Scam Warning Involving Your Phone

[Drakkith]

Beware, all. I almost fell for a scam today. Well, to be fair, I fell for it but quickly realized what happened and managed to fix it before anything bad happened.

I posted a Craigslist ad for some random odds and ends that I was giving away, with my phone number for the contact info. A few hours later I received a text message from someone saying they were interested in my ad. They said that they wanted to make sure the ad was real and not fake, so they were sending me a 'verification code'. This should have been a red flag already, but I was in the midst of something so I just gave them the code (received in a separate text).

Then they asked for another code, which I gave again. After the 2nd code something clicked and I said to myself, "Hmm... wait a second...".
After actually reading the text messages with the codes, I realized that the messages were from Google Voice. That's when I stopped what I was doing and started doing some research on this. I quickly came across this kind of scam, where someone will send you a verification code to 'verify your ad is real' and then use that code to make a google voice account with your phone number (presumably for nefarious purposes).

Soon after I started researching this, I also received a message from Verizon (my carrier) with a verification code. I shudder to think what they could have done if they had gotten access to my Verizon account.

Luckily all I had to do at this point was to create my own Google Voice account and connect my phone number to it, since connecting your number automatically removes it from any other account it was linked to (like the scam account).

Long story short, I managed to catch this scam before it did any real harm to me. I'm not sure what kind of damage could have been done had I not quickly caught on to the scam, but I suspect it wouldn't have been fun to fix. Or cheap.

Be safe out there folks!

 

[jedishrfu]

Wow! Thanks @Drakkith that's some scam.



https://abc11.com/new-scam-tries-to-use-your-phone-number-to-fleece-others/5416459/
Three common Craigslist scams:



I've heard of others related to Craigs List with respect to selling cars.

https://www.businessinsider.com/car-scams-craigslist-2019-4#curbstoning-2
Auto Wrap Scam

 

[Drakkith]

Update: A friend of mine told me that the verification code was for a Google account, not just a Google Voice account, and that through there they might have access to financial information. He recommended I change my password to that as well.

I'm pretty sure I don't have any financial information attached to my Google account, but I've changed my password to both Google and Verizon just in case.

 

[jedishrfu]

Never hurts to change all your passwords as you never know what they may find and how they will come at you again.

Years ago at GE, a corporate auditor who had worked at our computer center as a production operator (ie setup and submitted scheduled jobs for clients) used his knowledge of accounts and passwords to access our customer service user acct. On it, was a file of all passwords used on the site. It was a reference for when a GE customer would call and say they forgot their password. This was circa 1976 before the idea of never showing passwords but instead, select a new one that was subsequently hashed and stored.

The auditor found this unprotected file, reported it and got a lot of kudos from the audit team for finding a security breach and our customer service folks who worked hard got egg on their faces. All because at that time we didn't have or follow any recommended security practices as things were just too new. To be fair the auditor used insider knowledge to break in but that's now a thing to watch.

GE auditors would usually go on to become corporate-level managers of whole GE divisions after having traveled around to many GE sites doing their audit work. Basically, they gave up their life for a few years to reap the benefits of becoming a corporate manager in high esteem.

 

[Wrichik Basu]

As a rule of thumb, never share any such verification code with someone whom you do not know personally.

 

[Drakkith]

As a rule of thumb, never share any such verification code with someone whom you do not know personally.

Or anyone really. Unless there's a very, very good reason they need it.

 

[nuuskur]

That verification jazz is suspicious from the get go. I'd be like how does one verify whether my ad is real or not based on some code. If they're interested in the merchandise, no code will verify whether I actually have the goods.

Good job catching on to that. Haven't run into that kind of scam, but I've been offered "once in a lifetime" investment opportunities at least twice a month.