There are so many different types of fraudsters and scams. One is a trusted institution or company scam. We have experienced this recently with scammers identifying as Google, but scams using similar tactics could identify themselves as Genesee Co-op or any other company. Thanks to @SoupsRanjan from Sardine.Ai on LinkedIn for this anatomy of the scam:
1. Recon: Attackers trigger legitimate but unauthorized account recovery attempts on the victim's account from foreign IP addresses. These attempts will generate real security alerts from Google or other company, scaring the victim into a sense of anxiety and creating a believable pretext for the subsequent call.
2. Credibility Building: Hours later, the scammer calls, spoofing Google’s 650-253-0000 number, or similar, pretending to be Google's security team. They reference the recent, unauthorized login attempts demonstrating "inside knowledge” and establishing credibility.
3. Multi-Channel Deception: The most insidious phase of the attack - the scammer informs the victim that to secure the account, they need to verify their identity. The attacker then initiates a real Google account recovery process for the victim's account while they are on the phone. This action causes Google's legitimate servers to send a genuine verification prompt to the victim's device via a push notification, an SMS message, or an email.
4. The Trap: The victim sees a legitimate notification from Google on their device. The scammer on the phone instructs them to approve this prompt. In reality, by approving the prompt, the victim is authorizing the attacker's password reset attempt, thereby handing over complete control of their Google account.
5. Theft. This is the payout phase where the scammer searches for passphrases to crypto hardware wallets, banking information, or credit card data, that often folks are taking pictures of and leaving it within their Google Photos app or email. Then the companies take the information.
This is the modern highway robbery. And to stop it, we must adopt a zero-trust posture: 1. Never trust a phone call even if it’s coming from Google or an authorized source. Hang up, do your research and if in doubt, call up someone you trust, like calling Genesee co-op directly. Call or email your trusted contacts as soon as when your Google account is being reset.
If you are ever asked for information like, stop what you are doing immediately, call the credit union at our directly line immediately.
Genesee Co-op
Subscribe to our RSS feed for ongoing updates.
