If the RBC app can get hacked, smaller banks are even more vulnerable.
4. Use incognito mode on your browser for banking so a thief or hacker can't use your browser history to find out your bank.
adrr 301 days ago [-]
> 4. Use incognito mode on your browser for banking so a thief or hacker can't use your browser history to find out your bank.
You can buy that information. Databrokers will sell it. Your bank sells your transactions.
renewiltord 301 days ago [-]
I get these inbound communications all the time and many banks actually use them to communicate with you. Each time, I have always sheepishly said "This is kind of how people get scammed right. Do you mind setting it up so that if I call back the account exec will know what to do? It's just I'd feel foolish if I got scammed this way" and then I end up calling back and with a little work get where I wanted.
I think the reality is that people think "Oh couldn't be me and am I going to be the weird security guy" so it isn't whether you know software and security etc. that determines it. It's whether you're willing to be embarrassed frequently in these conversations.
I've had the banks call me, Coinbase scammers call me, all sorts. I'm at the point where I block my own area code (which is from a different state where I have a few people whitelisted fortunately) and that's eliminated a lot of it.
I don't mean I can't be scammed. Just that perhaps some mitigation comes from willing to be socially awkward and insisting to someone that you want to do it by the book.
1970-01-01 301 days ago [-]
The big tell was someone that operated via a telephone. Google would never do this.
bell-cot 301 days ago [-]
Their Adwords people seem to, occasionally.
At least when trying to drum up business from formerly-large accounts that have greatly reduced their spending.
arewethereyeta 301 days ago [-]
every 6 months. They also rotate on you to have a reason for calling again, out of the blue
zargon 301 days ago [-]
If you want to keep $100k in a crypto exchange, it doesn’t cost much comparatively to purchase a few yubikeys.
The thought of having all my online services centralized with a single provider for email, SSO, 2FA, and so on is scary. Especially at Google, where you can lose all access at the drop of a hat, with no recourse.
rslashuser 301 days ago [-]
I'm super curious how this hack worked, but I feel like the story is just about the last step. What did the attacker have such that this last step did it?
My guess is that the attacker had the google password, and also the login for Coinbase was somehow stored in Google, so the attacker getting into google also exposed Coinbase. I just looked at Coinbase, and it does have a "Sign In With Google" feature.
If you want to live the stripped-down TOTP lifestyle, you have to love this 20 line Python solution. Does not depend on weird libs, and the last edit is 4 years ago. Write the seed on a Post-It and you're all set. Not so convenient, but sound sleeping!
https://github.com/susam/mintotp
cbdumas 301 days ago [-]
> The attacker already had access to ... my Google Authenticator codes, because Google had cloud-synced my codes.
This was such an obvious mis-feature I can't believe they actually rolled it out. For those using Google Authenticator you can and should disable cloud sync of your TOTP codes.
Flimm 301 days ago [-]
I can understand it. Ordinary users were getting locked out of their accounts when losing their phones. Some of those stories hit HN.
Don't disable cloud sync unless you have a backup of all your TPTP secret keys. It's dangerous to advise people to disable cloud sync without mentioning backups. Being locked out of thousands of dollars in your crypto account is as damaging as losing that crypto to hackers.
cbdumas 301 days ago [-]
In that case wouldn't you be better off just disabling 2FA? The problem with the cloud sync is that users like the one in the article think they have 2FA but in fact if their Google account is compromised all their accounts using Google Authenticator TOTP second factors are also compromised.
hocuspocus 301 days ago [-]
It's the same thing with Apple Passwords.
TOTP isn't that great, you should definitely use a hardware and/or pass key for important and financial services. That said your cloud synced Google Authenticator can be behind a Google account with strong 2FA (i.e. not SMS nor TOTP), then it's mostly fine.
The lesson here is really not to ever share codes you receive by SMS, and preferably disable phone as recovery and second factor.
Joel_Mckay 301 days ago [-]
Spoofing email and phone caller ID is actually really common these days, but line-tapping is also active in some places.
Call the persons extension back from an out-of-band line, but after checking the contact phone number on the old web page or government business registry.
This is effective against most forms of line tampering, as targeting an unknown random line number is much more difficult to predict.
Most nuisance calls we get are the classic foreign operator message repurposed language translations trying to get people to "press 1 if you like ice cream" which bills 3rd party long distance calls. There was a local dubious calling card scammer arrested twice for this con. Just hang up, and report/block the number =3
latchkey 301 days ago [-]
Zak just posted this eye opening behind the scenes look at what these scammers are doing...
Wow - that is really interesting, to hear the hacker's voice, the absence of guilt, the thinking of "it's a game to steal".
A Horrific threat.
shemar123 294 days ago [-]
Subject: How I Recovered My Stolen Funds After a Crypto Scam.
Hello everyone I'm here to share my experience so others can avoid what I went through. A few months ago, I lost my entire life savings to an online group who posed as cryptocurrency investors. They were convincing and professional, and I only realized it was a scam after I have invested a lot of funds and when I tried to withdraw my money they disappeared.
I felt devastated, but I reported the crime to my bank and local authorities right away. After researching reputable resources, I eventually found a licensed financial-fraud recovery service that works with law enforcement. They helped me trace the transactions and recover a portion of my stolen funds. it gave me hope and some justice. If you've ever find yourself in a similar situation, kindly contact them in their email below:
easytouchcryptocurrencyrecover@gmail.com
sjy 301 days ago [-]
I'd complain to Google about this, maybe through a lawyer if needed to get them to take it seriously. They won't accept full responsibility, and in general people need to be aware of the risk of spoofed email, but Google should be able to stop fake emails from google.com from appearing in a Gmail inbox. You'd think they would also have the ability to recover an email deleted immediately after an account takeover, or at least work out how the spoofed email was delivered from other internal logs. Google should investigate whether their negligence contributed to the success of this attack.
insane_dreamer 301 days ago [-]
I no longer answer calls from a number not in my contacts. If it's a real call that I need to take care of, I figure they'll leave a voicemail and I can decide whether I want to call back.
citizenpaul 301 days ago [-]
>I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes!
To Me this quote says so much about the crypto space more than anything.
Also not shocked it was crypto theft.
SoKamil 301 days ago [-]
What does it say about crypto space?
citizenpaul 300 days ago [-]
Otherwise rational and educated people are willing to suspend disbelief about anything as long as it supports their crypto yacht dreams. In this case the concern that their yacht dreams were being lost. Which ironically caused their dream to be lost.
rib3ye 301 days ago [-]
I get scam calls with Google in the caller ID everyday.
It kinda sucks that in 2025, voice calls are now near-zero trust.
Is there really no velocity behind any open/consortium replacement to traditional voice calls?
kerpal 301 days ago [-]
Use a password manager and use a SEPARATE second factor authenticator not tied to the password manager. I personally use Authy (though I think it's been deprecated) and Bitwarden.
I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my to unlock my account probably to drain bank accounts.
icedchai 301 days ago [-]
Same. I don't store my 2FA with my passwords. I also use Authy, I'd like to move to something else but as long as it's working. I was annoyed they got rid of the Mac app.
kerpal 301 days ago [-]
Same, the desktop app worked great. Probably for the best though, ideally you want to pull your codes from a phone and password from your desktop device.
icedchai 301 days ago [-]
Yeah, I won't argue that it doesn't make sense security wise. It does.
jp191919 301 days ago [-]
Absolutely. If you are looking for a new 2FA/TOTP app- Aegis is good, also Proton Authenticator as it's independent of a Proton account.
fkyoureadthedoc 301 days ago [-]
oof that sucks. Luckily I'll never answer the phone
traceroute66 301 days ago [-]
> Luckily I'll never answer the phone
One of the best features of Apple iOS 26 is the new call-screening feature[1].
Pixel Call Screen has been a godsend for me since its debut, akin to using uBlock Origin for browsing.
layman51 301 days ago [-]
Would this actually work if it's more of a targeted attack? It seems like not, because they could just kind of lie to your call-screener.
edm0nd 301 days ago [-]
Apple once again just implementing ideas from Android lol
This will be great tho to help cut down on iOS users and scams hopefully
fkyoureadthedoc 299 days ago [-]
Call screening existed before either of them did it. I had some 3rd party Android app/service that did it way back in the day.
dismalaf 301 days ago [-]
The first clue should have been that you were talking to someone from a company notorious for not using real humans for customer support...
joe_the_user 301 days ago [-]
The scary thing is that the only filter people have now is "workflow". If someone calls you, you can't tell who they are but if you call them, from a number you find one the official website (that you find rather than someone telling you), then they're likely legitimate.
But that's hard because many people work on markers of legitimacy, not algorithms.
atallahw 301 days ago [-]
What did the account did the email actually come from? Was it legit from legal and he just submitted the request or was it a real spoofing
fkskammerz 301 days ago [-]
It was not legit from legal, I had the same attack on me two weeks ago. They were pretending to be from Google General Counsel responding to an estate request to my Google account being handed to another party who was supposedly the inheritor.
What clued me in was that he said he couldnt share the estate documents with me until I gave him my popup 2FA code.
layman51 301 days ago [-]
Were there any further login attempts that they tried to do to access your Google Account? It almost seems like the attack being described in the article is very sophisticated that the attackers aren't just contacting random people but might have certain people in their radar.
edm0nd 301 days ago [-]
It was legit from Google email and servers.
You cannot spoof an email from @google that will inbox
twostorytower 301 days ago [-]
They clearly did.
edm0nd 301 days ago [-]
You can trigger emails from Google on behalf of other users or use a platform like Google Cloud or Google Sites to trigger emails that come from real Google servers.
This was not spoofed.
foofoo12 301 days ago [-]
I don't know what the Google Authenticator team was thinking, if at all, when they did that deplorable implementation of the sync feature.
One click on the "backup codes" on main screen and boom, no confirmation or anything. Your keys are in the cloud. I couldn't find a place to undo it. Article says it's enabled by default now. This is shameful.
tacker2000 301 days ago [-]
2 weeks ago, I got these SMS messages via the official Bitpanda SMS number (the one that sends you the 2FA normally):
——-
Your sign-in code was successfully reset. If this wasn't you, contact us immediately on +43 1 3950657516
Reference: FPQ92
——
And this one
——-
You signed in from a new device in Beijing (China) through a Ledger Live API. If this is NOT you, call us on +43 1 3950657516
Reference: FPQ92
—-
Looks completely legit and I was really spooked at first. I can see how people fall for this stuff.
stevage 301 days ago [-]
I'm pretty shocked that Gmail will deliver mail that claims to be from @google.com . Is that really what happened?
dankwizard 301 days ago [-]
I bet the fact it is omitted and "lost", it was probably something like g00gle or googIe.
