The Day I Got a Call From “Google”
Scammers are getting more sophisticated by the day.
The call came at an inconvenient time, as I suppose they always will.
It was a perfect fall day. The weather was just temperate enough for it to be genuinely enticing to spend time outside, and just chilly enough that you knew in your bones you wouldn’t enjoy that same feeling again for many months. I was in Paris with one of my best college friends, a busy professional with a young child, enjoying a rare afternoon on which we could just walk around a beautiful city and debate the world. We were in the Marais, one of the most touristy neighborhoods—though my friend had brought me there to show me the conversion of a brutalist office tower he admired rather than to drink at one of the many wine bars—when my phone rang: “Google,” the display read.
My first instinct was to ignore the call. But I had never before received a call from Google. And then I remembered that I had gotten a strange request to approve a sign-in attempt via the YouTube app a little earlier in the day. I had assumed that this notification was one of those poor attempts at phishing you sometimes get, and wasn’t overly concerned about it. But the apparent coincidence made me think that I had better take the call.
The man on the other end of the line was very professional. In unaccented American English, he identified himself as part of the Google Safety Team. He started by checking my identity: “Are you Yascha [middle name] Mounk?” I confirmed that I am. “Do you reside at [address]”? I confirmed that I do. “Are the last four digits of your social security number [XXXX]?”1 I confirmed that they are.
“About half an hour ago, someone contacted Google with a copy of your driver’s license and other identifying details to regain access to an account you had supposedly been locked out of. We are calling you as a courtesy to ensure that this was you?” I explained that it had, in fact, not been me.
The caller proceeded to explain that he had feared this would be the case. The number and sophistication of phishing attempts had gone up significantly of late, he said. The attackers had managed to associate their Gmail address—he slowly spelled out a strange string of characters: besuvsjhcbc@gmail.com—with my account. As a result, the scammer currently had full access to all of my emails. Time was of the essence.
“Of course,” I said. “Can you lock them out of my account immediately, please?”
He could, the caller explained, but I’d first need to confirm the request to do so on one of my devices.
From the beginning of the conversation, three instincts competed in me.
The first instinct was suspicion. I knew that phishing calls were getting more sophisticated. I sensed that some things about this phone call were strange, that some details—ones I couldn’t quite put my finger on right in that moment—didn’t quite seem to add up.
The second instinct was fear. If someone had access to my email account, they might also be able to gain access to my bank account and to all kinds of other pieces of identifying information that would create additional problems down the line. And while I knew not to trust the man who was patiently talking me through the process of locking these would-be intruders out of my account, I did remark that he was remarkably calm and professional. Perhaps this was a genuine call after all?
Want to hear me in conversation with leading thinkers of our time? To catch up on recent episodes of The Good Fight with the likes of Francis Fukuyama and Steven Pinker—and avoid missing out on even more exciting ones we have in the works—sign up for ad-free access to full episodes by becoming a paying subscriber today!
And to listen on your favorite third-party app, click “Set up podcast” below!
The third instinct was a sense of social obligation. I was speaking to somebody who was either a sociopathic scammer whose business consisted in preying on gullible people—or to a friendly professional trying to help protect me against said scammers. Somehow, when faced with this kind of uncertainty, a reluctance to be rude takes over. I found myself embarrassed to be doubting the man on the other end of the line, and speaking to him politely even as I suspected him of being a sociopath.
Unsure what to do, I motioned to my friend and put the call on speaker. After he had listened in for thirty seconds, I hit the mute button: “What do you think?” I asked. “Is this legit?”
He looked as lost as I was. “It could be a scammer,” he said. I nodded. “But he sounds so professional,” he added. I nodded again.
“So what should I do?”
My friend shrugged.
“How do I know that you are actually calling from Google?” I asked the friendly man on the other end of the line.
“I can generate a message from our system,” the caller offered. “Feel free to check the message: it should come from noreply@google.com.”
A few seconds later, the promised email arrived in my inbox. Its format and design looked legit. It really did come from noreply@google.com. But a part of my brain was telling me that something was weird about it; the language in the email was about adding a recovery email, not about unlinking an account.2
“Is there some way I can call you back at an official Google number?” I asked the caller.
