How to Lose a Fortune with Just One Bad Click

KrebsOnSecurity documents a targeted phone-based phishing campaign in which attackers impersonated Google support—using a legitimate Google phone number and emails sent via Google Forms—to trick victims into approving account-recovery prompts and disclose cryptocurrency seed phrases at phishing sites (e.g., verify-trezor.io). The scams led to large financial losses (hundreds of thousands to millions of dollars), involved automated call-selection bots and coordinated callers, and reused indicators such as the phone number (650-203-0000); the article also details mitigation advice (disable Authenticator cloud sync, use passkeys or hardware security keys, and follow call-back verification procedures).