1f60c 301 days ago [-]
There are some weird things (like the fact that Google doesn't tend to call the owners of consumer-level accounts and the fact that the email is phrased very oddly), but wow.
I wonder, though, did "Norman" just guess you had tens of thousands in crypto lying around, or was this step two of a phishing attack?
thayne 300 days ago [-]
I've noticed a lot more phishing emails making it through gmails filters recently.
A lot of them ultimately (if carefully inspected) come from @gmail.com addresses. And many of them look pretty convincing.
Did gmail change something for the worse, or have phishers found a new way to circumvent Google's spam filters?
john_the_writer 301 days ago [-]
I've had a few calls where they are from legit places (I confirmed later) and they ask me verify my identify. I counter, that they need to verify who they are. They were confused and we couldn't go forward, because I wouldn't answer their questions until they answered my question.
301 days ago [-]
anigbrowl 301 days ago [-]
Change your passwords today. Don’t wait. 16 billion passwords have leaked recently, and yours is probably among them.
Never share a verification code. Scammers use urgency and fear (“you must resolve this in the next hour”) to get you to act.
Based on the second warning, I've decided not to trust the first.
calmbell 301 days ago [-]
The key takeaway from this imo should be to only use password managers with a secret key like 1Password.
sublinear 301 days ago [-]
> On June 19th, my life changed with a phone call. I was doing yard work when my phone rang. The number showed up as Pacifica, CA — (650) 451-5708. I answered.
I'm not trying to undermine the idea behind this article, but I was raised to never answer the phone and that was in the 90s
eviks 301 days ago [-]
> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
How is this basic fail still possible?
everybodyknows 300 days ago [-]
> The attacker spoofed the “From” field ... On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
Is this a victory of Google's UI designer's quest for a "clean look", over basic security essentials?
account42 300 days ago [-]
Isn't the bigger issue here that you didn't actually have 2FA and your Google account (which receives recovery mails and syncs "2FA" tokens) was the only thing required to access your Coinbase account?
chemodax 300 days ago [-]
I think there is relatively cheap way to reduce such scams: make it mandatory for banks etc to perform “training” of the clients. Regularly make a call to clients asking for sensitive data. Then block account if client provides this data.
jrflowers 301 days ago [-]
Out of curiosity, does anyone know if there is any scenario where Google would legitimately call you? I assume the answer is no, but it would be interesting if some extreme edge case existed.
Edit: Obviously not “you work at Google and your boss calls you” or whatever
UltraSane 301 days ago [-]
This is why I don't like cloud syncing OTP secrets. The hassle of migrating them is proportional to their security. They should only exist on one or more phones/watches/computers and on paper backups.
jader201 301 days ago [-]
Why do people still answer phone calls from unrecognized numbers? Just don’t. If it’s actually someone that needs to reach you, they can leave a VM.
But 99.99% of the time, phone calls from unrecognized numbers are spam/scams.
UltraSane 301 days ago [-]
I was considering adding a page to my personal web page where people could add phone numbers for me to whitelist. I have been getting 5 to 15 spam calls a day recently so I essentially have to whitelist.
neya 301 days ago [-]
> On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
This should be the real highlight of the issue here. I always check headers on my Samsung whenever I feel suspicious.
jonny_eh 301 days ago [-]
My takeaway is to never answer the phone when an unknown number is shown.
wewewedxfgdf 301 days ago [-]
If you're running a service with things of value, slow down big actions - please - like why allow large money transfers without an 8 hour wait period and extraordinary verifications.
throwaway7783 301 days ago [-]
I never pick up calls from numbers that I don't know. If it's important they leave a message. And if I think it is important, I call them back through official phone numbers
sgammon 301 days ago [-]
why were you synchronizing your 2fa codes? that requires opt in, even in the form of a signed in google account combined with google authenticator as a choice of 2FA code storage
why were your coins not in a cold wallet? that is how you stop this permanently
why did you acknowledge any kind of inbound communication? ignore it. always. or call outbound to a confirmed number to make sure.
btw you were scammed out of $80k, as you admit in your article, the headline is misleading for seemingly no reason except the larger number
sgammon 301 days ago [-]
> an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator.
it is still a second factor, because it is something you have instead of something you know; it's just that you converted it to something you know when you read it and transmitted it to someone else
all that being said, yeah, legal@google.com (as a homograph attack) should probably be blocked.
sgammon 301 days ago [-]
convenience is nearly always a tradeoff with security
pjdemers 300 days ago [-]
I get 5 calls and texts a day about my Google and Coinbase accounts. So many that if either Google or Coinbase really did try to contact me, I wouldn't see it.
p2detar 301 days ago [-]
> On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
Apple's Mail.app also doesn't allow this and it's driving me nuts.
endgame 301 days ago [-]
This is the world we're building for everyone, if passkeys + attestation get baked in everywhere and the bigtechs hold everyone's authentication keys.
dlenski 301 days ago [-]
This is indeed a sophisticated and alarming attack, but…
> the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.
Live by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency, die by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency.
> Google enabled Authenticator cloud sync by default.
Knowing how impossible is to get a hang of anyone at Google in case things go wrong, it is probably very safe to just assume they will never ever ever call you.
301 days ago [-]
301 days ago [-]
mvdtnz 301 days ago [-]
If you're gullible enough to "invest" in cryptocurrency you're certainly gullible enough to send your 2fa codes to a scammer.
1970-01-01 301 days ago [-]
This is a great lesson on 2FA fundamentals. Picking time-based codes for 2FA is equal to picking something you know twice. That isn't strong 2FA. That is 1FA with an extra step (1.5FA). To make it all the way to 2.0FA, you must pick something you know (password) and a private key (Yubikey, smart card, etc.) that does operations in-situ, that cannot be computed anywhere else, to then match to an expected value on the server. It therefore isn't something you know twice. It is something you know + something you have uniquely generated.
beeflet 301 days ago [-]
Strong 2FA is holding your cryptocurrency in a multisignature setup instead of an exchange that holds your keys for you and can disregard the 2FA whenever it wants.
The security bottleneck is the one institution that holds all of the responsibility. It cannot be fixed by giving more hoops to authenticate themselves to the one institution
1970-01-01 301 days ago [-]
3rd/4th party trust and has little to do with auth
cpncrunch 301 days ago [-]
It would be helpful to see the relevant headers to understand how it was spoofed, and if it would have been obvious from looking at the headers.
blactuary 301 days ago [-]
He posted about it on Twitter and the replies are full of those "this company helped me get my funds back" scammers, hilarious
duxup 301 days ago [-]
Even HN has a few of those guys who just don't stop posting, they're banned so no harm, but man they keep at it.
301 days ago [-]
nharada 301 days ago [-]
One thing I really hate is that some companies with poorly design customer service flows actually REQUIRE you to read a code they text you over the phone to a rep.
At least now more companies include a "never read this over the phone" note in their authentication texts.
more_corn 300 days ago [-]
They reached out to you.
Created a sense of urgency.
Let this be a lesson to everyone who hasn’t been scammed yet.
sciencesama 301 days ago [-]
i regularly check reddit scams to know about the scams and i recently dodged one which wanted my details !
dec0dedab0de 301 days ago [-]
i always tell my mom that no legitimate business would ever call, email, or send a letter about anything.
pipes 300 days ago [-]
Can someone explain how reading the code from the spoofed email compromised his account?
mbesto 301 days ago [-]
The first reason I knew this wasn't real is that Google doesn't have support...lol
YuukiRey 301 days ago [-]
The email has some obvious spelling issues. Not exactly a masterfully executed attack.
danr4 301 days ago [-]
the biggest mistake was thinking google actually provides customer support
mensetmanusman 301 days ago [-]
Is it an advantage of crypto that someone can rob you with no recourse?
edu4rdshl 301 days ago [-]
> And Google helped it happen
No, it doesn't, you were just stupid. That field has always been modifiable.
Every action you did is what you hear multiple times every week about people falling in pishing, and you continued.
Finally, it was just some crypto shit so not a big deal.
pglevy 301 days ago [-]
> I answered.
I never answer the phone.
nottorp 301 days ago [-]
Holy Ahriman. Google does not call you.
Any call from Google is a scam.
rkj93 301 days ago [-]
If you have not done it yet, file a case with the FBI
jbrooks84 301 days ago [-]
Do not answer unknown numbers ever. I repeat ever.
tracker1 301 days ago [-]
As a rule, I never give any private or secret information on received calls. I had a doctors office that their automated system would call and ask for my social security number, and I'm like, nope... not happening. Even when I knew it was likely legit.
Healthy levels of paranoia aren't so bad.
ShrimpHawk 301 days ago [-]
One wrong point in this. Google Authenticator does not cloud sync by default. You specifically have to accept the cloud sync option that you are prompted with.
giveita 301 days ago [-]
Coinbase not doing MFA? That makes them the other kind of MFA.
But yeah tel tell with Google is if someone from Google calls you then you know it is a scam by the fact that Google called you. Google doesnt give a fuck about you. Even if you spend millions on ads.
tiagobraw 301 days ago [-]
just realized google auth cloud sync was enabled in my device even though Ive never explicitly enabled…
so thanks for the advice!
301 days ago [-]
Dilettante_ 301 days ago [-]
>Fall for spoofed email sender
>Keep your crypto on an exchange
This gets the same level of sympathy as a person without backups suffering from data loss.
jackconsidine 301 days ago [-]
I think that’s a pretty unsympathetic take. Hindsight is 2020 but there are factors outside the author’s control (synced MFA, Gmail not detecting the spoofed address)
Dilettante_ 301 days ago [-]
Cloud sync is not out of one's control, and complaining that Gmail did not automatically detect the spoofed address is an inversion of assumption. It's like dropping your icecream and then being mad nobody caught it for you.
Is the average user (someone who "works in tech" even!) really so uninvolved in their own security? Are they not expected to hold any responsibility whatsoever?
user34283 301 days ago [-]
No more deserving than any other of the crypto cultists.
Whether you fall for an elaborate phish, or if your Ponzi-token predictably loses value after your 'investment' was cashed out as an earlier adopter's profit, it's all the same to me.
Alternatively your hardware wallet bricks itself or three of your disks fail at once.
I don't care. You lost the money when you first exchanged it for worthless tokens.
lavezzi 301 days ago [-]
Lucky for you Coinbase have set up a fund for people who got scammed through social engineering attacks due to their recent security fuckup.
Regardless of whether you received an email from Coinbase notifying that you were affected, the attack they suffered is much larger than they let on to the SEC.
Another company that sends 2FA over SMS codes, then wants them over the phone is Family Mobile. Its a Walmart T-Mobile derivative.
Its not a GREAT carrier, but I have a legacy plan for unlimited everything at $20 a line.
