3 ms·

You're right, seems they already had his inbox credentials.

• cpncrunch 1y ago
  No, it sounds like they got him to create backup codes, which (along with SMS 2FA code, which he also gave them), that is all they need to take over the gmail account. Job done.
  • deleted 1y ago
    [deleted]