I feel Google, Facebook, etc. all need to setup actual phone numbers and chat rooms, and make them rank highly on searches for "Google support phone number", "Google fraud department", "Google account recovery department", "Google Live Support Chat" etc.

Then those numbers should simply play a message that this is the only official phone number, and no human will ever call from or answer this number, and the company does not offer customer support or appeals to account problems.

They also need to make searching for fraud phone numbers return anti-fraud messaging rather than what it currently does. Seems like the entire 844-906 exchange is fraudulent [1].

I had a family member that just got scammed because they panicked after their Facebook account got banned, basically exactly like [2].

[1] https://www.google.com/search?q=844-906

[2] https://www.npr.org/sections/alltechconsidered/2017/01/31/51...

In case you would like a concrete example to ground the cynicism about corporate trade offs around customer support, I recommend watching Jill Bearup's 10 minute video [0] about this week's demonetization. For example, she has to deal with some form that she "can't submit", a customer service contact 12 time zones away (so email replies are 12 hours delayed), and an account manager who is non-responsive. In her court, are some unaffiliated google employees giving guidance, but only because they were already part of her youtube watching audience.

[0] https://www.youtube.com/watch?v=6RZHajVV9PA

I had Google call me once :) It was when I was riding in a Waymo and one of the screens in the vehicle was lagging a little bit. They made the surprising choice of calling my phone, rather than ringing the car itself, and I didn't pick up because... who picks up when your phone says, "Call from Google" :) They called the car shortly afterward to reassure me that the lagging screen wasn't an indicator that the car would underperform.

Being guaranteed to be able to talk to a human would be great, but I just don't see how it can possibly scale to over 1 billion users that aren't paying like gmail has.

Years ago, my brother used to work for XBox Live Tech Support, and he said that easily over half the calls he got were for things that customers could easily self-service, like a password reset. Many tech issues were fixed by the most basic troubleshooting step: Power cycling.

Meanwhile, my uncle works XFinity tech support, and he'll frequently get calls when a website has an outage, not to mention how many non-technical people think any internet-related issue, such as a forgotten Google password, means calling your ISP.

This doesn't even begin to talk about bad actors calling tech support to try to break into someone else's account. Google accounts are high-value targets. Once you've gotten in, there's a really good chance you could easily pivot to all of that person's other accounts.

To handle the call volume that a service like Google would have, if they offered phone tech support, the amount of staff they would need would be in the hundreds of thousands, and so many of the calls they take would be wastes of time. There are a lot of non-technical people that have no idea how things work and basically think that Google IS the Internet.

I had a weird security alert on my Google account the other night after trying to do a "Sign in with Google" to a service I've used for years. Trying to view my account/security info kept redirecting me to a page instructing me on how to clear cookies.

I clicked support and was able to get a call right away. But I pay $20/year for Google One.

Somehow Google and other tech companies are not required to have a customer service that actually solves the legitimate problems customers have with their services. I wonder how they are allowed to do this not just in the US but across the world.

They will reach put to try and help sell you more ad spend. If that was a scam its very good cause they set up my adwords campaign for me.

> It’s slightly depressing that there are probably more fake Google support staff than real ones.

I've never thought of it that way but you're right! Dealing with support at most tech companies is a horrible experience and is usually something I research before using a product where a failure in service provision could lead to catastrophic results.

If it weren't for the routine ex-Googler postmortem blog post shared on HN I'd think Google doesn't even have human employees.

The greatest mystery of my life is what is a "Google Product Expert" on their community forums whom I assume:

1. isn't an employee speaking as the company.

2. is someone given the title by the company.

3. spends a lot of time answering questions despite not being paid for it.

4. can contact Google employees somehow.

The only perks for this that Google lists is that you can join a secret club of Google Product Experts. It feels like gig economy applied to customer support.

Unless their salespeople are calling you

I had a legit call come from Google Maps and I called them a scammer and various other names.

> There’s an easier tell. It’s impossible because you can’t to get Google to help you at all about any account issues, ...

Paying Google apps / GSuite users can call a number and it's real humans answering (and they're very helpful).

But indeed I don't think they proactively call you.

I got one of the same calls (didn't believe them). Afterwards I phoned Google support and they said the same thing, they will never call you. I had them confirm nothing was wrong with my account, just in case.

So it's very possible to phone Google support, just don't believe anyone who calls you.

Right? "Google support" calling is an obvious tell.

