Deepfake voice scam targets Gmail users with credential theft attacks
Scammers used AI-generated voice cloning to impersonate Google support staff and attempted to steal a Hack Club founder's Gmail account by spoofing caller ID, creating fake Workspace accounts on Google's g.co domain, and sending fraudulent password reset emails. The attack was thwarted when the target remained suspicious and refused to authorize two-factor authentication.
What happened
Scammers used AI-generated voice cloning to impersonate Google support staff and attempted to steal the Google account of Zach Latta, founder of Hack Club, based in Vermont, USA. The attackers called from a spoofed number (650-203-0000, a genuine Google Assistant number) with a 'Google' caller ID, claiming an unusual login attempt had been detected from Frankfurt.
The scam exploited Google's unverified Workspace account creation process by registering a Workspace using a g.co subdomain, which anyone can create without ownership verification. The attacker then sent a password reset email from the spoofed domain that appeared to originate from Google itself.
Reported impact
Latta nearly fell victim to the attack but remained suspicious after the callers were unable to answer follow-up questions consistently and encouraged him to approve a two-factor authentication prompt without calling back to verify. He prevented account takeover by refusing to authorize the authentication request after detecting the red flags.
Index analysis
The attack combined multiple spoofing techniques: caller ID spoofing using a legitimate Google number, domain spoofing using Google's g.co subdomain, and voice cloning to impersonate Google staff members. The scammers demonstrated knowledge of Google's authentication systems and procedures, enabling them to construct a convincing social engineering attack that bypassed common verification practices.
Governance controls
Google suspended the account that facilitated the scam. The company said it had begun hardening its defenses against the attack vector, though specific remediation measures were not detailed in the report.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.