I do have a question for you first.
I'll get there, sir.
Do you do any background research? Do you know who I am?
Pardon, what did you say there, sir?
I was wondering how much background research you do on the people you call, and if you have any idea who I actually am.
So you know what I'm doing, right, sir?
This is a real phone call.
A scammer called me and tried to trick me into giving him access to my Google account, live in real time.
I recorded the whole thing.
Watch closely, because the moment that you'd have lost everything may not be the one that you think.
Hello?
Hello there, this is Michael Collier, contacting me from Google Support, looking to speak to Jamison Lopp.
Uh, hello, yes.
Hello there, sir. We were just contacting you here today in regards to the Google account in question here.
This would be @gmail.com.
This would be due to the attempted sign-in here today, an attempted phone number change from Toronto, Canada, under our iPhone 15 Pro Max device.
I would have to ask here today, sir, have you had any recent emails about this or any notifications?
No, no, no, this is news.
Okay there, sir, as I do see here, the account has gone ahead and been placed into account recovery mode.
You may have got an email sent over here just confirming about this account recovery case here today.
I do have to ask a couple security questions, as I do see here.
They did go ahead and attempt to change the primary phone number on the account in question to the attempted phone number on file here.
So in the first minute, he's done two things.
He's claimed to be Google, and he's invented an emergency.
Both of those are false.
Google does not call you.
That single fact should end this call, but everything after that point is him betting that I don't know this fact.
I would also confirm here today, sir, that would not be you attempting to do that?
Absolutely not.
Okay, there, sir, I do believe the email should gone ahead and been sent over there, but as the account has gone ahead and been placed into account recovery mode here today, I do have to ask a couple security questions.
In the past seven to 14 days, have you been using a VPN?
What could have possibly been using this Toronto, Canada social IP?
I mean, I use VPNs, but wouldn't be coming out of Toronto.
Does anyone else have access to this account?
What could have possibly been using any online retailers or any online services from the Canadian region?
Or maybe yourself opening up an account recently and writing the same password there or anything like that?
No, definitely not.
Okay, there, sir, as you did go ahead and confirm it here today, I'm just going to add over a note to the account that your account currently does actually use VPNs here, but this will be accessing from industry today, and that was not you in Toronto there.
As the account did go ahead and attempt to change the phone number here today, it did actually go ahead and set the account to the primary number here.
As it did go ahead and set the account into account recovery mode as the user doesn't actually have access to change this here today.
I do have to ask this TA question.
Half of what he's saying here is completely meaningless, and that's on purpose.
Confusion is what makes you compliant.
You stop evaluating what he's saying and you start to simply follow his instructions.
Would it have any relation, have you traveled recently from the Toronto region or access any network possibly or anything like that, sir?
No, definitely not.
All good there, sir.
As the account has gone ahead and been placed into account recovery mode here today, we're looking to confirm the primary cellular device account on the site here.
This would be the phone number.
As this is going to go ahead and confirm this is the primary cellular device here today, every time you do sign in on your laptop or desktop, this will be adding this is the primary to a fade off here today, sir.
As I do see here, this is actually installed in the account, this is over two years ago, this would be in 2024 November there, sir.
As I do see, this is made through the Google online support line, I have gone ahead and said that it's active here.
I do have to ask, is the primary phone number your main phone here today, sir, or would you have any other device you would want to go ahead and set this as your primary here?
No, that's definitely primary.
Okay, there, sir.
As the account has gone ahead and been sent into account recovery mode, there should be a prompt sent over to the mobile device here today.
If you do allow me one second here, I'm going to try and go ahead and access this on my end, but if I can't here today, would it be possible to get a pen and paper and just write this Google case support ID down?
I do believe the email has gone ahead and been sent over here, but if you do have a pen and paper, because this may have to be further to a different representative, if you just go do ahead and provide him this number here,
So, sir, you should get with that case and that account note there. Would it be possible to write this number down here, sir?
Of course, sir. This is going to be 483828.
Now I've got a case number in my own handwriting, which feels official. This is theater. A specific detail read confidently is the oldest trick in the book. And he still doesn't know the thing that he actually needs, which is how my account is being protected.
