What is the Google Voice Scam?
Google Voice is an online phone service that allows someone to make or receive calls from a web browser. These accounts are popular, and make it easy to communicate with anyone in the world at any time.
However, Google Voice accounts require verification with an active American phone number, which sets up a roadblock for scammers overseas looking to use the app inconspicuously in the commission of fraud. To get around this problem, threat actors started targeting people with legitimate phone numbers in the United States with the activation prompts to activate a Google Voice account. When successful, this exploit gives a threat actor use of the app under a concealed identity.
Here’s how it works:
Scammers respond to ads for products or services online.
Often they will express interest in purchasing an item for sale posted on Facebook Marketplace or Craigslist. Before they commit, they hesitate. They may claim their wariness to proceed is based on a bad experience. The bottom line: They won’t go through with the transaction without first confirming that the listing is legitimate, and that the seller is a real person. They may say things like ‘I’ve heard of fake listings online’ or, ironically, ‘I need to make sure this isn’t a scam before buying the item’, priming the seller for step 2.
This is when the scammer asks to validate the seller’s identity by sending a 6-digit verification code to their phone, promising to proceed with the sale once the seller shares the correct code they received. Behind the scenes, the scammer is prompting this code directly from Google Voice, waiting to input the code into the app and activate a Google Voice number linked to the victim’s authenticated phone.
What’s the motive?
With access to a legitimate Google Voice number, the criminal can pursue a range of malicious activities. They may opt to post fake ads themselves, ripping others off to collect funds. At greater detriment to the victim, they may be able to use the existing account to get a foothold on more critical digital credentials and accounts. Most likely, the phone number will be used as a burner in the commission of an online crime.
What do I do if I’ve been scammed?
The danger of Google Voice scams is twofold: a victim’s personal information has been compromised, and if the scammer’s criminal activity targeting others is traced back to the phone number attached to the Google Voice account, the victim will be implicated.
If this victim is you, don’t panic. Google Voice has steps on their site to help a victim reclaim their phone number if they have been targeted by the scam, and it’s relatively easy.
Takeaways:
- Google Voice scams are common on resale sites, but they can also occur on dating apps, job application pages, and sites posting lost-pet reports. No matter the context, never share one-time codes with people you don’t know.
- When making transactions online, never share your personal information, and only communicate on the site you are using.
- Don’t let scammer catch-phrases fool you: if someone demands your personal information to prove you’re not a scammer, recognize that you might be speaking to one yourself, and block the suspicious buyer from your messages.
