Scammed out of $130K via fake Google call, spoofed Google email and auth sync

Re:Scammed out of $130K via fake Google call, spoofed Google... by carodgers on Tuesday September 16, 2025 @06:06PM (#45268819)

I don't understand. What combination of actions and app features allowed the scammer to send an email that is indicated to be from google's domain?

[ Parent | on HN ]

Re:Scammed out of $130K via fake Google call, spoofed Google... by davidscoville on Tuesday September 16, 2025 @06:11PM (#45268873)

That's the big question. I've heard attackers have used Google's own tools like Google forms or Google cloud to send the email through Google's servers so it wasn't flagged. This is a major vulnerability that Google needs to fix. I'm quitting Google because I'm worried about other vulnerabilities like this.

[ Parent | on HN ]