But if I have to call in, they do send a 2fa SMS code, and require to tell them over the call. Its absolutely ridiculous. But, Ive only had to call in 4 times in the last 9 years, so, yeah.
pmarreck 301 days ago [-]
Someone keeps trying to hack into my main Google account (I keep getting 2FA requests), which unfortunately was part of some early crypto activity and was traced back to me, and I don’t know what to do.
I myself can keep denying them but I have a toddler and if he accidentally accepts one of them, I’m screwed.
And since it’s impossible to reach anyone at Google, WTF do I do?
winterqt 301 days ago [-]
Is changing your password to at least stop {some of, all} the 2FA requests not helping?
pmarreck 300 days ago [-]
It’s account recovery, not 2FA, my bad
lavezzi 301 days ago [-]
2FA or account recovery? I keep getting account recovery requests and it's pissing me off.
pmarreck 300 days ago [-]
Account recovery, my bad
monkpit 301 days ago [-]
> I was doing yard work when my phone rang. The number showed up as Pacifica, CA — (650) 451-5708. I answered.
Ah yes, and all millennials are immune to the attack in one fell swoop.
Workaccount2 301 days ago [-]
>On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.
The most infuriating part of the story by far.
TacticalCoder 301 days ago [-]
[dead]
tyleradams1 296 days ago [-]
[dead]
back2dafucha 301 days ago [-]
[dead]
bella014 300 days ago [-]
[dead]
temptemptemp111 301 days ago [-]
[dead]
abetancort 301 days ago [-]
[dead]
franciscojs 301 days ago [-]
TLDR: You should NEVER sync your Authenticator 2FA codes with a Google account.
londons_explore 301 days ago [-]
[flagged]
loloquwowndueo 301 days ago [-]
No it wouldn’t have.
OP said the coin base account was drained within “minutes”. Server thief bait can take up to 24h to notify you when someone takes the bait.
> We'll put a tiny amount of cryptocurrency in a wallet, but probably still enough to attract the attention of automated scripts. We notify you when it's taken within 24 hours.
blindriver 301 days ago [-]
Sorry but it’s stupid to blame Google when it’s 100% your fault. This is a scam that is 10+ years old and you fell for it in 2025. It’s not googles fault at all.
ycombinatrix 301 days ago [-]
It isn't Google's fault that an attacker was able to spoof mail from "legal@google.com"?
Avamander 301 days ago [-]
Proof of that remains to be seen.
That being said, there are a few approaches that might leave such an impression to people unfamiliar with their email client.
arx_ 301 days ago [-]
The attacker doesn’t need to spoof anything, this is known as a homograph attack:
If it's a known attack, Google has a known defence in its apps?
arx_ 301 days ago [-]
Something being known doesn’t mean a solution exist.
Computing the the set of Unicode characters that would result in a homograph of a latin alphabet word is non trivial. Now do this for relevant/trusted domains, now put in place a mechanism to mark a domain as trustworthy that also minimises your liability.
eviks 301 days ago [-]
> Something being known doesn’t mean a solution exist.
But we aren't talking theory. In this case solutions exist, just not in this app?
Also, the triviality point is puzzling, are we only allowed to criticize professionals for trivial fails? (though using a different font is one of the trivial mitigations)
> that also minimises your liability.
How is that a factor, what is their liability now without any mechanism and will it increase if they add some?
otterley 301 days ago [-]
We don’t know yet that that’s what actually happened in this case.
arx_ 301 days ago [-]
It seems likelier than a @google.com spoof landing in the person’s inbox.
Without them providing the headers this is just idle guessing, but I’d argue my guess is likelier to be the truth.
palmfacehn 301 days ago [-]
Seems like a good use for the .google tld
blindriver 301 days ago [-]
Spoofing email addresses has been around since the 90s.
acdha 301 days ago [-]
Yes, and the industry has been responding to it since approximately 5 minutes after Canter & Siegel started cranking out that green card spam in 1994. We have SPF, DKIM, DMARC, etc. _and_ more importantly, the victim in this case was using Google's mail client to access Google's mail service so they don't even need complex protocols designed to inform 3rd parties about whether a message is legitimate. If Gmail refused to accept any messages claiming to be from google.com which didn't originate from their servers, it'd be quite defensible given the ratio of attacks to the handful of legitimate cases where someone needs to do something like post to an outside mailing list using their @google.com email address.
acdha 301 days ago [-]
This is like saying it’s not Ford’s fault that they didn’t put in seatbelts and safety glass because people knew driving was unsafe. When bad outcomes happen at scale, you need a system-level fix.
EDIT: to be clear, the fix has arrived: had he used passkeys, this attack would have been impossible and every login would’ve been faster and easier. There are edge cases but this is literally the reason why U2F was created a decade ago.
blindriver 301 days ago [-]
The author knew that the scam existed and he even was skeptical. Then chose to rely on it being true despite all the red flags. That’s his fault.
At some point people have to accept responsibility for their own stupid actions.
acdha 301 days ago [-]
Yes, they made a mistake. They were honest about that.
A little secret which will help you in life: everyone makes mistakes, even people who don’t think they will, even you. Looking all the way back to last week and 2 major NPM hacks ago, you can get access to a lot of systems simply by hitting someone when they’re busy and distracted.
blindriver 301 days ago [-]
There's a difference between taking accountability for your mistake and blaming other people for your mistake. Blaming others when you are clearly in the wrong is reprehensible.
acdha 301 days ago [-]
That's a very harsh position to take and one I struggle to find support for in the post. I hope that you are never in the position where you make a mistake and others apply that standard to your response.
arx_ 301 days ago [-]
Per TFA
Title: I Was Scammed Out of $130,000 — And Google Helped It Happen
Heading: Google failed me in two ways
Body: Google has become the vault of our digital lives — and that vault had cracks.
If Ford adds seatbelts and you decide to take them off because they annoy you; when get into a crash you can’t claim Ford failed you since the seatbelts weren’t forced upon you more.
acdha 300 days ago [-]
Here are the two specific criticisms in the article:
> Phishing emails from “@google.com” made it into Gmail.
> Google enabled Authenticator cloud sync by default.
Both of these seem like fair points where one could reasonably expect one of the largest companies in the world to spend a tiny amount of money on security improvements which would make it harder to attack their customers. Not following Apple’s lead on security for Authenticator is especially disappointing since they have no shortage of good security engineers.
blindriver 301 days ago [-]
It’s weird that you think blaming other people for your own self-admitted mistakes is acceptable.
acdha 301 days ago [-]
Good thing neither I nor the author did that, then.
chinathrow 301 days ago [-]
> The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.
Don't do that. Don't put your 2FAs somewhere else than in an unsynched app. Not in Bitwarden, not in any online account, nowhere else than "Something you have".
gip 301 days ago [-]
Just wondering what is the plan in case this thing you have gets lost?
And would you say that using something like authy with encryption using a totally unique password is safe?
cbdumas 301 days ago [-]
Typically you print out recovery codes and keep them somewhere safe
fsckboy 301 days ago [-]
most thefts are inside jobs, so somewhere safe would be to give them to a total stranger
The guy who called me said "I can send you an email to show it's official" and I thought of that immediately when I read this article. No dice, he refused to give me a number to call back on, so I knew it was fake.
EDIT You can spoof from email addresses and you can spoof phone numbers - if someone is calling from a legit number on caller id it means NOTHING. You have to call back to a legit number to be sure it's real.
A little less convenient for a LOT more security.
They're happy collecting their commissions and avoiding you. The only good thing is that (for the most part) the payment method is just a password/faceid/touchid away.
EDIT: also thank you, but and 0.0% is fine.
Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.
Now try and convince your family to do the same (especially parents who are prime targets).
Not to justify their behaviour, but: most businesses are not set up to allow for callbacks or they're set up to actively discourage them. For example: they may be contracting out to call centers or employee performance may depend upon making a sale. My situation is unique since all calls our handled internally and my performance is not based upon making a sale.
That's said, the current situation pretty much dictates that a secure option should be offered to clients.
This process doesn't care about them calling from a spoofed number. We've had big problems with spoofed number scams and the CRA (Canadian version of the IRS) recently.
AI speech still has some noticeable quirks (I cloned my voice earlier this year to produce some tutorials). Once those are ironed out, I may increase my paranoia a bit. It's going to be hard for an AI faking a relative to get my bank password, if that even happens. There are far more lucrative targets with that level of investment.
I think just being on guard and not trusting potential anonymous sources is "good enough" for now.
Where do you bank? I'm looking for recommendations.
Playing Jason Bourne with your credit card number is not worth the effort if you ask me.
I would even say this is a net positive for the economy: the cost of fraud is outweighed by the lower barrier to payment. I'm sure you'd have made fewer sales had people been more worried about security. Net positive then, right?
If your bank doesn’t want to honor the request yes you’ll have to contact the payment network (visa/mastercard) and I’m sure there’s someone in this thread who has experienced that for an unauthorized transaction chargeback but it’s exceedingly rare.
Merchant error chargebacks , on the other hand… very different situation.
It’s possible that my current bank is particularly bad at this, as they are bad at everything else. I have had the runaround with merchant error and stolen card number chargebacks with other banks though.
Oh so you’re a telemarketer.
And to further crush that cynicism: most people are overjoyed when I call them.
Not everyone who makes outbound calls is a telemarketer.
The healthcare company I work for has a whole department of very nice people who make outbound calls to offer free health and nutrition classes to poor people.
Yes, they're free. As an employee I am also required to take one of the classes each year, so I know what they entail. Yes, they cost our company money. No, they're not sponsored by some corporation or ad company, and no we don't sell people's information on (HIPAA and all that).
The real world isn't a tech bubble cage fight.
I assume if I have a problem with any of my accounts, I'll eventually find out and self serve to go and fix it, as much as possible.
"This is he(or she)", or "who are you trying to contact" handle most situations.
Just don't let scammers get you saying something in the affirmative.
Edit: Many of them are scammers, they don't play by the rules.
Probably going to cost a lot to get to that point, probably more than they will scam you for. They're after the quick hit that gets them something right away while also believing that you won't take it that far.
It's like knowing how to pick a lock vs just throwing a rock through the window that's next to the door to gain access. They both get you there.
Scenario 2: You say yes and they lie what you acknowledged. You sue or you don't.
The math on your end doesn't change, no matter what you said.
Alternatively, ask for their license number, check the license, then call the number it lists. (Kills two birds with one stone for licensed professionals.)
Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale.
But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned.
At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of.
But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks.
And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work.
[1] https://discussions.unity.com/t/does-anyone-screen-these-ads...
[2] https://www.vice.com/en/article/taboolas-content-chum-boxes-...
[3] https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-ne...
[4] https://www.vice.com/en/article/instagram-and-facebook-are-o...