Depends heavily on the company. Fidelity, for example, has super friendly, local sounding support employees. They will sometimes call you directly, too, for things like "checking in on your retirement goals". If someone called sounding professional, it would not be a tell that it isn't actually fidelity.

Plus, most of the weird "customer support" scams I've gotten in the past are people with thick accents on a garbage connection.

I've gotten real support calls where the audio was so bad it was hard to understand anything they said. And/Or the standby music fidelity was so awful it's like pounding a spike in my ears. (Or maybe that's intentional so I hang up and don't bother with them.)

You'd think they'd have equipment newer than the 1960's.

Yeah, hah, it is funny that "Google offering phone support" is so unthinkable to me that it's a red flag for a scam.

Sounds as urgent as legit :)

Frankfurt is actually notorious in Germany for their issues with drugs. Going outta the train station you can see ppl passed out with literal needles in their arms, taking a shit in public view etc

Doesn't really transfer to cyber crime, but it's definitely one of the more "criminal" places in Germany. Still super tame compared to actual slums etc though

Hmm. I remember using a code like this with google, too. Seems like they had something similar in the past.

that sounds tedious af and still prone to error, i'd rather literally pay someone to handle all of this for me, let's say, some kind of institution which specializes in storing and handling money

It’s great for laundering money.

Non centralized proof of ownership is pretty cool.

>I think mid-term to long-term people simply buy a Bitcoin ETF or stocks from a company holding shitloads of Bitcoins like MicroStrategy. Just like I buy SLV (paper silver) or the ZKB silver ETF (physical replication, in vaults in Switzerland).

But what's the inherent value of BTC if it doesn't do the things it claims? What value does Michael Saylor owning a bunch of bitcoin, of which I have a pretend share, even have?

This is the paradox of Bitcoin. It's a really cool technology that's really hard for normies to use.

I partially agree, although I can see more companies offering these kinds of services in the future. Block already has a system with Bitkey, custody companies like Casa and Unchained are providing services as signers, and AnchorWatch is stepping in as both a custody and insurance provider at the institutional level. Despite the government's best efforts to limit participation from existing banks[1], other services are jumping through the arduous hoops of regulation to fill in the void.

[1] https://www.swanbitcoin.com/politics/biden-s-sab121-veto-sta...

I feel that crypto offers a different risk profile than say the gold ETF. There certainly is significant risk and expense to storing and securing the physical gold backing the ETF. I think it also needed to be audited as matching expected reserves occasionally?

But crypto has similar it and physical security costs at a minimum, though physical storage will be cheaper. Auditing maybe similar costs, I’m not quite sure how you confirm ownership of an address or pile of BTC without transactions?

The big risk is that these big holding companies of bitcoin become targets of state-scale cybercrime hacking armies. Can you imagine an adversary deploying constant attack on every facet of you IT infrastructure, from accessing the private keys presumably stored in hot wallets to support active trading to the interface where they may try interfere with client functions to all sorts of ends from theft to market manipulation.

> Just like I buy SLV (paper silver) or the ZKB silver ETF (physical replication, in vaults in Switzerland)

I'd suggest that holding precious metals without actually having physical metal under your exclusive control is essentially as flawed as holding crypto without exclusively holding the private key.

Xmr aims to be a digital cash, and basically achieves that. Btc has goals more akin to digital gold, hence being more useful to speculators than people buying things is somewhat intentional.

I don't know who the oligarchs you're talking about are. Buterin? Bankman Fried? In either case, their position is quite different from that of a banking titan.

"foreign device" based on IP geolocation is pretty tricky and annoying.

My home in Texas had an IP address which a lot of databases had as supposedly being in Montreal. It was like that for years. Gotta love so many sites trying to default to French.

How would a code help? The victim has already bought into the social engineering. If the person on the phone asks the user to read out a code, they will. If the person on the phone asks them to enter a code (i.e. the version of this kind of prompt where the user needs to enter a code on the phone matching the one showing on the login page), they will.

Yup. If you DON'T have this feature, you're depending on every user who has TOTP 2FA to actually save their backup codes somewhere they can retrieve ~years later or back up their TOTP some other way manually. Naturally, most users will fail to do this, so you'll have to deal with how to securely reset the accounts of people whose phones got lost or destroyed.

But then if you DO have it, you have to deal with the situation in this story, where if you can compromise their one key account, you get all of their TOTP codes too.

Same with me, I had setup MFA using Google Auth for an important account I use.

