What happens if someone gets your Google Voice code?

by: FOX59

Posted: Jan 4, 2022 / 11:55 AM EST

Updated: Jan 4, 2022 / 11:55 AM EST

There are more scams you need to watch out for if you’re shopping online, especially on sites like Facebook Marketplace or CraigsList.

What may seem like an attempt to verify your identity during a sale may actually make you a target for scammers.

Here’s how it works…

Scammers reach out to you and say they want to make sure you are who you say you are, so they send you a text with a Google Voice verification code. They then ask you to send them that code. Once they get it, they can use it to create a Google Voice Number connected to your phone, which helps them conceal their own identity.

“If any individual is ever asking for a code, that’s an immediate red flag,” said Victor Wieczorek, Vice President of GuidePoint Security. “Those scammers could use that phone number which is tied back down to that individual who fell for it, so if they use that phone number for either malicious activity or scams, then potentially that phone number could be tied back to that individual who fell for that scam in the first place.”

With enough information, scammers could also access your accounts or open new accounts in your name.

Cyber security expects say you should never give your verification code out and to only use them for the sites they are intended.

“You have to watch out, you have to use that sixth sense, if something feels strange, if you don’t feel safe, then it’s best to back out,” said Wieczorek.

If you become the victim of one of these scams, you can report it to https://reportfraud.ftc.gov.

Copyright 2022 Nexstar Media Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.

LOS ANGELES - The Federal Trade Commission (FTC) is warning consumers of a trick used by scammers who attempt to conceal their identity and steal sensitive information by using a technique known as the Google Voice verification scam.

It involves scammers targeting people who post items for sale on websites like Craigslist or Facebook Marketplace. Once inquiring about the item for sale, a scammer will ask for a phone number and explain that out of concern about potentially fake listings, they want to verify a victim’s identity. 

They’ll attempt to do this by sending the victim a text message with a Google Voice verification code and asking the victim for the code. 

The FTC warns that if a victim gives them the code, the scammer will attempt to use it to create a Google Voice number linked to the victim’s phone. 

While it may seem harmless, if the scammer is successful, they’ll be able to scam others while concealing their identity using a victim’s phone number. With this information, they may also be able to access victims’ accounts using their name and phone number. 

If you gave someone who you suspect may be a scammer a Google Voice verification code, follow these steps from Google to reclaim your number.

Other scams are becoming common as the holiday season approaches. The commission previously warned consumers of another scam involving impersonators pretending they work for Amazon.

Acting FTC Associate Director Maria Mayo said scammers can contact you to offer a "refund" for an unauthorized purchase but "accidentally transfer" more than promised. They then ask for you to send back the difference.

RELATED: Major retailer warns of shopping scams during holiday season

Mayo said, behind the scenes, the scammer moves your own money from one of your bank accounts to the other (like your savings to checkings, or vice versa) to make it look like you were refunded so, any money you send back to Amazon is actually your money from your own account.

In 2020, the U.S. saw a 427% increase in delivery and shipping-related scams amid Black Friday and Cyber Monday, according to data from cybersecurity firm Check Point Research.

Amazon was the most impersonated brand in the U.S.; 65% of fake delivery emails came from bad actors posing as Amazon, Check Point found.

The company said some Amazon departments may call customers, but they will never ask for personal information or offer an unexpected refund. Also, the company will never send an unsolicited message trying to get this information. Additionally, Amazon will not ask for you to make payments outside of the website nor ask for remote access to your computer.

If you have become a victim of such scams, the FTC urges you to report it at ReportFraud.ftc.gov.

FOX Business and FOX 2 Detroit contributed to this report. This story was reported from Los Angeles.

The FBI is seeing so much activity around malicious Google Voice activity, where victims are associated with fraudulent virtual phone numbers, that it sent out an alert this week.

Fluffy is missing.

You post your lost pet’s photo online, hoping that some good Samaritan will find Fluffy, listing your phone number and crossing your fingers.

You get a text or email from somebody who thinks they’ve found Fluffy – or, say, somebody who wants to buy that scruffy old couch you posted for sale on Craigslist.

The purported lost-pet-finder/old-couch-aficionado tells you they don’t want to get scammed, though. They’ve heard about fake online listings and want to verify that you’re a real person and not a bot, or they might say that they want to verify that you’re the pet’s true owner.

So they tell you they will send you a Google authentication code in the form of a voice call or a text message, and then ask you to repeat the number back to them to prove you’re real.

In reality, they’re setting up a Google Voice account in your name, using your phone number, and the “authentication” code is actually the two-step verification code needed to complete the set-up process.

There are a growing number of scammers are rolling out this Google Voice scam — to the point where the FBI was moved to issue a warning about them this week.

Why Google Voice?

The Google Voice service offers virtual phone number that can be used to make domestic and international calls, or send and receive text messages from a browser. That account can be used to launch any number of scams, the FBI said, all without the ability to be traced directly back to the scammer. As well, the code can be used to gain access to, and hijack, Gmail accounts.

The scammers often use the Google Voice number in fraudulent ads on marketplace websites or for other criminal activity, hiding their true identity and leaving the victim looking like the guilty party. Sometimes the scammers are also looking for other information about the target that they can use to access online accounts or open new accounts in the victim’s name.

Although the message Google sends out warns recipients not to share the number with anyone, in at least one case, the scammers disguised the message by having it sent in a foreign language. As Nerd Wallet reported last month, journalist Kelly Rissman of New York, who had listed furniture for sale, got contacted by a scammer. A six-digit code from Google followed quickly, along with something written in Filipino. Had she translated it, she would have seen that it read: “—— is your Google Voice verification code. Don’t share it with anyone else.”

Google Voice verification code. Source: FTC.

Anatomy of a Google Voice Scam

As the Federal Trade Commission (FTC) explained in October, this is how a Google Voice verification code scam typically works:

• A criminal downloads the Google Voice app and links it to a Gmail account.
• They find victims by checking out online marketplaces, looking for people who post things for sale on sites like Craigslist or Facebook Marketplace. They also prey on people who post looking for help finding a lost pet and have been known to run the scam on dating sites.
• They say they’ve been burned in the past by bots and ask the seller/pet owner to accept and text back a code to prove they’re a real person.
• When the victim texts the code back, the scammer can link the Google Voice number to the victim’s authenticated phone.

This is a tough scam to detect, given that targets aren’t asked for personal data or account numbers, and, as Rissman noted, she hadn’t forked over any way to steal her identity or her money.

As of September, the Identity Theft Resource Center (ITRC) reported that the scam is booming: nearly half – 49 percent – of the complaints they received in the prior month were about the Google Voice scam.

How to Avoid the Google Voice Scam

The FBI offered these ways for consumers to protect themselves from falling victims to such gambits:

• Never share a Google verification code of any kind with others.
• Only deal with buyers, sellers and Fluffy-finders in person. If money is to exchange hands, make sure you are using legitimate payment processors.
• Don’t give out your email address to buyers/sellers conducting business via phone.
• Don’t let someone rush you into a sale. If they are pressuring you to respond, they are likely trying to manipulate you into acting without thinking.

Image courtesy of Cory Doctorow. Licensing details.

Password Reset: On-Demand Event: Fortify 2022 with a password-security strategy built for today’s threats. This Threatpost Security Roundtable, built for infosec professionals, centers on enterprise credential management, the new password basics and mitigating post-credential breaches. Join Darren James, with Specops Software and Roger Grimes, defense evangelist at KnowBe4 and Threatpost host Becky Bracken. Register & stream this FREE session today – sponsored by Specops Software.

• Mobile Security
• Web Security