It is all about balance. Google could do more here, however the answer is not as obvious as you might think. Especially in an age where identities get stolen often and the lag time on catching said fraud is quite long.
The issue is that the entities mentioned are doing...nothing at all. Not even basic MANUAL identity checks and payment checks. Automated checks work very well until they don't.
Oh it is. A basic background check alone done by an actual human to see if the business is actually real, let's say this costs Google 1h @ 40 dollars plus 20 dollars for credit bureau fees. Google can offload that cost to the advertiser - even for a small cookie store, that's hardly an expense.
And after that, vet the campaign material for each asset. When you have 200 dollars in ad spend (which isn't much), 10 dollars should go pretty far in having a human see if the "pizza store" didn't just place an ad for penile enlargement.
> Automated checks work very well until they don't.
The key thing is, the entire ad industry is amoral. No one cares about fraud or brand reputation any more, not when you see chumbox ads on "reputable" newspapers. So everyone seems to think "why should I leave a few dollars on the table?".
I have seen Microsoft support forum articles that list the "Facebook official phone number". The fact that it's not from Facebook doesn't make it less authoritative in a panicked person's mind.
Google, Meta, Microsoft, and Apple really must start publishing an "official phone number". It is perfectly OK that this phone number just plays a repeating message saying that the user should browse google.com/phone. That website can explain that there is no phone support offered, and provide a bunch of links for common scamming hooks that leads to anti-phishing material.
Ephemeral ads are not a good thing.
The guy who called me on friday felt like a targeted attack, I've been getting a TON of pokes at trying to reset my google password. It really made me feel like there's less and less you can trust online. Scammers are winning the arms race, and have the resources to create really good looking pages.
Supposedly, people have been fired after being falsely accused of harassment. The scam works as follows:
Send a message to bob@gappsdomain.com and notavictim at the same domain. Arrange for the headers to be “from” bob. Now, notavictim reports Bob to HR. If the google admin is competent, they look at the headers, and note that Bob didn’t send the email. (Not sure if they catch the offender or not.)
If they’re incompetent, they see the message in Bob’s from box, and recommend he be fired.
This is a feature that enables dubious workflows, where Bob configures spam bots to bother his coworkers, but wants those messages to be auto filed in his sent box.
I didn’t think it worked when spoofing unrelated domains like Google though. That’s just dumb. Maybe the attacker had the author’s IMAP gateway password and moved the message into the inbox?
I had to tell my bank this once a few years ago, when they called me up and then expected me to give them personal information to confirm my identity.
Great idea unless the attacker has SS7 access.
But in a world with Pegasus, and telecoms in smaller vacation countries selling off SS7, etc, etc - if someone good really wants to target you normal security protocols aren't going to cut it.
The phone network is just not a secure channel for any sort of communication
But because Google delivers spam from senders who spend a lot on Google ads; and e-mail traffic gets laundered into web ads traffic; they just can't do it. And because Superhuman charges more than $0, it can't do it either. Nobody can fix e-mail. If you can't see how phishing and Google Ads are related... you know, this is why it is hard to "just" pass a law. It's not because the law wouldn't fix the problem. It would, if you permit the status quo where Google is the e-mail monopoly. It's this whole A16Z "just pass a law" nonsense, where someone thought he was saying something really insightful because he didn't like Jon Stewart, getting in the way of my inbox zero, and simply never receiving non-personal e-mails at all.
This reminds me of one time where I got a call from a number I don't know, got yelled at something about spamming calls. Yelling includes threats about getting reported to police or whatever, which was confusing since I never had any history with this number.
I suspect my number was spoofed. I'm not sure if there's any defense against that.
Now my default is to ignore any unknown numbers.
— no support group from a big company is going to call you. Ever.
— never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that!
— Don’t put all your private info behind one password, so don’t use Google Authenticator backed by your Google Account as your password manager. Always use a third party like 1Password or similar.
— Don’t have the same email you use banking and investments be the email that the world knows. Create a new email for that. If you use Chrome, even use a separate profile with that email, and only have your password manager as an extension. No others.
- from a number with no results on Kagi search
- claiming to be the online banking support of my bank
- asking me to read them a code sent to me via SMS
and when I refused to do that, they blocked my login credentials for online banking and sent me a sternly worded (paper) letter that my account could not be upgraded automatically for their software system migration because I had refused to engage with their support agent.
I then had to create a new login in their app, call the phone number on their letter and read that guy the SMS code and, to my surprise, that was the only !!! authentication needed to activate the new login credentials that I had just created.
(BTW, this was one of the top 100 largest banks worldwide)
It's almost like some companies are training you to fall for scams.
EDIT: This specific instance was Deutsche, but Chase has the exact same horrible habit of calling and then asking for an OTP code.
Sometimes the rep is understanding, and acknowledges that he would have the same reaction, but other times it's like they don't realize they're asking their customers to do something Very Stupid™.
It was also difficult that when people asked whether they could call back, we encouraged them to, but couldn't guarantee they'd then speak to the same person. They'd need to just talk to whoever they got. That was usually enough to put the person off and they would just take the risk (unfortunately).
Edit: Just wanted to add that I personally didn't want the people to make an exception to their unknown caller scepticism. Perhaps this bugged me more than others, but I would strongly encourage them to call back, and then do my best to get the call-back transferred to me. For that and many other reasons which I like to think of as preferring quality over quantity, my stats were as bad as you'd imagine!
When that bank did really try to tackle this issue, they quickly realised that there was more than one level of risk, and for the vast majority of the calls, we could get by with very little of that customer verification process - basically just that we had called them on a number they had provided, and they stated their name (which I think was more as a recorded verification that they were at least stating they were the correct person). For the much smaller number of outbound calls with more risk, we could then ask the person to call back. Once the risk peeps were on board, it was vastly improved fairly easily.
I'm not in that space at all now, but it seems far easier than it was back then. A few banks I'm a customer of send notifications right into the online banking app, which the customer approves, confirming that they at least have access to that. I don't know what they do if you don't have the app installed. I do find it a little sad that it is yet another thing pushing you to need a smartphone (and to install yet another app). On the other hand, I think all of those banks require me to have the app to use as an authentication token to do any kind of online banking even on a desktop browser, so if you're going to do that, may as well take advantage of it everywhere.
Sensible. But this whole “we called you now prove to us who you are” mess is stupid.
“Hey, this is Carol from Le Bank. Please just give us a call back at our main number found in the app or on our website. Then you can reach me directly at extension 123.”
"New online banking and new app
From 25 August 2025, you will benefit from the upgrade for online banking and Deutsche Bank app.
[..]
From 25 August, you will be able to simply reset your PIN yourself.
[..]
after logging in, you can also see accounts for which you are an authorised signatory."
But out of fairness, let me just mention that Chase behaves the same way. I think all of them just don't really care about small- and medium-sized businesses.
The worst part of this (for BECU) is that they've been warning their customers about phishing attacks from entities claiming to be BECU.
On another occasion the bank called me regarding my house insurance and asked me to identify myself with their dongle.
Like, there is a wonder I have any money at all in my account. But then again, giving away plastic cards with a magic number on that you gave to strangers for them to withdraw an amount of their choosing from your account was the norm for decades ...
Maybe the wisdom is "Security through no security"?
She had to do some additional work to resolve my issue but it did get fixed.
I called them about my Fitbit warranty and the rep needed to verify my account and wanted me to give him the code from SMS that explicitly said in the SMS not to give it to anyone!
No my account did not get hacked afterwards. Yes it was a legit service rep because afterwards he was able to pull up info on my previous warranty claim.
Edit: My bad, I misremembered. It wasn't that they truncated them, it was that they were case insensitive. Which is... objectively worse.
If it did and even included details like the person‘s name, that would make me feel safe. If it’s a generic OTP that could be used to log into my account or reset its password, though…
If anything even remotely similar happened to me, I'll instantly close all accounts and move my business to another bank.
There will always be people that are "wallet inspector" stupid that you can't really shield from scams. But common sense practices and consistent messaging would solve a lot of the problem. There needs to be better accountability for companies that have these insecure practices. The same way they'd be held accountable for a data breach. Oh, wait...
https://www.youtube.com/watch?v=CS9ptA3Ya9E
To their credit/discredit, when I said no I'm not giving that out it says not to they just moved on. Not sure why they even asked then.
It is a setting that let your power company to change your temperature settings when grid is under load. We wouldn’t mind it but they turned our heat way down during one freezing night while we were sleeping. Everyone woke up with cold next day.
> - never give out codes sent to use via sms or push notifications to someone requesting them via phone or email. Never. The messages often even say that.
Chase bank still, as of last week, asks for these codes over inbound calls. Drives me mad. They do so when calling me about fraud alerts, not the other way around.
When you answer a call your brain kinda loses its ability to step back and think. Almost like the same trick that those people who ask for directions and steal your watch do.
Security is not the main reason I do this but it has been nice knowing I can't be reached directly by scammers and hackers.
Unfortunately, some call centers DO use that for verification in some cases (i.e. you call them, and they send you a code to your email/phone that you read back).
The key situation for giving out an SMS code that the gp is pointing out is the customer initiates the call to the support center.
For example, suppose somebody wants to add a credit-card to their smartphone digital wallet. They have to call the bank issuing their credit-card to do that. Once the customer support person answers the call, a common security verification (e.g. Chase Bank does this) is for them to send you a 6 digit code to your phone. You then repeat this code back to the support person on the call. They want proof of your identity and also proof that you physically have the smartphone with you. Repeating the SMS code to the customer support person is safe because the customer called the official 1-800 number on the back of their card.
That's a totally different sequence of steps from receiving a random call from somebody claiming they are from Chase Bank. Yes, in those cases, you never give out SMS codes to that untrusted person on the phone.
Note, however, that those are two "totally different sequences of steps" to you and I, and "completely analogous / equivalent sequences of steps" to my father in law :-/
Doing so would not force users to divulge codes over the phone, and enable support staff to verify identity all without training users that reading codes over the phone is acceptable.
Thoughts on that?
I think if the war against phishing online has taught us anything, it's that humans can't be trusted to not reveal secrets to scammers. Only machine-to-machine public key authentication (like TLS or WebAuthn or U2F) is truly phish-proof.
I assume in the case where the customer initiates the call and support is verifying their identity via SMS, they use different text (i.e. not "to confirm you're signing in"). Otherwise, that'd be pretty ridiculous.
the verbiage is the same.
My reply involved the effort of sending a test message from my Chase account, to capture the exact text used. If you want people to engage with you in good faith, you should put similar effort into your replies, rather than just use Reddit-speak for "I think you're wrong."
It's like they want us to get scammed?