Next day the phone broke, and I lost that account forever. I had not written the backup codes down anywhere.

Generating and storing your passwords, OTPs, and passkeys in a fully E2EE system like 1Password is effectively a root of trust, although you also have to trust (a) the password manager company, (b) whatever third-party systems and devices they use to build and deliver their software, (c) the quality of their cryptosystem, and (d) whatever device you use to decrypt/access secrets in your vault.

Some cryptocurrency hardware wallets such as Trezor's are usable exactly how you want: they support fido2/webauthn and derive their keys from the recovery seed phrase. You can write down the recovery seed phrase, initialize other hardware wallets with the same recovery seed later on, and they will present to a computer as the same fido2/webauthn token.

> It's possible that I did this without realising

IIRC on my platform, when they added the feature they turned it on by default, as an auto-installed update.

And if you're logged into the gmail app on the same device that also logs you into authenticator.

You didn't do anything wrong.

> does anyone know of a way to revert authenticator to local-only?

To answer my own question: tap the profile pic (top right on Android) and choose the Use Without an Account option. Removes codes from cloud storage and any _other_ devices. Mentioned in TFA.

You can't revert, they keys are sent, they have them. They can't un have them. You'll need to rotate your MFA.

Better option is to not use Google's TOTP app. Use something else

The trick with Authy is to disable multi-device access unless you're in the process of adding another device, so hackers and scammers can't add their own devices to your account without your aid. If you leave the setting enabled, someone may get your TOTP secrets from Authy before you can stop them.

You can just decode the QR code and use whatever secret is in there to generate the OTP codes. TOTP isn't that complicated, it's really just a second password that the system generates.

Google rolled out that hare-brained "improvement" in an update to Google Authenticator a few months ago, with the nice extra that for some users, when you dared unselecting the new cloud backup checkbox, the secrets stored in the app were instantly corrupted in some way, so you were locked out of your Google accounts immediately as a bonus <chef's kiss>. Happened to a family member, luckily they had a working emergency access method. We will never use Google Authenticator again.

Recommended alternative: 2FAS (https://play.google.com/store/apps/details?id=com.twofasapp) which allows you to import the secrets from Google Authenticator via QR codes, and has a local backup feature (e.g. to a USB drive).

They added this recently, because lots of people complained to Google that they lose their tokens; Authy and others started to gain traction because they did synchronization. Google was pretty much forced.

I know, 2FA loses the entire point when it's synchronized. But, well. People lose their stuff all the time!

The active ingredient in 2FA as practically implemented for nearly everyone has never been the 2. It's mostly just not letting humans choose their entire password.

It's because everybody wants to put everything in 2FA protocols, because people just can't use passwords...

And the fact that one of those doesn't lead to the other passes way over their heads.

Most people wouldn't realise they can't recover their TOTP codes. But the hacker would still need to know your password surely

"You can't undo a transaction" is a core feature of crypto. This is hilarious, because in actual payment networks, it literally only benefits scammers.

Every consumer ever has at one point or another wanted or needed to reverse a transaction. Chargebacks are a FEATURE of credit cards.

> they will do their best to either recover your money or return you whole.

And if they don't, the courts can force them to do it and give you some extra money for the trouble.

No they won't. If you bank transfer money to a scammer, the bank won't refund you, nor can they recover it. If you give a scammer your bank access credentials, they also won't refund you because you broke the TOS.

How do they identify their marks? A random firefighter seems like an odd target.

I think you’re saying the same thing from the other side: it’s definitely true that it’s harder to get or transfer large amounts of real money because the system has layers of protection due to past fraud, but those fraud protections also mean that most people can’t get the kind of paper profits which lure people to cryptocurrencies. This gives scammers the appealing target of a self-selected group of financially unsophisticated people who have chosen a system designed to make large scale theft easy and safe.

> Calling back the possibly spoofed number

Don't call back the number possibly being spoofed (i.e. using your Caller ID as the source of the callback number). Call an independently-listed number for the company, such as the phone number on the back of a credit or debit card. Using an independent number prevents any failures where the Caller ID correctly reports an attacker-controlled but plausible-sounding number.

For extra paranoia and safety, perform the callback from a separate phone line. That would avoid at least some of the more-targeted attacks involving a compromise of the victim's phone connection, which could potentially allow the attacker to redirect outgoing calls.

> The main difference is that the first call wanted me to give them information, while the second call advised only "go into a bank branch in person."

