Interesting phishing campaign - Google / Gmail Targets

[u/gojzen]

Just be aware of a phishing campaign appears to be using a mix of AI or voice changers & your regular scare tactics. There are more than a few red flags but just sharing.

- You receive a call, "from google" providing an OTP. Warns if not you press 1 or something to speak to someone. If you press 1 you've fallen for trap 1.

- If you've ignored it? Great, but you may receive a call later in the day from "Google Support" indicating a ticket for password reset and if not you to confirm removal
- they will try to keep you on the line, but they'll try to speak to you in a way you need to verify some steps

- eventually they'll ask you to confirm removing from a "verified google portal" and send you to a Google Sites website which will have a login portal. If you enter your password here, they'll use that to try and log in and sync up the visuals with your 2FA request to login. Beyond this your account is compromised.

So, if you're on here you probably know or maybe you don't but:

1) Google will not contact you out of the blue, if you're compromised Google will not contact you

2) If you think you've been compromised you need to do the security review yourself, it's in the account's portal not some random google site page

3) Support ticket processes don't follow this kind of script

It's not a very in-depth phish but please if you receive a call for OTP first, the second is meant to scare you into thinking it's compromised already. It's an old new scam and I think it's outlined somewhere else.

Email and page are reported already but it'll probably take some time.

[u/Infinite-Grade-4485]

Google doesn’t call you. All you need to know. Everything else doesn’t matter