Yeah, insane. I think it was HSBC. This was a couple of decades ago so maybe they've fixed that. I don't bank with them any more.
But over here our bank has also been sending out leaflets on how to avoid scams, and the top two are "if you need to call, call the number written on the back of the card" and "if you're not sure, come to the bank in person".
Same thing I tought my parents, and my mom actually got a call about some "personal info they needed to verify", said she'll come to a bank in person, they said "ok", she went in person, and they actually needed to verify some data (some EU regulation, she hasn't visited a bank in years).
So some of these systems are very poorly designed.
Or even better, don't rely on a third-party hosted service.
I've been a Codebook[1] user since the old-days when they used to call it Strip.
They are old-school, local-system storage. With sync/backup done how you like it (all three encrypted before it leaves your computer):
[1] https://www.zetetic.net/codebook/There’s good reasons to use it over self managed solutions, just like there are other good reasons to use a self managed system like this.
Neither should be strictly dictated as better without first ascertaining what the user is looking for
Capital One texts codes during live calls and requests the customer read the code to them.
A health care provider sends emails with links to 3rd party domain to provide encrypted email, because a) regular email isn’t supposedly not HIPAA compliant and b) apparently the health care provider’s web and app infrastructure which provides secure messaging is not secure enough for certain messages. It’s indistinguishable from a phishing attack.
Hospital direct invoicing by email, also includes 3rd party links, which takes the user to a site asking for personal information including SSN. It’s certainly phishing. Right? Nope, it’s legit, and no option to get a mailed bill once volunteering an email address.
I think half of mobile device users don’t know or can’t handle a best practices workflow.
The reality is the tech industry sucks, it’s bad at its job, gives shitty advice to everyone then goes and violates all of it leading to loss of trust.
It isn't.
I work in healthcare, and if anyone in the company sends an email with PHI or PII in it, we're supposed to alert the Security department, or lose our jobs.
> no support group from a big company is going to call you. Ever.
Is, eventually, you probably will get a call from a support group at a big company, as many have noted in response, and then all of the other absolutes in the list also become "well, people say never, but I think this is one of those exceptions" instead of "it's never worth taking the risk of assuming it's the company who really called you".
A company, even big one people joke about having a complete lack of actual human support agents, may really call you one day. The other 364 days of the year it's probably a scam. The safe bet is to take the issue they called about and contact the official support channel yourself (being careful to get a real one and not an ad/fake site if you need to Google it). It may not always seem the most convenient, but it only takes one mistake to end up in a much more inconvenient place one day.
I'm imagining something with the non-phishability of U2F but the usability of an SMS 6-digit code. Maybe that's U2F.
Google Support would call me all the time, and then first thing they would do is ask me to open the interface and repeat some code or another.
Some services even say that when they are indeed codes you are _supposed_ to read back to them. Which clearly helps further train people to ignore that language.
I tried making this point downthread but it bears repeating higher up. Per OP, this was account with Authenticator enabled. If you have a working authenticator setup, they aren't going to "ask for a code", since by definition you're already authenticated. And while I'm no expert, I really don't think there is such a thing. Recovery for a lost account never goes back to device-in-hand once you have enabled full 2FA.
Something is being skipped in the description of the phish here. I don't think OP is being completely honest.
Then the attacker used Google SSO to perform the initial log in to my coinbase account. Then they opened Google Authenticator, signed in as me, to get the coinbase auth code so they could complete coinbase’s 2fac.
I really think you're reaching here trying to ascribe blame. You... just got phished.
I'm not familiar with the formal account takeover process at Google, but my best guess is that the attacker simply requested an account takeover via the official Google process, which triggered this email to be sent by Google legitimately. By reading back the code in that email, the attacker was able to claim the Google account as theirs, thus access the Gmail inbox to reset the Coinbase password and access the authenticator backups from the Google Drive.
I would be very curious to see the original message headers of the email though.
Look at the first sentence of the first paragraph and the first sentence in the second paragraph. Two grammar errors which are a dead giveaway it's fraudulent.
> Thank you for your assistance and understanding during your recent support call, regarding a ficticious request aimed at accessing your Google account.
Comma doesn't belong there and "fictitious" is misspelled.
> To follow all guidelines of the internal review properly. Please keep a secure note with the temporary password which your support representative has provided to you.
Out of place period. Should be a comma.
Legit, canned emails like this (especially from legal@google.com) would be proofread much better than this. It's fake.
The spoofed email was deleted by the attacker, but I have a copy because I forwarded the email to phishing@google.com (something ChatGPT told me to do). The attacker then deleted the original but when I got my account back an hour later, Google bounced back the email. So that is the copy I have and the headers are not super helpful.
You're going to get hacked again
https://www.thesslstore.com/blog/wp-content/uploads/2023/05/...
Edit: I searched my email and it doesn't look like they are doing this at all with their accounts.
Edit II: Looks like it's on hold: https://blog.kickbox.com/gmail-bimi-exploit-what-you-need-to...
You must be insane to use gmail for anything like banking, crypto, domains.
I lost access to my gmail account. I know the PW but I can't access the 2 factor authentication anymore.
Yes, you need to buy hardware, yes you need 1 or more backup yubikeys in a bank safe somewhere in case your primary one breaks, but it is actually safe.
Strong passwords in your head are bad because they're even more phish-able. Like, with FIDO2, my yubikey will not login to "fake-coinbase.com", the attacker cannot proxy the data they get from the yubikey. For 2FA TOTP codes and for passwords, a phishing page can just proxy through the stuff to the real coinbase and login (as happened in this attack).
Sure, have a second one at home that can be Fedexed to you.
I wonder sometimes how many scams I've avoided simply by pretty much never answering my phone when someone calls unless I'm expecting a call or it's someone I know.
> The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.
Ugh, google
I was pretty suspicious but thought I would get them to authenticate their identity as someone really from Amazon by telling me the last thing I had really ordered was...
I must have stayed on the call for 20 minutes, eventually they ended up swearing at me - all the time I could hear other people in the same room trying the same lines on different people. I have no idea why I stayed on for so long....
I do not answer calls
Maybe 3 or 4 of these a day <sigh>
Then because of the leak side channel effect they can further future target calls such as coming from google about your problem with "your pixel 9 or 10?"
I assumed this was normal.
What a shit show.
They're saying that the least likely part of the cover story is that Google would proactively reach out to you in order to help you personally with the service you are (most likely) paying zero dollars for, and assign one of their most expensive employees to the case.
They have the scammers working off phone queues, it takes a little bit of time to get the call to the scammer, who has to start off with a script, so there's a delay.
Remember, the scammer, also likely not a native english speaker, also probably bored out of their mind, has to spin up, they have to read the name, understand how to say it and then say it out loud. Their is a mental startup time that a normal conversation doesn't have.
If someone calls you and isn't ready to immediately respond to "hello" it's a scammer.
https://support.google.com/phoneapp/answer/9118387?hl=en
Personally, I would utter a confused "hello?" if I was calling somone, the ringing stopped, and no one said anything, but I guess not everyone would.
Getting a procative call for my benefit would make me very suspicious about the authenticity of that call!
I certainly don't. Every call I get from the school seems to come from a different number. And the camp she was at when she hurt her leg and had to be taken for immediate medical attention.
I get it, in your world, in your experience, it all works out. But in mine, it just doesn't. From experience, I _know_ this is true.
The attacker had access to the Google account which includes passwords from Chrome and also the 2fa codes stored in Google Authenticator, because those were synced to Google without the author noticing it.
So with passwords and 2fa the attacker could login to Coinbase too.
Friend’s mother got scammed. She’d contacted tech support and they said they’d call back. Then a scammer just happened to call her within that next hour…
In my experience most authenticators cloud sync automatically, at least on iOS. For most people, this is a benefit. Otherwise, lose your phone and you're stuck, I doubt most people secure recovery codes properly either.
The answer is almost certainly greater than 0.
Never, ever, use a cloud password manager, that's just dumb. Combining these things together in some sort of master account -- be it Google, Apple, Microsoft -- is also terrible. It's like leaving all of your savings accounts, checking, and investments at a single bank.
All of this stuff is going to get way worse because of AI. You'll be talking to real people you know personally who are 100% not AI but were tricked in to asking you to do something by other AI enabled scammers. However aggressive I've suggested people be in the past probably isn't going to be enough for 5 years from now.
These things have always been possible, and have been done, but now they can be done at scale, with advanced testing to figure out what works on who, whereas before it was targeting the guy who kept posting pictures of expensive watches on his public Instagram.
Great advice for someone who doesn't have children or family members with health conditions.
Do people actually downvote this? Seriously???
I also don't leave any information I'm worried about someone stealing in my Google account. I find it hard to understand how anyone in tech could fail to see how risky that is.
but you're assuming that "bank security" (or the like) will never call you to alert you to a scam, or that you will recognize their number. maybe they don't, you may know that, but I sure don't.
I'm assuming no such thing. I have indeed gotten calls and texts from my bank and my credit card companies alerting me to fraudulent transactions, that were legit calls and not scams.
But I didn't answer those calls or texts directly, or try to figure out whether the number that was calling me or texting me was the right one. What I did was to call a number that I already know, independently, leads to my bank, or to my credit card company's fraud department. Or I independently logged into the bank's or credit card company's website to see if there were any alerts. And if there were, I acted on them.
I described this in my earlier post: "If they claim to be from some company I have a relationship with, I check independently to see if something's up."
But if I get such a call or text, I don't answer it. Instead I do what you describe--call the official number that I already know independently. (Or I log in to their website to check for alerts.)
It's true, unknown calls are 99% spam. That's on you if you'd want to believe otherwise; by your own admission, you don't know.
Yes, important companies you do business with you will come to store those in your contacts. You'll have specific account reps even. Services, apps, don't call you, for this very reason, they have in-app confirmation flows.
And nobody use voice mail in EU, it seems to be an US thing.
Sure it is. Just because you get a call about an issue that turns out to be legit, doesn't mean you need to resolve that issue by answering the call.
I describe upthread what I've done when I've received calls or texts from my bank or credit card companies about issues.
It's happened lots of times and it's why traditional banks are way more secure than crypto.
Well done to the author for talking about it, but I hope the real lesson is learned that crypto isn't a real store of wealth and can be stolen at any time....
Sure, but this is Hacker News, not Mugger News.
Like crypto, wire transfers are difficult to track and irreversible.
The victim may also have a chance to cancel the transfer, because they’re not instant. (especially outside of business hours)
It’s just not an attractive way to mug someone, it’s easier to take them to an ATM.
In Europe a wire is instant with no recourse.
Most banks have processes for giving money back in some of these cases.
For example, even a 2-of-2 setup with a trusted authority like a bank is straight-forward improvement in security over the conventional bank system.