Yeah, I see that email that just came a few minutes ago
Okay, there, sir. As you've got that email here today, I'm just going to go ahead and access the team here. I'm just going to have to go ahead and use the TA panel. If you do allow me one second. Let me just take one minute here.
Okay, here, sir. As the account recovery here, I do see that you do have a Google Authenticator app set up here. As I do believe this would be breached here today, we would have to confirm the primary cellular device on the account here. As this would be accessing this from your end there, sir. Would it be possible to go over to the Google Authenticator app there?
Uh, let's see. I don't use Google Authenticator.
Okay, here, sir, I do see this has actually been added to the account. You'd say you don't currently have access to any Google Authenticator app or I do have to ask how previously have you actually signed into this account as I do see this is actually set within the account for a while here.
He's asking about my two-factor setup for a reason. A code that you can read over the phone can be stolen over the phone, but a key you have to physically touch cannot be dictated.
Oh, I'm a big YubiKey guy.
What did you say there, sir? So sorry, I couldn't hear that.
I said I'm a big fan of YubiKey. I don't use Google Authenticator.
Okay, there, sir, I do see that you have your own private key here with your own API.
If you do allow me one second here, I do believe this is maybe an access from the YubiKey as on our end, which actually doesn't show that.
Once you do have YubiKey, this would actually be why it's showing the Authenticator app there, sir.
If you do allow me one second here, I can go ahead and confirm that in the Google support ticket.
Okay, there, sir, I'm just contacting the supervisor here today. As you just say, a YubiKey is connected to the account here.
Do you have any access to this YubiKey for Google verification codes? Has anything happened recently to this or anything you have know of, of any difficulties there or no?
I just told him something that isn't in his script and he didn't even blink. He invented a technical sounding explanation on the spot.
You will probably not be able to out-clever this guy by surprising him because he does this all day long.
No, no, everything is normal as far as I'm aware.
Okay, there, sir. As I can go ahead and confirm that here today, I'll just put that in the case ID. I'm so sorry here today. Let's just take a couple seconds here.
Okay, there, sir, I do see here today. This would actually be set through manually here. If you probably do know your way around the Google app here today, sir, if you do want to go to the Gmail mobile app here, this is just going to be adding your phone here today, sir.
Once you do go to the Gmail mobile app, you may see a prompt on your screen just confirming this account recovery here today.
If that currently isn't popping up on your screen, this may be due to the account being set into account recovery mode. But once you are on the Gmail mobile app, sir, do let me know. I can try and go ahead and guide you through this.
Uh, well, I mean, I use the web app. I don't actually use the native mobile app.
Okay, there, sir. This can be added through the web as well. If you do go to the Gmail web app there, sir, and just do go to your top right of your account there.
Okay, pay attention to this next part. This is where these scams tend to either succeed or fail.
Once you are on security settings there, sir, in the top right of your screen, you'll see something saying security and sign in there, sir. Once you do click on security and sign in, you'll see something saying two step verification here.
Once you do click on verification here today, sir. Once you do click on two step verification, just go ahead and make sure that is on currently and is actually set to the account here today.
As this is going to set the account to account recovery, this may actually prompt you to retype in your password as you're already signed into your account.
Maybe it hasn't there, sir. But as your account is already in, may I ask what are you currently seeing your screen?
Yeah, ask me for password and now it shows that I've got backup codes and security key.
Okay, here today, sir, as we're confirming here, we did actually go ahead and send over a temporary password here today due to the account being sent to account recovery mode.
We actually do have to confirm the backup code here today, sir. I did go ahead and send over a temporary password. This should be sent over the email here.
If you just let me know once you got that there. If you do want to go ahead and just click on that should be in the Gmail inbox as the account has gone ahead and been sent into a soft lock here today just to recover this as I do see is actually currently blocking any emails as it was go ahead and sent via Google there.
You did go ahead and probably receive that as it's going to be doing this here today, sir. If you do go back into the security and setting. Did you see that temporary password there, sir?
This email is real. It's actually from Google. He triggered it by attacking my account so that a genuine Google email arrives right on cue and confirms his story for him.
What he's doing here is weaponizing the real infrastructure of Google. It's not a fake website, and there's no red flag on my screen.
