In October 2021, the FTC Consumer Information Blog drew attention to a devious new scheme, in which scammers try to create a Google Voice line through your phone number and use it to send out phishing phone calls.
This scam relies heavily on social engineering, a form of psychological manipulation, to pressure people into giving up personal information. In these cases, what seems like a simple enough verification step, is a nefarious bid to take control of a piece of your digital fingerprint.
How Does the Google Voice Scam Work?
The Google Voice Scam targets people who have posted items for sale on community sites like Facebook Marketplace or Craigslist. The scammer may make an offer or otherwise pretend to be an interested buyer, then express some worries about responding to fake posts. They’ll then ask you to prove that the post is genuine or verify your identity. To do so, they’ll suggest sending a Google Voice verification code to your phone and asking for the code.
This is the element of social engineering at work – they disarm their victims by playing on a shared concern and making people prove that they’re not a bot, a security step we’ve been conditioned to expect by CAPTCHA codes and two-step verification.
The verification code being sent is, in fact, part of the Google Voice account set up. If the scammer gets the verification code, then they’ve effectively set up an alternate phone number, linked to your own, that they can access from anywhere. The scammers are then free to use that phone number for all sorts of automated text and email scams, without it being connected to their identity.
In a particularly cruel and effective twist on this formula, scammers will reply to lost pet postings, claiming to have found the pet and wanting to verify the owner’s identity.
Protecting Yourself
Beyond having your number linked to a fraudulent activity, scammers can also use that “verified number” in their efforts to steal additional personal information. Paired with enough other stolen information, scammers could effectively impersonate you, using the Google Voice line to breach your accounts, open new accounts, and defraud others.
The FTC has offered this advice regarding the Google Voice scam:
“No matter what the story is, don’t share your Google Voice verification code — or any verification code — with someone if you didn’t contact them first. That’s a scam, every time. Report it at ReportFraud.ftc.gov.”
Thankfully, Google offers an easy solution for reclaiming a Voice number and good cybersecurity practices – changing passwords, keeping software updated, and using antivirus software – can keep you protected following a data breach.
Vigilance and awareness the among the most effective tools for preventing fraud in all of its forms. For the latest developments in the world of forensic accounting and fraud prevention continue following SDC CPAs hot topics.