“For security reasons our team doesn’t accept incoming calls,” the man on the phone said. “But feel free to look up the phone number I’m calling you from. You’ll see that it is listed online as the number for Google Support.”
I decided I needed to get off the phone to have a moment to think. “I can’t check the number while I’m on the phone. The display only reads Google,” I said. (Oddly, this was true.) “Could you call me back in a few minutes?”
The caller took this with impressive equanimity. “Of course,” he said in a friendly tone. “I’m glad you’re taking the security of your accounts so seriously. Just remember: Time is of the essence. I’ll call you back shortly.”
I looked up the number: 877-355-5787. A quick search confirmed that it is legitimate: the first link took me to a Google Support page which listed those exact digits.
“Is it possible to simulate that you’re calling from some phone number when you actually aren’t?” I asked my friend.
He wasn’t sure. Neither was I.
“Can you look up which devices are connected to your Gmail account right now?” he suggested.
I tried. Without my laptop to hand, everything was a little slow. I logged into my Google account on my mobile browser, looked for the security settings, and finally found a list of active connections. A few were hard to interpret: older connections, probably from devices I hadn’t used in months or years. But there didn’t seem to be any recent connections from strange devices or locations. The adrenaline slowly started to seep out of my body.
I decided to ask ChatGPT for advice. The number in the display, I learned, really is associated with Google. But “phone number spoofing is unfortunately quite common, even with legitimate-looking numbers.”
ChatGPT also suggested an additional way to check whether the call was legit. It told me to go to support.google.com and see whether there was an active support ticket. I did. To my relief, I couldn’t find one.
The phone rang again. I was now 99% sure that the caller on the other end of the line was a scammer, but somehow still unable to overcome the compunction to be polite.
“I checked the active connections on my account and there doesn’t seem to be anything unusual there,” I said. He gave some vague explanation, the gist of which I no longer remember, that didn’t make much sense.
“Also, my understanding is that there should be a case number in my Google account, but there doesn’t seem to be one,” I told him.
The line went dead. The scammer had given up. A wave of relief washed over me. Then I felt a deep sense of shame: “I nearly fell for it,” I thought.
Instead of heading out to dinner immediately, I retrieved my laptop, and did some of the things I should have done long ago: Sever inactive connections to my account. Activate two-factor authentication on important accounts that didn’t yet have it enabled. Upgrade my security settings.
In retrospect, I realize that I didn’t act as much of a fool as I had felt in the moment. The scammer really had been remarkably professional. He really had struck a perfect balance between refraining from pressuring me in too obvious a manner and impressing the supposed urgency of the moment upon me. And yet, I had not given out any information that helped him steal my money. My account was safe.
But the experience has certainly made me less quick to judge those who do fall for similar scams. A couple of years ago, a personal finance writer for New York Magazine published a viral story about handing a shoebox containing $50,000 to a scammer. The jokes wrote themselves: How could someone who made a living from giving people financial advice be so stupid?
I too had a good chuckle at her idiocy at the time. Today, I find it much easier to see how a smart and knowledgeable person could fall into a well-laid trap.
There but for the grace of God go I—and you.
I assume that the scammers were able to get these details from a data breach.
In retrospect, it’s obvious how they did this. The scammers had created an account with the name besuvsjhcbc@gmail.com. Then they simply asked Google to use my email address as a recovery account for their account. This generated a genuine request from Google, cleverly timed to seem as though it could only have been sent by somebody working for the company.
Good job handling that. The irony is that Google doesn't call people—that type of personal attention is only going to come from phishers.
Yascha, I got the same exact call a week ago from "Google" 2 weeks ago and from "Coinbase" last week. Since I work in Cybersecurity, I knew it was a scam from the first second but I played along until I got him to send me a link he wanted me to click. I copied the link and pasted it into a secure virtual sandbox. You can use Joe Sandbox or ANY.RUN. it redirected me to a look-alike copy of Google's and Coinbase's websites under newly registered domains. I then emailed the abuse department at the registrar of each of these domains, provided a recording from the sandboxz along with the phishing email and the domains were suspended within 24 hours.