How does it work?

Google Voice is a service that lets you set up a virtual phone number that can be used to make calls and send texts across the world just from a browser. As a result, these can be used by scammers to launch any number of scams without being traced directly.

How are scammers using this?

Scammers are finding other people’s phone numbers via publicly available information like Facebook and other social media and using these as the verification step for Google Voice. This needs your voice to authenticate it. So what scammers are doing is calling the victims and having them read out the text message that gets sent to their mobile number. The scammers presumably have the victim on loudspeaker so that Google Voice can hear them. This authenticates Google Voice.

The text message the recipient receives is legit and from Google. It normally reads something like this: “6584 is your Google Voice verification code. Don’t share it with anyone else”. I think it’s safe to say that if someone asked for the code over the phone, most of us wouldn’t do it. But scammers are sending the text message in foreign languages to throw us off. Meaning we would just see numbers and read them out.

This means that scammers are using other people’s phone numbers to set up their Google Voice numbers. Meaning if the scammers ever get “caught” the phone number they used to register the account is someone else’s. Potentially putting the blame on them.

Scammers then use their fraudulent Google Voice number and put it wherever they need it. Ads for a malicious app, phishing emails in place of a legit phone number, etc.

How do we avoid this scam?

Scams like these are getting ever more complicated and there are always new variations of each scam appearing. Never share any authentication codes with anyone, even if you haven’t requested one. Always be cautious of the information you make publicly available and if you want to change what other people can see you can check the application’s privacy settings.