New Spoofing Technique To Attack Gmail Accounts

There are over 2.5 billion Gmail accounts in the world, presenting an attractive opportunity for scammers. Now, scammers are employing a tactic named “super realistic AI scam call,” which can deceive even tech-savvy users.

The founder of CloudJoy and security expert Sam Mitrovic recently fell victim to one such scam. He received an email that looked like an approval notification for his Gmail account recovery, followed by a phone call with caller ID “Google Sydney.”

One week after the incident, Mitrovic received another recovery notification and a similar phone call from a legitimate phone number listed on Google’s support page. The caller claimed that an unknown person accessed Mitrovic’s Gmail from overseas and downloaded his personal data linked to the account. Mitrovic also received an email from Google Domain confirming the issue.

Sam Mitrovic suspected it was a scam and confirmed it was a spoofing attempt with online forums like Reddit. This scam employed a legitimate-sounding AI voice bot, a phone number similar to Google Workshop support, and a Google Domain email generated from Salesforce CRM. These things can convince most users to believe it’s genuine communication from Google and to hand over their Gmail credentials to criminals.  

To stay safe from such scams, users must be aware that Google rarely contacts individuals by phone and mostly prefers emails. If someone receives such calls, it’s good to verify the number using platforms like Truecaller. Regularly monitoring Gmail activities and enabling two-factor authentication (2FA) can also boost security.