Gmail Users Beware: New AI-Driven Scam Steals Personal Data

A new scam has emerged, specifically targeting Gmail users with the intent of stealing personal data through cleverly designed fake account recovery requests. IT consultant and tech blogger Sam Mitrovic recently shared his experience with this Gmail scam, emphasizing how easily unsuspecting users can fall prey to this AI-driven fraud.

How the Gmail Scam Works

The scam kicks off with an unexpected notification sent to your email or phone, prompting you to approve a Gmail account recovery request that you never initiated. In Mitrovic’s case, this notification originated from a different country—specifically, the United States. When he declined the request, the scammers escalated their efforts approximately 40 minutes later with a phone call from what appeared to be an official Google number.

This phone call is the pivotal moment in the scam. The caller adopts a professional, polite, and American-sounding voice, and informs the target of supposed suspicious activity on their Gmail account. They may inquire whether the user has logged in from a foreign country, creating a sense of urgency and alarm that makes it easier for them to manipulate the victim into believing their story. The caller ID often displays what seems to be a legitimate Google office number, further adding to the façade of authenticity.

Once the scammer has captured the user’s attention, they claim that someone has accessed the account and downloaded sensitive information. To solidify their deception, they follow up with an email that looks like it’s from Google but is, in fact, a spoofed message designed to appear legitimate. The end goal is to persuade the victim into approving the account recovery request, granting the scammers full access to their Gmail account.

Protecting Yourself Against the Scam

Mitrovic stresses the importance of vigilance in thwarting this type of scam. Here are essential steps Gmail users can take to protect themselves:

1. Do Not Approve Unfamiliar Recovery Requests: If you receive a recovery notification unexpectedly, do not approve it. This is a primary indicator that your account may be under attack.
2. Verify Phone Calls Claiming to Be from Google: Google rarely calls users directly unless they are involved with Google Business services. If you receive a suspicious call, hang up and verify the phone number before continuing the conversation.
3. Check Email Addresses Carefully: Spoofed emails may closely resemble legitimate messages from Google. Look for small details in the “To” field or the domain name that could indicate a fake email.
4. Review Recent Security Activity: Regularly audit your Gmail account’s security settings. You can check for unfamiliar logins by visiting the “Security” tab in your account settings.
5. Inspect Email Headers: For those who are more tech-savvy, examining the original email headers can reveal whether an email was sent from a legitimate Google server.

By following these precautionary measures and remaining alert, Gmail users can shield themselves from this increasing AI-based scam. The overarching message is to exercise caution and double-check any unusual activity on your account.

Real-Life Impact: Someone Got Tricked

While investigating further, Mitrovic discovered a comment on Reddit from another user who reported a similar experience with a suspicious email. This raises concern, as it’s possible that individuals who genuinely believed they were interacting with Google could have fallen victim to this scam.

Upon reflection, Mitrovic recapped his own experience with the scam call:

1. The caller seemed legitimate, displaying courteous and professional behavior with an impressively realistic American AI voice.
2. The phone number matched what appeared to be a legitimate Google office.
3. The email correspondence also looked authentic.

However, several red flags indicated this was an account takeover attempt:

1. He received account recovery notifications that he had not initiated.
2. Google does not typically call Gmail users who do not have a Google Business Profile connected.
3. The email contained a “To” address that was not associated with a Google domain.
4. There were no active sessions on his Google account other than his own.
5. Email headers revealed that the message had been spoofed.
6. A reverse phone number search indicated that others had received the same scam call.

Despite the numerous warning signs, the call’s professional presentation made it plausible enough to deceive many individuals. Mitrovic speculated that the conversion rate from answered calls might be relatively high.

While there are various tools available to combat these scams, the most effective defense remains individual vigilance. It is crucial to perform basic checks and seek assistance from trusted friends or family when in doubt. By staying informed and proactive, Gmail users can significantly reduce the likelihood of falling victim to these scams, safeguarding their personal data and online presence.