You can go further, for example consider a 3-of-5 setup with 2 keys in security deposit boxes, 1 key on a laptop, 1 key on a phone, and 1 key on a hardware token. You can set the hardware token to erase its keys when the wrong pin is entered, making it pretty rubber hose proof.
So you want there to be as low of a barrier of entry as possible, which is how we get here...
Especially when transactions can't be traced
If some idiot leaves all of their funds on an exchange like this, and it gets hacked, then good. That's how the market evolves and money moves out of the hands of the incompetent and into the competent.
Of course, this doesn't help if you don't have trusted associates — and can be (even more) dangerous with multiple people responsible for crypto custody.
Also helps if you have offline ("cold wallet") storage, which would require hours to importPrivKey and redeem. Slow them down...
It's a tiny, infinitesimal chance: but it's a heck of a lot greater of a chance than the same thing happening with a bank account, especially the "no recourse" part.
There are 2^256 wallets. There are 2^72 grains of sand on earth.
The chance of your bank screwing up is a lot higher, by trillions.
I'm a huge critic of the cult of crypto, but the odds of a key collision are smaller than the odds of <some highly improbable series of mistakes/coincidences/malice happening that result in you losing your money in the traditional banking system>.
The odds of a 'someone gets access to your account/wallet and instantly drains it with no recourse' are much higher in the crypto space, as the author of the post experienced.
Unrelated, but for added spice, here's a thread from ten months where everyone agrees you're a fool unless you secure your coinbase account with google authenticator
https://www.reddit.com/r/CoinBase/comments/1h65zuh/account_h...
With my bank, I've been able to recover several thousand after a thief was able to bypass the 2FA app used to verify large transfers. (I still don't know how they were able to bypass the verification, and after investigating our bank never told us. Not sure that makes me feel all warm and fuzzy, but at least I was made whole with minimal fuss.)
With the former, your recourse is essentially zero. Banks won’t do anything, cops are useless.
With the latter, banks try to prevent it and it’s harder and riskier.
In USA, banks are actually required by law to reimburse fraudulent account activity if reported within 60 days. However, this does not cover cases where the account holder themselves made the transfers even if they were tricked into doing so.
But if someone gets your login and liquidates your bank account, in USA a least, the bank is 100% responsible for that fraud.
Credit card companies are 100% responsible for fraud regardless. Even if they try to market it as a perk "You're never responsible for unauthorized transactions". Yeah, no shit. It's the law.
Doesn't seem like there's a lot of middle ground between being responsible for your mistakes and being treated like you can't be trusted to make your own decisions.
There isn't any federal regulation at all covering your Bitcoin.
Or (given the password database link at the end), is the sequence:
1) various logins are pwned (Google leak or just other logins, but using gmail as the email - if just other things, then password reuse?)
2) attacker has access to password
3) attacker phishes 2FA code for Google
4) attacker gains access to Google account
5) attacker gains access to Google authenticator 2FA codes
6) attacker gains access to stored passwords? (Maybe)
7) attacker gains the 2nd factor (and possible the first one, via the chrome password manager?) to a bunch of different accounts. Alternatively, more password reuse?
I guess the key question for me, was there password reuse and what was the extent, or did this not require that?
Disclaimer: work at Google, not related to security, opinions my own.
I have no idea how they had my password, I never share passwords or use the same password. But I hadn’t changed my Google password in a while.
The only question mark is the email from google. It sounds like it was a scam email, so it would be interesting to know whether/how it was spoofed.
And did you have passwords using chrome password manager as well (which were also compromised by the Google account access, and this is how they got access to e.g. Coinbase?), or did they get passwords through some other means and just needed 2FA?
By enabling cloud-sync, Google has created a massive security vulnerability for the entire industry. A developer can't be certain that auth codes are a true 2nd factor, if the account email is @gmail.com for a given user because that user might be using Google's Authenticator app.
Specifically, the most problematic is SSO + Google authenticator. Just @gmail + authenticator is not enough, you need to also store passwords in the Google account too and sync them.
Although, this is functionally the same as using a completely unrelated password manager and storing authenticator codes there (a fairly common feature) - a password manager compromise leads to a total compromise of everything.
I don’t see how this happens if you use strong passwords without reuse.
I sleep fine at night, this is a Hallmark of these "omg I got owned and it could happen to you!" posts that never quite add up.
Inbox access is a fairly big compromise, even without the 2FA codes.
I'm assuming this is a dirty unicode hack and not something worse: no DKIM or an actually compromised sender.
The whole thing stinks.
Thanks ICANN!
The headers uploaded are the report email being sent to Google, not the original incoming email. We still don't know how this was spoofed.
https://imgur.com/a/Ki2cciH
minimal efforts, won't pass any scrutinity but someone panicking might miss it.
Thanks OP for the thread, very enlightening.
I wonder how many people would fall for that though.
I use the super-sophisticated method of manually copying everything important to an external storage another every 5 weeks or so. That has never failed me.
> In just 40 minutes, the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.
One of the many, many benefits of irreversible transactions.
> I made mistakes, yes
His first mistake was keeping six figures worth of 'cash' in a wallet that anyone with less than 40 minutes of access to can swipe.
My brother (a tech professional in California) does not have any crypto or social media, and attackers still stole his phone number, which they used to steal his email account, which they then tried to get into a non-existent Coinbase account. He was only out of the time it took to get his phone number back (a couple of hours later).
So many people and developers do not understand two factor authentication. If the necessary information is automatically sync'd to another device, you likely don't have two factor auth.
Example: If you log in from a Macbook, and the second auth is sent to your phone, Apple will helpfully forward that code to the Macbook, completely removing the second factor.
If your goal is to stay safe even after one of your devices is owned then you’ve got a rarer (and way more difficult) threat model.
Since you’re getting harassed all the time and dealing with opaque rules it is no wonder people are fatigued, make mistakes, are inclined to panic when they get a scary call and hand over the keys, etc.
To add to that, having anything to do with crypto is to put a big target on your back and make yourself vulnerable.
I've seen references to "three factor" auth which is often a push notification to a phone, and then there's more secure second factors, like yubikeys or code-protected passkeys.
But the main way to know is that companies never call you these days. No company should have and few do have a workflow where an employee will call you "cold" with a problem. Instead, companies email, snail mail or text about a problem and you call them back.
But if someone somehow sounds legit, you ask for the official number and whatever info is need to identify your supposed problem. Then go to the website and verify. Call the number at the website (that you find from your own search, not the caller's info) and then have them verify you.
These scams will only get better, they will impersonate your loved ones, your best friends, your children, and plead with you to save them by handing over money or information, but it will all be a ruse. The only things that can prevent this outcome are: positive ironclad proof of identity / personhood / company representation, or ongoing rejection of belief in inbound communications.
``` By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor. ```
> On iOS, Gmail doesn’t let you view full headers
True! But Gmail on desktop does provide full headers. Why not post them so the rest of the community can step in and help out?
Google has dozens of properties and it is easy to generate an email from one of them that seems to confirm the attacker's identity. Never trust any of these to identify a legitimate representative.
Sadly for the scammers, that number didn't match. But, I note it was part of his script to sound confident and give a working URL. Pretty strong.
Yes, SPF (the original design) is horribly broken and trivially bypassed. The most prominent design flaw is that the inbound SMTP service uses the SMTP (rfc5321) MailFrom address for SPF validation, which is not the same sender address shown to the recipient, they can only see the the message (rfc5321) 'From' header address. SPF originally didn't require the domains in the MailFrom and From addresses to match, so an attacker would simply use a domain they control in the MailFrom address, and the 'spoofed' domain in the From header.
That was in 10 years ago though. DMARC fixed this by adding the alignment requirement, meaning that the domains in the MailFrom and From address must match. By default the alignment policy is 'relaxed', meaning that the MailFrom and From domains can differ in subdomain, as long as they share the same organizational domain. Setting the SPF alignment to strict (aspf=s) like you mention in your post requires the domains to match exactly, with no subdomain differences allowed.
So, it doesn't matter that Google doesn't use strict SPF alignment in the DMARC policy, the fact that they have DMARC already adds the requirement to SPF validation that the domains must match.
Yes, google.com and gmail.com use the same IP ranges in the respective SPF policies, but Gmail will never allow you to send email addresses from a domain that you do not own. This is why domain validation is required when you set up Gmail with a custom domain.
The only scenario where your explanation would hold up, is if the attacker was able to gain control of the DNS of a subdomain of the google.com domain, and successfully validated it as a custom domain in Gmail, then send emails from that subdomain in rfc5321.MailFrom address and the google.com domain itself as the rfc5322.From domain.
Deprecating SPF would do everyone a favour though. Especially for reasons like these.
Google owns and manages all of this, so they can send emails with a google.com MAIL FROM, a google.com header, and signed with a google.com DKIM key. And they could do likewise with gmail.com emails.
I'm not clear on why this isn't practical, perhaps there is something I'm missing though? I would appreciate your viewpoint.
Edit: I see you added a point about forwarding.
Your MTA can still check alignment for both HELO and SMTP From as specified by SPF's RFC(s) though and spam filters often do for extra information/signal.
DMARC's adkim/aspf aren't basically supported in practice. Nor they should be. For reasons already mentioned, as you already read.
Yeah, I would be curious to see the actual email headers of what was received.
As an aside, fun fact, this would not be possible with @apple.com because Apple employees have old-school S/MIME signatures as an additional security layer.
A few do, but most do not, and certainly Apple's automated-system e-mails do not.
In theory, third-party places like gmail could (should ?) automagically verify S/MIME sigs where a root cert is readily available.
There's no system in place to warn the user when there is no signature and that there should be one.
https://easydmarc.com/blog/google-spoofed-via-dkim-replay-at...
https://undercodetesting.com/how-email-spoofing-exploits-spf...
Why do banks have to "know their customers" and telephone providers don't?
I have read that one problem are VOIP systems which can spoof outgoing phone numbers. It sounded like these are easy to attack. Or maybe scammers just make fake VOIP calls from overseas.
Can somebody explain what exactly this means, and how it works?
We trolled each other in class with it a bit. But at one point some student not in our class sent out a mass email, which was against the rules. I replied with a From line as "Administrator" and a bunch of whitespace, telling the girl that she broke the rule and would be suspended for it. Our teacher made me apologize, and I was lucky that I didn't get into more trouble beyond that.
Basically, the from field on an email can be anything you want. It's like sending physical mail and using a fake letterhead with someone else's info, just type what you want. No verification.
That's sometimes a good feature. Like, a third party provider can send newsletters on behalf of company A. But can also be bad, when used for phishing.
