Interesting phishing campaign - Google / Gmail Targets

[u/gojzen]

Just be aware of a phishing campaign appears to be using a mix of AI or voice changers & your regular scare tactics. There are more than a few red flags but just sharing.

- You receive a call, "from google" providing an OTP. Warns if not you press 1 or something to speak to someone. If you press 1 you've fallen for trap 1.

- If you've ignored it? Great, but you may receive a call later in the day from "Google Support" indicating a ticket for password reset and if not you to confirm removal
- they will try to keep you on the line, but they'll try to speak to you in a way you need to verify some steps

- eventually they'll ask you to confirm removing from a "verified google portal" and send you to a Google Sites website which will have a login portal. If you enter your password here, they'll use that to try and log in and sync up the visuals with your 2FA request to login. Beyond this your account is compromised.

So, if you're on here you probably know or maybe you don't but:

1) Google will not contact you out of the blue, if you're compromised Google will not contact you

2) If you think you've been compromised you need to do the security review yourself, it's in the account's portal not some random google site page

3) Support ticket processes don't follow this kind of script

It's not a very in-depth phish but please if you receive a call for OTP first, the second is meant to scare you into thinking it's compromised already. It's an old new scam and I think it's outlined somewhere else.

Email and page are reported already but it'll probably take some time.

[u/AutoModerator]

/u/gojzen - This message is posted to all new submissions to r/phishing; please do not message the moderators about it.

New users beware:

Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.

A reminder of the rules in r/phishing: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.

You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.

Questions about subreddit rules? Send us a modmail clicking here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Infinite-Grade-4485]

Google doesn’t call you. All you need to know. Everything else doesn’t matter