I got the email with the temporary password. All good there, sir. If you do go back to the two step verification here today, we would actually have to confirm the backup code for the TA device here.
As we're looking to go ahead and set this as the TA temporary password. This would just be used for your laptop and desktop here today.
You did say you only use via YubiKey. Would there have any relation to using any phone here or do you not use a phone there?
No, I don't use phone for two, I think.
Okay, sir. Just go ahead and confirm that here today. If you do want to go into the backup codes here, sir, this would be via the security and setting there.
Once you do click fire a backup code, this would actually be access to this YubiKey. Once you do have one of those backup codes, it may show you 10 or depending if you're actually using it for the YubiKey sense.
I don't know if it's popping up maybe with a prompt on your screen, but once you do have one of those codes there, sir, this would be one or nine.
If you want to go ahead and refresh those there and just go ahead and regenerate 10 of those codes there, sir.
I want to be honest here because this is the part that matters. If you're a normal person, you're smart, careful, busy, you're already hooked at this point. You've seen real Google emails inside your real account settings.
Nothing looks fake because nothing is fake except for the man on the phone. Don't tell yourself that you would have known. You probably wouldn't have.
All right, done. Once you do go ahead and do that here today, sir, this is going to be using this temporary code here today to go ahead and set over this temporary password and get the account of account recovery mode.
Once you do see one of those backup codes in the first one there, sir, they can go ahead and repeat that out verbally here today.
Let's see. Uh, let's see. Uh, five, nine, nine, three, two, two, seven, nine.
Okay, there, sir. As you did go ahead and confirm that here today, this is just going to go ahead and set the account to account recovery mode.
If you do want to go ahead and click off of that now. As you did go ahead and get this temporary password sent to the Gmail inbox here today, sir.
I can go ahead and set this account into a TA active there. If you do allow me one second here.
As you've gone ahead and confirm that here today, you did say you used the YubiKey.
Is that supposed to be the backup code? As I do see the code provided here today, sir, did actually go ahead and cancel there?
Uh, well, I mean, YubiKey is just my normal 2SA. I think backup is what I would use if I lost the YubiKey.
Yes, there, sir. As this is confirming because the account has been sent into account recovery mode, it may be because you just gone ahead and refresh those codes there, sir.
That has just gone ahead and not worked. If you can just try and go ahead and read out one of the codes below there, sir, as I do see this is currently just blocked there here today.
I already closed out that tab.
I'll get there, sir. If you want me to guide you back to there, I can go ahead and do that now.
This would just be in the top right when you click on manage my Google account.
You see the security and sign in. This would be on two-step verification here today, sir.
Got it.
Okay, there, sir. If you can just go ahead and read out the code below as I do see it maybe because it refreshed there. It just didn't currently work in the system there.
Uh, 77224945.
Okay, there, sir. As you did go ahead and confirm that here today, I can try and go ahead and set this account into the TA account recovery.
As you do currently have access to the TV-YubiKey, you did say nobody has actually tried to attend to sign in and no applications have happened there.
As it does say here, this is actually the wrong backup code, sir. This is just currently not confirming here today.
I don't know that I have restrictions on my account as I'm not the TA supervisor team as I can try and go ahead and further this call here today, sir.
Would it be possible if you try and go ahead and refresh that again? I'm so sorry as these codes aren't currently going through.
I do have to ask. Are you currently reading out the backup codes there, sir?
Yeah, that's what it looks like.
Okay, sir, do you allow me one second here? This may just be on my end that is currently not working.
What he is after here is quite simple. A working key to my account. If a real target reads a real code here, he's going to type it in on his end and finish the takeover while you're still on the phone.
For the record, everything that I read to him was complete garbage that I made up. He never got a thing.
But you should not plan on outsmarting these attackers. Don't try this at home. I'm a professional.
The real move here is to refuse. Full stop. Hang up. Don't talk to them. Nothing good can come of continuing this conversation.
No legitimate company will ever ask you to read a code, a backup code, or a password over the telephone.
The request itself is the attack.
Okay, here today, sir, as we're going to be using this temporary password to the TA account here today, you can actually go ahead and set this within yourself here.
