Scammers Make Google Deliver Their Fake Invoices for Them
Scammers put fake invoices and phone numbers in the name of a Google app password, so Google's own signed security alert carries the lure past spam filters.
Scammers have found a way to get Google itself to deliver their fake invoices. According to a Hokanews report that credits a warning from Coin Bureau, they type invoice text and a phone number into the name of a Google app password, which makes Google send a real security notification that repeats their words. The email is genuine, signed by Google and passes the usual checks, so spam filters and wary readers both wave it through. The aim is to get you to call the number.
For defenders
How it works: the attacker creates an app password on a Google account they control and puts the lure in its name field: a fake charge and a “support” number. Google’s automatic security alert quotes that name back. The scammer then gets that authentic alert in front of the victim. Hokanews says the victim’s own account is never touched.
Example: Hokanews cites a University of Michigan warning about an alert carrying a fake $399 McAfee invoice and a number to call to “dispute” it. On the phone, a fake support agent takes over: remote-access tools, gift cards or a “refund” that empties a bank account are the usual endings of this callback phishing pattern.
Why it’s hard to catch: SPF, DKIM and DMARC all pass, because Google really sent it. The buttons go to real Google pages, which show nothing wrong. Filters keyed on sender reputation won’t help; the tell is a phone number or invoice language inside a Google security notification. Google hasn’t commented, per the report.
What it means for you
A real Google email can still carry a scammer’s words. Google security alerts never include invoices, refund offers or phone numbers to call. If one does, that text was written by a criminal, and the person who answers that number is part of the scam.
Do this now
- Never call a phone number that appears in a security alert or invoice email. Look up the company’s number on its own website instead.
- To check your Google account, type myaccount.google.com into your browser yourself and look under Security for recent activity.
- If you already called, don’t install anything they asked for, call your bank, and change your passwords from a different device.