News for hackers. Stuff that matters.

A comment on Scammed out of $130K via fake Google call, spoofed Google email and auth sync. Parent comment

Re:Scammed out of $130K via fake Google call, spoofed Google... by pluc on Tuesday September 16, 2025 @05:37PM (#45268443)
Passwords don't matter if you have access to the inbox and 2fa codes, you can just reset passwords.
[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by ratorx on Tuesday September 16, 2025 @05:42PM (#45268515)
But if you get access to the inbox, then you have a compromised device or the password via some other means right?

Inbox access is a fairly big compromise, even without the 2FA codes.

[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by bdangubic on Tuesday September 16, 2025 @05:50PM (#45268606)
Inbox is the biggest compromise of them all IMO. I realized this a decade ago and use a different email for every account that I have. None of them have anything to do with my name in any way, I use 4 random words to create new email for any new account that I need. Accidental takeover of any one account does not lead to total take over of my life :)
[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by pluc on Tuesday September 16, 2025 @06:07PM (#45268822)
You're right, seems they already had his inbox credentials.
[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by cpncrunch on Wednesday September 17, 2025 @12:08AM (#45271551)
No, it sounds like they got him to create backup codes, which (along with SMS 2FA code, which he also gave them), that is all they need to take over the gmail account. Job done.
[ Parent | on HN ]