Gmail user accounts are being exposed to increasing scams aimed at seizing passwords and personal data through phishing text messages and emails.
This scam usually begins with a text message that appears to come from “Gmail by Google,” alerting users of a threat that their accounts have been hacked.
The message includes a link suggesting “Recover account,” and when clicked, the victim is asked to write his “Gmail” password, so the scammers can steal it immediately.
In some cases, scammers combine stolen information with other personal details such as phone numbers, then exploit social engineering techniques to convince carriers to transfer the number to a SIM card they control. This allows them to access two-factor authentication codes received via text messages (which are “temporary short codes sent to your registered phone number when you try to log in to your account”).
Victims have confirmed that these messages appear to be highly credible, and often allude to previous “login attempts” from foreign “IP addresses.” Although this raises suspicions, it is often part of a scam.
When the user enters his account information, fraudsters are able to access Gmail accounts. If the same password is used on other sites, these other accounts are also at risk.
