JNew York City journalist Kelly Rissman had been advertising some furniture online with a simple snack when “Jaree” texted through the OfferUp resale app asking if it was still available.
Jaree asked for Rissman’s phone number, then texted that she would send a code that Rissman could text back to verify that she was a real person.
Eager to get out of underpayments for storing furniture she no longer needed, Rissman agreed. A six-digit code from Google arrived quickly, with something written in Filipino. If she had translated it, Rissman would have discovered that it said, “—— is your Google Voice verification code. Don’t share it with anyone else.”
Rissman sent the numbers back via text message.
How the scam works
Jaree had no interest in furniture. His goal was to get Rissman to disclose his phone number and then a Google Voice verification code.
Here’s how a Google Voice verification code scam typically works:
- A criminal downloads the Google Voice app and links it to a Gmail account.
- Then they find a potential victim, for example in a sellers marketplace. They say they’ve been burned in the past by bots and ask the seller to accept and text back a code to prove they’re a real person.
- When the victim sends the code back via SMS, the scammer can associate the Google Voice number with the victim’s authenticated phone.
- The scammer uses Google Voice number in fraudulent advertisements on marketplace websites or other criminal activity.
In other words, the scammer is a fake buyer first, and then once they trick victims into authenticating Google Voice accounts, the scammer becomes a fake seller – potentially trapping a second generation of victims who pay for goods they never receive.
Rissman grew suspicious and ended the call when Jaree said there had been a problem and asked if Rissman had another number to try.
Although she writes about scams, Rissman says she was duped because it lacked the typical features: she had not been asked for personal details or account numbers, and she had not provided any. way to steal their identity or their money.
Why Google Voice?
Google Voice allows users to merge multiple phone numbers into one. There are many legitimate uses for a Google Voice number. People can give it to their business and personal contacts instead of having to juggle multiple phone numbers. Individuals can keep their cell phone numbers private, and businesses can find an available number with the last four digits they want.
But crooks want a constant supply of new Google Voice numbers to use in criminal activity. Victim complaints and inquiries will initially list the authenticated phone number of the original victim. It takes further investigation to find the Gmail account created by the criminal.
Once Rissman figured out the scam, she unlinked her phone number. Google offers a help page that guides users through claiming the number used with another account.
The scam is not new, but it’s hot
The Google Voice authentication scam is not new, says Eva Velasquez, CEO of the Identity Theft Resource Center. But that represented almost half (49%) of calls received by the center in August, more than nine times the volume received in July. At the beginning of October, the pace did not slow down and there have been over 2,000 calls to the ITRC on this subject since mid-summer.
Business sites like eBay, Facebook Marketplace, and Craigslist aren’t the only ones where criminals look for verification codes. This has been done on dating sites and even in response to reviews of lost animals. The common thread: Someone wants you to prove that you are a real person by receiving and returning a code.
The volume of complaints indicates that criminals have a new cache of Google Voice numbers and it is likely that some will be used in online advertisements in the coming weeks. Additional caution is warranted.
How to stay safe
If you’re a seller, check if the platform you’re on has a feature to verify its users, advises Amy Nofziger, director of victim support for the AARP Fraud Watch Network. If a potential customer asks to verify your identity, insist that they use this feature. If the seller insists on switching from the sales platform to texting or calling, that’s a danger sign.
Do not accept and return a code by SMS. “It’s written on, don’t share this code with anyone,” says Velasquez. “We really want to hit this house for people. These are codes you get to verify yourself. This is a second layer of authentication, and they’re just for you. … And if someone asks you to share it with them, that should be a big red flag.
Buyers should also proceed with caution, says Velasquez. A plug can use a stolen Google Voice number.
- Check as much information as possible about the seller. If the sales platform has a verification function, use it.
- Don’t deal with someone who wants gift card payment – this is a sure sign of a scam.
- Use a credit card if possible; they have protections that peer-to-peer payments and debit cards don’t.
- Go to a safe place to exchange payments and goods.
People who lose money to scammers using Google Voice numbers are unlikely to know their theft was triggered when someone was tricked into revealing a verification code. “I really think there are more victims (of the scam) than we even know they are victims,” Rissman said.
More from NerdWallet
Bev O’Shea writes for NerdWallet. Email: [email protected] Twitter: @BeverlyOShea.
The Scam Alert: “Prove To Me That You Are Human, Not A Bot” article originally appeared on NerdWallet.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.