“A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to click “yes” to a Google prompt on his mobile device.”
The call came from a real Google number, the alert came from google.com via Google Forms, and the recovery prompt was Google’s own. One victim lost about $450,000, another lost 45 bitcoins worth roughly $4.7 million. The caller, by his own account a teenager, bragged that “no one gets arrested.” Google supplied every piece of this con, and its Authenticator app syncs 2FA codes into the same stolen account by default.