2 min read

Google Voice Verification Scam

Google Voice Verification Scam

If you hang around Facebook Marketplace, Craigslist, etc., you might run into this phishing scam.

Has anyone ever messaged you that they want to send you a code to verify that you're a real person?

If they do, absolutely do not give them that code!

Here's the setup:

To establish a Google Voice forwarding account, you have to have an actual phone number to base it on. Google verifies this phone number by sending you a private key code. You paste the private key into the Google Voice form which associates your real phone number with the Google Voice phone number.

Essentially someone is trying to set up a fake/burner phone number where it will not trace back to them. The most likely reason for this would be to do more scamming, but I could see it being used for other illegal means as well. Use your imagination.

Here's someone trying to use this method to phish me over an aquarium I was selling on Facebook Marketplace. There's a pun there somewhere...

At first, I was trying to figure out of this was an SMS-based MFA attack or not.
You'll notice the common phishing tactic of false urgency here. Not shown is a Google Voice verification code text message. 

At this point, I realized what was going on so I decided to ask what nefarious purpose my phone number would be used for.

They didn't seem amused

Unfortunately, my new friend decided to stop responding after that. I offered him a guest spot on this post to share his thoughts, but his silence spoke louder than words.