News for hackers. Stuff that matters.

A comment on Scammed out of $130K via fake Google call, spoofed Google email and auth sync. Parent comment

Re:Scammed out of $130K via fake Google call, spoofed Google... by pluc on Tuesday September 16, 2025 @06:07PM (#45268822)
You're right, seems they already had his inbox credentials.
[ Parent | on HN ]
Re:Scammed out of $130K via fake Google call, spoofed Google... by cpncrunch on Wednesday September 17, 2025 @12:08AM (#45271551)
No, it sounds like they got him to create backup codes, which (along with SMS 2FA code, which he also gave them), that is all they need to take over the gmail account. Job done.
[ Parent | on HN ]