However, the email doesn't just appear in your mailbox. It comes to your email provider by another server connecting to it and sending the email. Spf allows the owner of A.com to specify which IPs/servers are actually acting on their behalf. So if I get an email from something@A.com, I can lookup and verify that the sending server is one to trust. If not, the email client should reject or warn the user somehow.
I'm pretty surprised gmail didn't flag this at least. When I did it for a class in Uni, it always let me know that the FROM header didn't match the sender since that's a clear attack vector
I would also assume something as prominent as the Gmail website/app for iOS, and the google.com domain, would have all possible email security features correctly configured.
So.. is this not the case? Or is it, but due to bad UI, despite all this security, any schmoe can send email appearing to come from google.com, and I have to pore over unspecified details in the "full header" to spot a fake?
Apple Mail does allow you to see the actual sender if you tap on the name though. Outlook has been way worse in that aspect, by not letting you see the full sender. At some point it even saved these fake addresses automatically in your address book if it matched a contact's name or something. (I couldn't find the thread about it right now, but it has been discussed elsewhere.) It's a disservice to everyone except attackers to be honest.
This is honestly the cause IMO. I refuse to any call from any number not in my phone book, UNLESS I am expecting a very specific call and if it’s not who I expect, I hang up with no conversation.
A warning to auth engineers: if an account is using a Gmail address, then auth codes from Google Authenticator should not be considered a second factor.
I don’t use Google but at least in the Apple world you also get a fairly different prompt for enrolling a new iCloud Keychain device than simply logging in. Obviously that’s not perfect but there is a good argument for not getting people accustomed to hitting okay for both high and low impact challenges using the same prompt.
I think I requested the reset with various details, then had to wait 24 hours before continuing.
About a decade ago I had suggested to Google at an identity forum that they embrace a local government/organization model for their hard-landing account recovery process (since it can ultimately devolve to an ID check) by having a mechanism where you can start the account reset process and get something which could be taken to a third party to approve after they do an ID check. As people increasingly depend on things like email accounts for everything there are a constant stream of people who will lose access to their phones but could easily visit a notary, library, DMV, police station, etc. and pass a check against a pre-registered government ID.
Incredible take. I don't know what's worse here — suggesting gmail address = google authenticator, thinking you can know the source of "auth codes", or the fact this is coming from an auth engineer. I'm switching to handwritten HMACs on paper napkins today.
I'm not sure if I have the same password reset flow as OP, but when I try to reset my password and even provide the 2fa code, it basically doesn't let me get past a certain point without contacting my backup email address or making me use a phone which I'm logged in on to complete the reset
Email spoofed from legal@google.com and he read it in Google's Gmail app for iOS. The original title was correct: "Google Helped It Happen"
You can use Google Cloud or Google Sites to trigger emails to anyone that legit come for Google email addresses and servers or submit forms on Google that will send legit emails to Gmail users/targets.
They simply either just embed their scam text into these emails or use the emails from legal@ as a scare tactic and pretext for their scam when they call you.
Read the text shown in the screenshot in an article. I am 99.9% sure that is not from Google. The wording screams scam to me, most likely from someone who is not a native English speaker.
Among many many other red flags, it specifically says not to try and change your password for 6-12 hours and to not share the details of the email with anyone.
It was only after I checked Twitter that I saw Garry Tan's callout of the exact same scam. After experiencing it myself, I wouldn't fault anyone who fell for it. The only other tip-off was that the voice was pretty monotone and unemotional, but that only appears obvious in hindsight, not in the moment where you're slightly panicking that someone might be trying to claim access to your account.
I am not clear how the account access occurred. What code did he read? He voluntarily read his own 2FA code from his Authenticator?
This person read an SMS code — one that explicitly says not to give it to anyone — and then they said "I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes! And yet, I got phished."
This person's greatest mistake was answering the phone to a stranger. Who knows what hell can be unleashed on one's emotions nowadays with AI. One cannot expect to be rational in a lion's den.
They are royally fucking up their PSA by throwing Google under the bus rather than telling people to avoid answering their phone to scammers. I suspect this PSA will help approximately no one because of that. Not getting your voice captured (for AI synthesis) is, by itself, a great reason not to answer random calls like this.
This is key. I would "never" fall for a scam like this. But who knows for sure? I would also never cheat on my partner, but can I say with 100% certainty that some insane situation can't possibly ever come up where my many layered defenses are compromised? Can some sufficiently charismatic individual deliver a perfect AI script to me based on info from 5 other breaches, in my brother's voice, to make me give up a 2fa token in an emergency? Maybe! So just never answer the phone, ever
Your story is humbling, and a good reminder that anyone can get “got”. We shouldn’t think ourselves above such incidents.
You can literally tie a yubi key to your Coinbase account and no one can withdraw funds unless a yubi key is physically plugged in and pressed.
One can also use the Coinbase Vault system where it would be impossible to steal any funds from his account had he enabled it.
You should also never use cloud sync for Google Authenticator as evidence here as why.
Ever since then I've been getting hundreds or thousands of Google notifications I've had to decline. Anyone know how people are able to send out hundreds of 2FA gmail notification popups without Google blocking this?
Never understood this convenience and never will. This is exactly the wrong way to deal with people losing their authenticator secrets.
Yeah, I do. Do you? Because it's certainly not what you're implying
Google took forever before adding cloud-sync to their TOTP app even though pretty much all the other ones did it from day 1. And I bet a non-trivial amount of people got locked out of their accounts because they hadn't reliably stored recovery codes.
Financial services are actually the least of your worries since you can get ahold of customer service and eventually recover your credentials even if it takes a few days and some snail mail. However if you lose access to Gmail or Facebook, good luck unless you know an employee.
2. (More general) When a person initiates a communication with you it is for his benefit, not yours. If it was for your benefit then you'd initiated the communication to benefit from it. This is not only about scam but also about selling stuff or answering to polls or whatever. Be always sceptical when somebody you don't know contacts you.
I've lost 2FA codes. It's complicated but if you have a financial relationship with the vendor you're going to be able to get everything sorted out. I imagine as this happens more there will be common internal policies which aid customers in this situation.
You have to weigh the amount of potential hassle against the value of potential losses. Why you would have $100,000 of value stored somewhere and only secured by a loose-lipped third party app is beyond me.
Most clued-up places enable you to register a Yubikey as 2FA.
So then it doesn't matter if you loose your OTP app and your backup codes because you've still got a Yubikey.
(And those that don't allow Yubikey, almost certainly will have SMS as a secondary option).
Still, better to just not do SMS auth. These days Yubikeys are not that expensive. Get three, register them all at the most important places, and put one at a parents’ place or similar.
But the point I was making that IF the website does not allow Yubi THEN SMS is almost certainly available, and you should use that as a backup mechanism.
Why ? Some sort of backup mechanism is better than none at all.
And what happens if you lose your Yubikey or it stops working? You're back to needing backup codes or an additional 2FA device
That's why you own N+1 Yubikeys ;p
Any place that offers Yubikey auth will enable you to register multiple Yubikeys against your account.
In all my time on the internet I have only ever seen one place that allows Yubikeys but restricts you to one key.
Google Authenticator can be local-only or synced to the cloud.
In local-only mode, the authenticator is bound to a specific device. You can manually sync it to additional devices, but if you lose access to all those devices, it's game over, you will get locked out of whatever accounts you secured with authenticator as the second factor.
In cloud-synced mode, it's synced to your google account, so if you lose your phone, you can restore authenticator state. But if your google account gets taken over, it's game over, the attacker has your authentication codes.
> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did
This was an account with authenticator enabled. I'm no expert, but I really don't think there's a recovery process that works as simply as "read back a code". Certainly not in the SMS 2FA sense I'm sure we're all expected to interpret.
Honestly it seems like the author is trying to blame Gmail's UI, when some other more involved phishing technique was actually the novel part here.
Did they send the fake legal email and at same time trigger a recovery code to be sent?
Is this like the same thing in discord where they ask you for your email to join a server then ask you for a code sent to verify you own that email but really they submitted the email for password reset. The victim doesn't realize it's a real recovery code sent by Microsoft, etc instead in the moment thinking it is a "discord code". Once you submit the code in discord they have your account stolen in seconds.
Is this what the article is attempting to describe?
if the scammers had spoofed the email, they would already have that code, and if they hadn't spoofed that email... I mean it looks like a case ID, why would they need it?
Maybe the reading back the code was to get buy in, then there's a missing step here like they had him hit "allow" on a 2fa prompt. Or maybe the email was legit, since it references a "temporary code" and the case ID allowed access with that code?
Good chance my reading comprehension is shot and I'm missing something, I suppose, but I don't understand.
That's more charitable than me. My UnreliableNarrator sense is tingling really badly here.
> In the Gmail app on iOS, it looked completely legitimate — the branding, the case number, everything. Even the drop-down still showed “@google.com.”
> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.
The sentences do not refer to the same thing.
The code was not in the email... The narrator was asked to read back "a code" not the case ID in the email. "A code" here referes to a 2fa push notification code. The email was used to rattle the narrator / build trust to get them to comply.
On the plus side, iOS and Android now have features for auto-answering and filtering so thankfully I have that.
Part of the blame should be levied on Coinbase if this is the case.
(I'm assuming this guy at least uses unique passwords...)
Coinbase has many ways to secure your account if the user enables them
also physical Yubi Keys would prevent anyone from withdrawing or steals funds as it would have to be plugged in and tapped to process them.
> Google had cloud-synced my codes.
> That was the master key. Within minutes, he was inside my Coinbase account.
The author wrote "codes", not "passwords".
Never act based solely on an unsolicited telephone call or email.
As for the email, this blog post ( https://sammitrovic.com/infosec/gmail-account-takeover-super... ) from about a year ago notes that somehow scammers were/are using Salesforce to spoof emails from Google that appear legitimate. Seems like something similar happened here, but there's no way to be sure without the headers which the scammer seemingly cleaned up.
The FTC reported that scam losses totaled 12.5 billion last year. These scams are elaborate and convincing even for folks who make a living in tech. ( https://www.ftc.gov/news-events/news/press-releases/2025/03/... )
At any rate, sorry this happened OP. Stay safe, folks.
I do see why Google did it; it's going to be difficult to educate users to always set up 2FA both on a primary and a backup device. Much easier and convenient to automatically sync different devices. But your story makes it obvious that something isn't quite right here.
And yes, Google could have added an extra encryption password. But users forget/lose passwords, especially if they normally never need them. So I can see why Google didn't go that route.
[1] https://www.reddit.com/r/2fa/comments/pmow4k/switching_from_...
My primitive security precautions:
1. DO NOT use your Gmail for recovery. Use another email provider.
2. Use a family member's phone number for recovery.
3. DO NOT install your bank's app. Somehow the Royal Bank of Canada's app was used as an attack vector. If the RBC app can get hacked, smaller banks are even more vulnerable.
