I received a call the other day from a 1-877 number. I don't usually pick unknown calls, but I was waiting for a callback from the Canadian Revenue Agency and thought it might be them. Guy says he's from Google, and has been monitoring suspicious activity in my account originating from Iran. According to him, someone there was trying to change my recovery email and 2FA phone number.
He then rhymed off my old work email that I used to have as a recovery email (I don't anymore) to sound legit, which he did. He then proceeded to tell me that this has been happening a lot, with all of the activity going on in the Middle East. My Spidey sense was tingling; I was pretty sure Google never called people about being hacked. So I played along.
He then said they could lock my email access to specific devices for 72 hours, in the event I got hacked. I argued, "But I have a strong password and 2FA set up. Why should I worry?"
He then reiterated that this was a service Google provided, and asked if I wanted it. I asked what needed to be done, and he told me to close the Gmail app and restart it on my phone, which was immediately met with the 2FA message, "Someone is trying to access your account from Miami, Florida. Is this you?"
I responded to him, "Hey, is this you? I'm not in Miami. I'm in Toronto!"
He then said it wasn't him, as he was in California. He then told me to close Gmail again and restart. New 2FA message: "Someone is trying to access your account from Toronto, Ontario. Is this you?"
I lied about living in Toronto. I live in a smaller city to the west, and I always get prompted with my correct city name when authenticating. I then said, "I don't know who you are. But I don't think you're Google. If you are, which I doubt, thank you. But if you're a hacker, which I think you are, go Fuck yourself."
He then told me that he completely understood, and I should immediately change my password, which was the only truthful thing he said in the conversation. I did so immediately after I hung up.
I researched afterwards, and my Google account was compromised (I have no idea how) including my old recovery email. They were using a VPN to spoof their location, and trying to get me to hit the "yes, it's me" button to get into my account, and then game over. Thank god for 2FA!!
This guy was smooth, professional, and sounded very legit - no accent, no pauses. At no time did he lose his composure when I challenged him. Hackers are getting very, very sneaky and sophisticated. Be careful out there! If you don't have 2FA setup on your Google account, do it NOW!!