Twitter user @_thp shared a recent phishing scam that they received; and it’s so fiendishly clever that it’s gone viral. They wrote: "This is the most clever phishing scam I've ever encountered and for a second it almost got me." Now, that is perhaps a bit exagerated, but you have to admit it's something a lot of people will likely fall for,
Here is how this scam works. The victim receives a text asking whether they’ve requested a password reset for their Gmail account - and, if not, to reply with the word ‘STOP’.
Employees who have not received any new-school security awareness training will fall for this social engineering tactic, and will respond with ‘STOP’. Next, they are urged to send the 6 digit numerical code in order to prevent the password being changed.
Of course what is really happening is that the scammer has requested a password change on their account. That request sends a code to the real account owner to verify that they actually want the password changed. And by sending that attacker the code back, you’re enabling the bad guys to complete the password change, and now they have access to the account and all the email.
So what should you do if you get one?
Simple: companies will never ask if you don’t want to do something with your account or to ask you to do something to stop something else happening. And trust your own memory - you didn’t ask for a reset, so you shouldn’t be asked about one. Do not reply to the text (doing so will tell the scammers that they have reached a valid number).
Oh, and ensure you have 2-step verification set up on your Google account.