5 ms·

I know this is not 100% specific to this article, but this is happening right now to a friend of mine's gmail account. Scammer was able to social engineer the

I know this is not 100% specific to this article, but this is happening right now to a friend of mine's gmail account. Scammer was able to social engineer the cell phone company to forward his number, then did a password reset, and locked him out of his account. 20BTC Ransom. He followed every single google customer service link/resource he could find and tried to reset link, which said they would contact him in 3-5 days. This was 6 days ago. No response. FBI can't do anything either. Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? Imagine in the future trusting google with a self driving car and home automation -- imagine getting locked out of your house or hijacked in a self driving car and having nobody to call. If anybody here knows somebody at google who can reach the group that handles Gmail security, please contact this account so I can give you his info.

o87dv 11y ago
Hopefully the next step is going to be switching from Google to a different provider.
- eru 11y ago
  Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.
  - ikeboy 11y ago
    Think I read that Google Auth falls back to SMS, so that wouldn't help.
    - y4mi 11y ago
      you can freely choose between enabled authentication methods. so, its possible to disable the sms authentication by removing it in the security settings
- roflchoppa 11y ago
  Yeah thats one way to address the issue (or even using multiple emails), but you know what's even better than that? Having competent customer support, that would be able to address situations like this. Esp. with the amount of people that are using these home automation services with "cloud" support, its only going to get worse the more integrated these services become. My friend has had a similar situation with the good ol Yahoo eMail service, and after being on call waiting for 4hours, they told him they cannot help him, then hung up. I also had a similar service, with my STEAM account, I emailed Valve, and within 45 min the account was restored.
  - fallat 11y ago
    What are more companies like Valve? Seriously...
  - Liru 11y ago
    Wait, you actually had Valve do customer support? I think that's rarer than getting Google customer support, to be honest.
  - grogenaut 11y ago
    Lol, I was 1/2 way through this email thinking I'd respond that the only one worse is valve... turnabout. I've never had them respond to me. I've got several tickets multi months outstanding.
    - thret 11y ago
      It is possible they queue their client service based on how much money each client has spent. It is what I would do if I did not have time to get to everyone cost effectively.
      - rjbwork 11y ago
        Yep. I've spent ~1k dollars on steam and i've gotten games refunded within days, even though they dont have to according to their TOS.
- chrisper 11y ago
  Do you know any good alternative? I was thinking about self hosting and just use google as a relay.
  - superuser2 11y ago
    fastmail.fm is where people disillusioned with GMail traditionally go.
    - feld 11y ago
      can't say enough good things about fastmail
    - rtpg 11y ago
      Have you heard any story similar to what's happening with OP where fastmail support ended up resolving the issue quickly and in a timely manner? I'm not trying to imply that it would be the same, genuinely curious if I can expect better by switching.
      - johnpowell 11y ago
        I haven't had my account hijacked before with fastmail. But I have had to contact support and I was in touch with a real person in less than 30 minutes.
      - superuser2 11y ago
        Not that I'm aware of. I think there's an element of "grass is always greener on the other side." When the NSA thing first came out, people were publicly talking about leaving for GMail for Fastmail, since Google showed up in the XKeyscore docs, just as people felt superior about their Androids when the Apple Foxconn scandal broken. But in all likelihood they suffer from many of the same problems; Fastmail (and the various Android manufacturers) are just smaller and don't attract the same negative attention.
      - DrJokepu 11y ago
        I have dealt with Fastmail support in the past, although it was regarding invoicing questions, not identity fraud. My experiences were fairly positive.
nadams 11y ago
I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of mine's gmail account I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. > Scammer was able to social engineer the cell phone company to forward his number If they are in the US please tell us the name of the provider so we know not to ever use them. This isn't the first this kind of attack has happened [1] (shame on you DigitalOcean). I use Gandi and they state in their documentation that they will not reset it if you ask them [2]. > Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It's a free service - what do you expect? I've heard this story many many times. Yes - google makes billions in profits and could in theory hire someone to handle gmail issues. But, they don't and it makes sense from a business point of view (why spend money on a guy who will support a service that doesn't make money?). > It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? If a Fortune 500 company uses gmail they would buy the google apps for work. If they buy google apps for work they get an 800 number to call if they have problems (and most likely a dedicated account rep because they are probably buying 1000s of accounts). > Imagine in the future trusting google with a self driving car and home automation Again - you would be giving money to google. And in return you will get support. I'm not saying Google is perfect but if self driving cars become a thing I'm sure (hope) there will be an 800 number you can call when your car becomes sentient. [1] - https://news.ycombinator.com/item?id=9596258 https://news.ycombinator.com/item?id=9596258 [2] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...
- sorrythrowaway9 11y ago
  The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.
bakhy 11y ago
i never activated google's 2factor authentication just out of fear of my phone being stolen. this ugly possibility never even occurred to me. i really cannot understand why this stupid sms-based scheme is pushed down our throats by google. fingers crossed for your friend, i hope it works out!

o87dv 11y ago

Hopefully the next step is going to be switching from Google to a different provider.

