GOOGLE SCAM ALERT!

In August, a scammer posing as “Google” called a Proton team member.

The scammer had a California number and a polished American accent, and he said someone had tried to change the recovery email on our colleague’s Gmail account. An email about it was already in the inbox, and it was real.

The scam actually runs in reverse. The scammer sets up a throwaway Gmail account and uses Google’s own recovery email flow to add the victim’s address to it. Google sends a genuine confirmation code. Mid-call, a genuine “Security alert” arrives too, and only the small print shows it’s a copy of an alert sent to the scammer’s address.

Both emails come from Google’s servers, so every conventional anti-phishing check passes. Reading the fine print gives it away, but that’s hard to do while a “security team” talks you through it.

Our colleague hung up before the caller made the ask, and the scammer withdrew the recovery request straight after.

If “Google” ever calls you:

– Hang up and check your account

– Never read out a code

– If a stranger wants your address as their recovery email, hit “Remove email”

– Check which account an alert is about

Proton won’t call you about account security either.