As this prompt is not working to the TA device here, sir. This would actually be sent for the temporary password. You did say you received that right there, sir?
Yep.
Okay, if you currently received that here, this would actually be swapping that Google password here today. I'm so sorry. This is done via the manual way as these prompts currently aren't showing on your screen.
This may be due to the account currently being in account recovery mode. As if you did go ahead and set this temporary password, as the temporary password here today, this would be lasting up for 24 hours here.
As the account has gone ahead and been sent to account recovery mode, this would just be the TA password used for that 24 hour time period. After the 24 hour time period is that we do advise obviously swapping this password there, sir.
If you do go into the Google account there, sir, and you see something saying password, this would be below two step verification there, sir.
Yep.
Once you do have that temporary password, I do advise if you want to go ahead and copy paste that or maybe write it down and go ahead and swap that here today. As this is going to be using this temporary TA password on the account for the 24 hour time period. If you do want to go ahead and add that there, sir.
This would be, I do see the password in question as it is currently not available to us. This would be sent by email to you there, sir.
If you're ever unsure, hang up, look up the company's number yourself and call them directly. Never read a code or a password out loud to anyone for any reason, no matter how trustworthy they sound. No real company will ask you for any of this sensitive information.
This problem is exactly why we built verification codes into Casa. If someone claims to be a Casa advisor, you can challenge them and you should ask for their verification code, which you can then check in your Casa app.
The app will show you a match or a failure. And this results from a cryptographic verification of this code. If the verification succeeds, then you can be sure that the person on the other end of that phone call has privileged access to Casa's internal systems and you can be sure that they are in fact a verified employee.
Got it. I do have a question for you first. I'll get there, sir.
Do you do any background research? Do you know who I am?
What did you say there, sir?
I was wondering how much background research you do on the people you call and if you have any idea who I actually am.
So you know what I'm doing, right, sir?
I am the chief security officer of a cyber security company.
Yep, we know. You're pretty rich.
So you do know who I am and you think you're going to be able to trick me with this stuff?
You never know. Do you know someone called Malone Lamb?
No, it doesn't ring a bell.
Well, I tried my best. I was putting on American voice. Did it sound good at least? Like a gay American sort of dude?
I believed it.
Okay, yeah. But no, bro. Oh, wow. What a shame. How did you not fall for it?
But also, there's so many of you guys, you guys are calling me every fucking day. And I guess, I guess none of you coordinate with each other. And you don't know that like, I had the same conversation yesterday with a different guy.
So clearly, I know automatically whenever I receive a phone call from one of these spoofed Google numbers that it's not actually Google.
I'm well aware of my own security practices and the fact that people are constantly trying to attack me and hack into various accounts.
And I also know that Google doesn't care about me enough to actually make a phone call to me.
They just don't have the manpower to do that. And it's not part of any major company's regular security practices.
None of them have the ability to scale up their own human employees to meet that level of resource requirements.
If they're going to actually have humans calling their clients, you know, if you have hundreds of millions or billions of clients,
then dealing with this type of issue cannot be done manually. It has to be in an automated fashion.
Yeah, it's just like there's a, I work for like a call center sort of thing, but there's a big boss who just hands out all the things.
I don't know if you get the P1 calls.
Ah, okay.
All I know is that this site is intensifying a lot over the past few weeks.
All good. Well, I'm so sorry that I had to do this to you as always. I hope you have a great rest of your evening.
I don't know if you're watching the World Cup, but England's doing good. Come on.
I think USA are playing Belgium. I don't know if you're much of a soccer football fan, but it's a good thing to watch.
But you have a great rest of your day.
You guys are my full time sport. So I'll have fun continuing to talk to you guys and see what your latest tactics are.
Oh, all good. Well, you have a great rest of your day. I've got to go back to calling other people, but have a good one.
Yeah, worst of luck to you.
Everything that you just watched was scripted, rehearsed and professional.
It failed because of who he happened to call. Today, it's a Google account.
But the same playbook is coming for all kinds of other accounts, whether it's your bank accounts, your Bitcoin exchange accounts, your self custody wallets.
They're going to come for anything of value that they can try to take from you.
So be careful out there. Stay skeptical. Stay frosty.
Two days later, he called me back.