eru 11y ago
Use the cryptography based 2FA (with Google Authenticator on your phone). SMS is too open to social engineering, and as a second factor might actually make your account less safe.
- ikeboy 11y ago
  Think I read that Google Auth falls back to SMS, so that wouldn't help.
  - y4mi 11y ago
    you can freely choose between enabled authentication methods. so, its possible to disable the sms authentication by removing it in the security settings
roflchoppa 11y ago
Yeah thats one way to address the issue (or even using multiple emails), but you know what's even better than that? Having competent customer support, that would be able to address situations like this. Esp. with the amount of people that are using these home automation services with "cloud" support, its only going to get worse the more integrated these services become. My friend has had a similar situation with the good ol Yahoo eMail service, and after being on call waiting for 4hours, they told him they cannot help him, then hung up. I also had a similar service, with my STEAM account, I emailed Valve, and within 45 min the account was restored.
- fallat 11y ago
  What are more companies like Valve? Seriously...
- Liru 11y ago
  Wait, you actually had Valve do customer support? I think that's rarer than getting Google customer support, to be honest.
- grogenaut 11y ago
  Lol, I was 1/2 way through this email thinking I'd respond that the only one worse is valve... turnabout. I've never had them respond to me. I've got several tickets multi months outstanding.
  - thret 11y ago
    It is possible they queue their client service based on how much money each client has spent. It is what I would do if I did not have time to get to everyone cost effectively.
    - rjbwork 11y ago
      Yep. I've spent ~1k dollars on steam and i've gotten games refunded within days, even though they dont have to according to their TOS.
chrisper 11y ago
Do you know any good alternative? I was thinking about self hosting and just use google as a relay.
- superuser2 11y ago
  fastmail.fm is where people disillusioned with GMail traditionally go.
  - feld 11y ago
    can't say enough good things about fastmail
  - rtpg 11y ago
    Have you heard any story similar to what's happening with OP where fastmail support ended up resolving the issue quickly and in a timely manner? I'm not trying to imply that it would be the same, genuinely curious if I can expect better by switching.
    - johnpowell 11y ago
      I haven't had my account hijacked before with fastmail. But I have had to contact support and I was in touch with a real person in less than 30 minutes.
    - superuser2 11y ago
      Not that I'm aware of. I think there's an element of "grass is always greener on the other side." When the NSA thing first came out, people were publicly talking about leaving for GMail for Fastmail, since Google showed up in the XKeyscore docs, just as people felt superior about their Androids when the Apple Foxconn scandal broken. But in all likelihood they suffer from many of the same problems; Fastmail (and the various Android manufacturers) are just smaller and don't attract the same negative attention.
    - DrJokepu 11y ago
      I have dealt with Fastmail support in the past, although it was regarding invoicing questions, not identity fraud. My experiences were fairly positive.

nadams 11y ago

I'm sorry if this sounds like me being a jerk - that's not my goal. I just want to point out cold hard facts. > but this is happening right now to a friend of mine's gmail account I can't stress this enough but please enable OTP on your accounts. Facebook, gmail, and even your Windows system if you are paranoid enough. Yeah it adds some hassle - but the value of increased security far outweighs the hassle. Also backup the OTP codes somewhere. > Scammer was able to social engineer the cell phone company to forward his number If they are in the US please tell us the name of the provider so we know not to ever use them. This isn't the first this kind of attack has happened [1] (shame on you DigitalOcean). I use Gandi and they state in their documentation that they will not reset it if you ask them [2]. > Its so disturbing that there is absolute nothing you can do to reach Google once this happens. It's a free service - what do you expect? I've heard this story many many times. Yes - google makes billions in profits and could in theory hire someone to handle gmail issues. But, they don't and it makes sense from a business point of view (why spend money on a guy who will support a service that doesn't make money?). > It could happen on anyone's cell phone as well, how many fortune 500 companies have higher up employees with cell phones and gmail accounts? If a Fortune 500 company uses gmail they would buy the google apps for work. If they buy google apps for work they get an 800 number to call if they have problems (and most likely a dedicated account rep because they are probably buying 1000s of accounts). > Imagine in the future trusting google with a self driving car and home automation Again - you would be giving money to google. And in return you will get support. I'm not saying Google is perfect but if self driving cars become a thing I'm sure (hope) there will be an 800 number you can call when your car becomes sentient. [1] - https://news.ycombinator.com/item?id=9596258 https://news.ycombinator.com/item?id=9596258 [2] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...

sorrythrowaway9 11y ago
The cellphone provider was sprint. My friend is a paid customer of Google Apps. In part of the process he called called Google Apps, and they immediately disabled his Apps account but -- but they couldn't or wouldn't do anything else including helping him escalate to the right people -- They said they did not know who to contact. Eventually after he called back several times, he got a manager/supervisor who was able to create a ticket. He called back the next day and the ticket was deleted! Meanwhile the scammer is making threats to his family and pretending to be him send out emergency BTC loan requests and resetting bank passwords. He could be SWAT'd at any moment. Apparently Google executives are in the mindset that it isn't cost effective for them to provide even the most minimalist crisis support -- a trivial 5 minute look at the account and seeing the ransom artist texting him (through his own gmail) would at least justify an account hold. Google couldn't be bothered-- even at a record 66 billion dollar profit to help him. Why? Because they can't make a profit helping him. Or maybe its that and they are still in the 2003 "beta" mindset. It truly is a real life THX 1138 nightmare for him.

bakhy 11y ago

i never activated google's 2factor authentication just out of fear of my phone being stolen. this ugly possibility never even occurred to me. i really cannot understand why this stupid sms-based scheme is pushed down our throats by google. fingers crossed for your friend, i hope it works out!