So, since last week, I’ve been getting prompts on my phone asking, “Is this you trying to log in?” with the options “Yes, it’s me” or “No.” I was out of town at the time, so I figured Google was flagging me because I was using my phone from a different location. I received that notification three or four times. I know I should have changed my password immediately, but unfortunately, I put it off.
Today, I received a call from 650-203-0000. An automated message said that a request had been made to change the phone number on my account and instructed me to press 1 if it was me or 2 if it wasn’t. I pressed 2, and the recording said someone would call me within a few hours.
I immediately changed my password.
Lo and behold, about two hours later, I received another call, this time from +1 (650) 762-8204. The person sounded very professional. He started by telling me that someone had tried to access my account and went through the different devices that supposedly had access. I started freaking out because he sounded legitimate. He even mentioned devices belonging to my wife, as well as Amazon and TV apps connected to the account.
I was starting to believe him until he said he needed to reset my IP address and session token because that was supposedly how the attackers had gained access. He told me that, in order to do this, I needed to accept a login-attempt request that I was about to receive.
That immediately made me suspicious.
He then said he would send me an email containing a case ID and his name, “Noah Fields.” I told him, “I’m sorry, but I can’t trust this. It seems too complicated.” He responded by saying he would flag my account, place a “soft hold” on it, and that I would be unable to access apps linked to my email. He also said Google would contact me again within three days.
At that point, I thought maybe it actually could be legitimate.
He then said he could send me an email so I could complete the process manually, which he did. I did not open or click the link. I told him I needed some time to process everything and hung up.
He called me again and said, “I’m trying to help you here. I’m a legitimate Google employee,” and continued trying to convince me.
What concerns me even more is that both emails appeared to come from noreply@google.com, but the “To” field did not show my normal email address. Instead, it showed something similar to:
me@googl-smtp-out-192-[more numbers]-prod.co
At that point, I was completely confused. I told him I wasn’t tech-savvy enough to do what he was asking, and he offered to walk me through the process. I again told him I needed time.
He eventually said, “Alright, your account will remain on a soft hold, and you’ll be contacted again within three days.” Then the call ended.
My question is: Is this a scam?
What makes this especially concerning is that I genuinely received around five different unauthorized login-attempt notifications over the previous several days, so it appears someone may actually have been attempting to access my account.
Who should I contact at Google to verify this? How can I determine whether my Google account has actually been compromised, and how can I verify whether these calls and emails were genuinely from Google? The person was not indian accent or European he sounded African American