4. Use incognito mode on your browser for banking so a thief or hacker can't use your browser history to find out your bank.
You can buy that information. Databrokers will sell it. Your bank sells your transactions.
I think the reality is that people think "Oh couldn't be me and am I going to be the weird security guy" so it isn't whether you know software and security etc. that determines it. It's whether you're willing to be embarrassed frequently in these conversations.
I've had the banks call me, Coinbase scammers call me, all sorts. I'm at the point where I block my own area code (which is from a different state where I have a few people whitelisted fortunately) and that's eliminated a lot of it.
I don't mean I can't be scammed. Just that perhaps some mitigation comes from willing to be socially awkward and insisting to someone that you want to do it by the book.
At least when trying to drum up business from formerly-large accounts that have greatly reduced their spending.
The thought of having all my online services centralized with a single provider for email, SSO, 2FA, and so on is scary. Especially at Google, where you can lose all access at the drop of a hat, with no recourse.
My guess is that the attacker had the google password, and also the login for Coinbase was somehow stored in Google, so the attacker getting into google also exposed Coinbase. I just looked at Coinbase, and it does have a "Sign In With Google" feature.
If you want to live the stripped-down TOTP lifestyle, you have to love this 20 line Python solution. Does not depend on weird libs, and the last edit is 4 years ago. Write the seed on a Post-It and you're all set. Not so convenient, but sound sleeping! https://github.com/susam/mintotp
This was such an obvious mis-feature I can't believe they actually rolled it out. For those using Google Authenticator you can and should disable cloud sync of your TOTP codes.
Don't disable cloud sync unless you have a backup of all your TPTP secret keys. It's dangerous to advise people to disable cloud sync without mentioning backups. Being locked out of thousands of dollars in your crypto account is as damaging as losing that crypto to hackers.
TOTP isn't that great, you should definitely use a hardware and/or pass key for important and financial services. That said your cloud synced Google Authenticator can be behind a Google account with strong 2FA (i.e. not SMS nor TOTP), then it's mostly fine.
The lesson here is really not to ever share codes you receive by SMS, and preferably disable phone as recovery and second factor.
Call the persons extension back from an out-of-band line, but after checking the contact phone number on the old web page or government business registry.
This is effective against most forms of line tampering, as targeting an unknown random line number is much more difficult to predict.
Most nuisance calls we get are the classic foreign operator message repurposed language translations trying to get people to "press 1 if you like ice cream" which bills 3rd party long distance calls. There was a local dubious calling card scammer arrested twice for this con. Just hang up, and report/block the number =3
https://x.com/0xzak/status/1967592307714379934
A Horrific threat.
Hello everyone I'm here to share my experience so others can avoid what I went through. A few months ago, I lost my entire life savings to an online group who posed as cryptocurrency investors. They were convincing and professional, and I only realized it was a scam after I have invested a lot of funds and when I tried to withdraw my money they disappeared.
I felt devastated, but I reported the crime to my bank and local authorities right away. After researching reputable resources, I eventually found a licensed financial-fraud recovery service that works with law enforcement. They helped me trace the transactions and recover a portion of my stolen funds. it gave me hope and some justice. If you've ever find yourself in a similar situation, kindly contact them in their email below: easytouchcryptocurrencyrecover@gmail.com
To Me this quote says so much about the crypto space more than anything.
Also not shocked it was crypto theft.
It kinda sucks that in 2025, voice calls are now near-zero trust.
Is there really no velocity behind any open/consortium replacement to traditional voice calls?
I recently got a Google scam call from someone using Google Voice in the bay area (650 number) claiming to be with Google and that an unauthorized device was trying to access my account. Eventually realized they were just trying to get my to unlock my account probably to drain bank accounts.
One of the best features of Apple iOS 26 is the new call-screening feature[1].
[1] https://support.apple.com/en-gb/guide/iphone/iphe4b3f7823/io...
This will be great tho to help cut down on iOS users and scams hopefully
But that's hard because many people work on markers of legitimacy, not algorithms.
What clued me in was that he said he couldnt share the estate documents with me until I gave him my popup 2FA code.
You cannot spoof an email from @google that will inbox
This was not spoofed.
One click on the "backup codes" on main screen and boom, no confirmation or anything. Your keys are in the cloud. I couldn't find a place to undo it. Article says it's enabled by default now. This is shameful.
——-
Your sign-in code was successfully reset. If this wasn't you, contact us immediately on +43 1 3950657516
Reference: FPQ92
——
And this one
——-
You signed in from a new device in Beijing (China) through a Ledger Live API. If this is NOT you, call us on +43 1 3950657516
Reference: FPQ92
—-
Looks completely legit and I was really spooked at first. I can see how people fall for this stuff.
I wonder, though, did "Norman" just guess you had tens of thousands in crypto lying around, or was this step two of a phishing attack?
A lot of them ultimately (if carefully inspected) come from @gmail.com addresses. And many of them look pretty convincing.
Did gmail change something for the worse, or have phishers found a new way to circumvent Google's spam filters?
Never share a verification code. Scammers use urgency and fear (“you must resolve this in the next hour”) to get you to act.
Based on the second warning, I've decided not to trust the first.
I'm not trying to undermine the idea behind this article, but I was raised to never answer the phone and that was in the 90s
How is this basic fail still possible?
Is this a victory of Google's UI designer's quest for a "clean look", over basic security essentials?
Edit: Obviously not “you work at Google and your boss calls you” or whatever
But 99.99% of the time, phone calls from unrecognized numbers are spam/scams.
This should be the real highlight of the issue here. I always check headers on my Samsung whenever I feel suspicious.
why were your coins not in a cold wallet? that is how you stop this permanently
why did you acknowledge any kind of inbound communication? ignore it. always. or call outbound to a confirmed number to make sure.
btw you were scammed out of $80k, as you admit in your article, the headline is misleading for seemingly no reason except the larger number
it is still a second factor, because it is something you have instead of something you know; it's just that you converted it to something you know when you read it and transmitted it to someone else
all that being said, yeah, legal@google.com (as a homograph attack) should probably be blocked.
Apple's Mail.app also doesn't allow this and it's driving me nuts.
> the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.
Live by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency, die by the decentralized, irreversible, climate-destroying, scam-and-slavery-enabling currency.
> Google enabled Authenticator cloud sync by default.
Adding that to the list of reasons I use FreeOTP instead (https://f-droid.org/en/packages/org.fedorahosted.freeotp)
The security bottleneck is the one institution that holds all of the responsibility. It cannot be fixed by giving more hoops to authenticate themselves to the one institution
At least now more companies include a "never read this over the phone" note in their authentication texts.
Let this be a lesson to everyone who hasn’t been scammed yet.
Every action you did is what you hear multiple times every week about people falling in pishing, and you continued.
Finally, it was just some crypto shit so not a big deal.
I never answer the phone.
Any call from Google is a scam.
Healthy levels of paranoia aren't so bad.
But yeah tel tell with Google is if someone from Google calls you then you know it is a scam by the fact that Google called you. Google doesnt give a fuck about you. Even if you spend millions on ads.
so thanks for the advice!
>Keep your crypto on an exchange
This gets the same level of sympathy as a person without backups suffering from data loss.
Is the average user (someone who "works in tech" even!) really so uninvolved in their own security? Are they not expected to hold any responsibility whatsoever?
Whether you fall for an elaborate phish, or if your Ponzi-token predictably loses value after your 'investment' was cashed out as an earlier adopter's profit, it's all the same to me.
Alternatively your hardware wallet bricks itself or three of your disks fail at once.
I don't care. You lost the money when you first exchanged it for worthless tokens.
Regardless of whether you received an email from Coinbase notifying that you were affected, the attack they suffered is much larger than they let on to the SEC.
https://www.coinbase.com/blog/protecting-our-customers-stand...
Its not a GREAT carrier, but I have a legacy plan for unlimited everything at $20 a line.
But if I have to call in, they do send a 2fa SMS code, and require to tell them over the call. Its absolutely ridiculous. But, Ive only had to call in 4 times in the last 9 years, so, yeah.
I myself can keep denying them but I have a toddler and if he accidentally accepts one of them, I’m screwed.
And since it’s impossible to reach anyone at Google, WTF do I do?
Ah yes, and all millennials are immune to the attack in one fell swoop.
The most infuriating part of the story by far.
OP said the coin base account was drained within “minutes”. Server thief bait can take up to 24h to notify you when someone takes the bait.
> We'll put a tiny amount of cryptocurrency in a wallet, but probably still enough to attract the attention of automated scripts. We notify you when it's taken within 24 hours.
That being said, there are a few approaches that might leave such an impression to people unfamiliar with their email client.
https://en.m.wikipedia.org/wiki/IDN_homograph_attack
https://www.xudongz.com/blog/2017/idn-phishing/
Computing the the set of Unicode characters that would result in a homograph of a latin alphabet word is non trivial. Now do this for relevant/trusted domains, now put in place a mechanism to mark a domain as trustworthy that also minimises your liability.
But we aren't talking theory. In this case solutions exist, just not in this app?
Also, the triviality point is puzzling, are we only allowed to criticize professionals for trivial fails? (though using a different font is one of the trivial mitigations)
> that also minimises your liability.
How is that a factor, what is their liability now without any mechanism and will it increase if they add some?
Without them providing the headers this is just idle guessing, but I’d argue my guess is likelier to be the truth.
EDIT: to be clear, the fix has arrived: had he used passkeys, this attack would have been impossible and every login would’ve been faster and easier. There are edge cases but this is literally the reason why U2F was created a decade ago.
At some point people have to accept responsibility for their own stupid actions.
A little secret which will help you in life: everyone makes mistakes, even people who don’t think they will, even you. Looking all the way back to last week and 2 major NPM hacks ago, you can get access to a lot of systems simply by hitting someone when they’re busy and distracted.
Title: I Was Scammed Out of $130,000 — And Google Helped It Happen Heading: Google failed me in two ways Body: Google has become the vault of our digital lives — and that vault had cracks.
If Ford adds seatbelts and you decide to take them off because they annoy you; when get into a crash you can’t claim Ford failed you since the seatbelts weren’t forced upon you more.
> Phishing emails from “@google.com” made it into Gmail.
> Google enabled Authenticator cloud sync by default.
Both of these seem like fair points where one could reasonably expect one of the largest companies in the world to spend a tiny amount of money on security improvements which would make it harder to attack their customers. Not following Apple’s lead on security for Authenticator is especially disappointing since they have no shortage of good security engineers.
Don't do that. Don't put your 2FAs somewhere else than in an unsynched app. Not in Bitwarden, not in any online account, nowhere else than "Something you have".
And would you say that using something like authy with encryption using a totally unique password is safe?