I got a call Saturday evening that showed up as Google. An automated voice asked me to press one to confirm I was Rohan. A follow-up call came from someone on Google’s security team, investigating a breach on my account. They told me to check the Google support portal, where I’d see a ticket raised in my name.
I checked. There was nothing there.
They didn’t miss a beat. No problem, they said, we’re already on it. Then a notification arrived saying someone had tried to log into my account and added a new recovery email. All I needed to do now was verify my login by sharing a code.
That’s when I stopped. You should never share a verification code with anyone.
I’d fallen for a version of this years ago with a Craigslist scammer, and I wasn’t doing it twice. I hung up.
What struck me was how sophisticated this was. The caller ID said Google. The email looked like it came from Google. None of the usual tells were there.
A friend told me recently that he doesn’t pick up calls from numbers she doesn’t recognize, period. I think I’m going to be adopting that policy too.
And the one rule that’s worth repeating: never share an authentication code with anyone, no matter how official the request sounds or how convincing the person on the other end is.