Unfortunately physical branches are expensive to maintain, so a lot of banks have been closing them down. There are even plenty of banks with zero physical branches now. All contact is via phone or email, so there is no scam-proof way for them to contact you.

How were they able to use an ATM without having your card?

I recommend not calling back the incoming number even if you think it's real and spoofed, always look it up on the bank's website.

Here's a thing that is enraging, though: when a bank has SMS 2FA (insecure if you're being targeted but better than nothing) and they keep having you enter that into third-party websites. I mean going to a legitimate business, making a purchase with a credit card, and then the bank wants 2FA to validate a purchase instead of a login? Fuck off, I'll use a different card, then.

If it weren't for bullshit FICO calculations I would drop that account entirely.

There was a comment on Hacker News, which alas I can no longer locate, where a guy said he'd been called by his bank and the bank wanted him to answer various security questions. He said he was happy to do so, but firstly needed the bank to verify who they were, or to call the bank back on a telephone number on their website. The bank refused, so he refused to give them any details. The bank then blocked his bank account, meaning he couldn't pay his university tuition on time, meaning his student visa was no longer valid as he was no longer "studying", meaning he had to leave the country.

This.

Also healthcare providers, though they seem to have finally wised up. They would call me from poorly configured phone systems (so unrecognizable caller id) and the first thing they would ask is to confirm full name and date of birth.

Patterns like this do a great deal of damage in desensitizing folks and making them accept dangerous patterns that get exploited by scams.

I have had my telephone company ask me to give them a code sent to my device. It is presumably to prove to the company that the representative is talking to me so that bad actors low in the company cannot start randomly messing with people’s accounts. It is the equivalent of the bad click here. The only real defense is to know the difference between a mechanism meant to authorize someone a the company and a mechanism to authorize you. Confuse the latter for the former like the victim did here and bad things will happen.

Banks maybe, but Google? Google only has "AI" support and that doesn't call us yet. So it's safe to assume that any call from Google is fake.

A ss7 attack could make your carrier part of the scam without their knowledge, such that calling back the number will connect you to the scammer and not the bank.

Maybe but this shit is hard for institutions too. There are so many sharp edges.

Even in a well-respected fintech with responsible, talented people I’ve seen: safe deposit boxes get lost (literally no idea where in the world they actually are), go missing (the bank relocates or closes and disposes of them without notification) or become destroyed (fire, flood). I have seen industrial-grade hardware security modules spontaneously corrupt all the internal keys, happily continuing to produce “encrypted” output which can never be decrypted.

Building crypto offerings at scale that can survive the myriad unknown unknowns of real world and hardware failures that can affect both paper and hardware wallets is a really difficult problem. Not impossible, but the stakes are extreme and getting one thing wrong that leads to the loss of a cold wallet can easily lead to total ruin.

Even if “only” a hot wallet gets popped, the instantaneous and irrevocable loss of those funds needs to be offset by a comparatively large amount of operating profit.

At least with the traditional banking system there are a lot of safeguards in place.

Yes they do. If you subscribe to Google One.

https://support.google.com/googleone/

I'd assume there's some model for finding those kinds of photos

> Then people would prefer links that didn't look like gobbledygook

Well, I can say with relative confidence that people prefer those links but _marketers_ prefer hxxps://awsmail.me/b64trustmebro/8675309== that leads who fucking knows where

You mean besides literally all the times when people upload raw copyrighted movies and music to YouTube? DMCA is boring and un-newsworthy when it's working properly. (Unless you're the type who thinks copyright is inherently wrong, but it would then be very silly to ask if DMCA was ever "used in a manner".)

I wonder how that would work if they cannot prove my identity first by telling the representative a code sent to my phone number. I would expect the bank to tell the attacker to go into the local branch with identification.

They don’t even support businesses. We pay for whatever the highest tier of support is.

We have been emailing our TAM (or whatever Google calls them) for weeks (and opening tickets)

They keep giving us the same fucking documentation link.

Literally useless.

Another instance we were using code from their docs and they refused to help saying they don’t look at code ever

Unfortunately, when a person is getting support from a large corporation it's completely routine and normal for the follow-up e-mail to have random extra branding like "zendesk" or "atlassian" or "salesforce"

It's a clever move by the scammers - I can see how people would fall for it.

Yeah I got a similar call once from someone, maybe a credit card company, and the first question was "to verify your identity we need the last four digits of your social security number" and I was like wait a minute, you called me. What are the last four digits of YOUR social security number?

100% - yes - if you follow simple rules