Ask HN: Phishing from 646-257-4500

8 points by latchkey 19 days ago | 2 comments

Yesterday, I got a call from 646-257-4500.

American western male voice. Very polite. They actually called me 3 times. The first two, I just hung up.

They were claiming they received a request from the google support portal for a change of phone number on my account and wanted me to verify my account.

They sent me an email which looks very much like it came from Google… even in the headers! I don't see anything intrinsically wrong in it.

Subject: Re: You are now on the phone with a verified Google Agent, your Case ID is: XXXXX. Please ask your Agent to confirm this over the phone.

  ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@google.com header.s=20251104 header.b=XXXX;
       spf=pass (google.com: domain of XXXX.XXXX.XXX@cases-outbound-prod.bounces.google.com designates 209.85.220.75 as permitted sender) smtp.mailfrom=XXX.XXX.XXX@cases-outbound-prod.bounces.google.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com;
       dara=pass header.i=@gmail.com
  Received: from mail-sor-f75.google.com (mail-sor-f75.google.com. [209.85.220.75])
        by mx.google.com with SMTPS id XXXX-XXXX.10.2026.06.11.14.42.06
        for <XXXX@gmail.com>
        (Google Transport Security);
        Thu, 11 Jun 2026 14:42:06 -0700 (PDT)

They hung up immediately when they realized that I wasn’t going to read them that code.

Searches for the number confirm I'm not the only one.

I guess my question is how they could send that email!?

Why isn't google filtering this out through their system?

joshstrange 16 days ago |

I get these calls all the time. For me the number (most recently) has been 650-203-0000 and it identifies itself as Google.

Once I answered by accident and decided to see how the scam worked. The guy told me that someone called in trying to reset my password but it was from Russian so they “blocked” it, he was going to “add some notes to my file” to make sure it didn’t happen again, while he did that he tried to make small talk and joke around but I just kept waiting for the other shoe to drop. He sent me an email with a link to my “support ticket”. Which was hosted on sites.google.com. It showed a list of support tickets (just the 1) and when I clicked on it a phishing login form opened. I could see it was hosted (iframe) on some random server and submitting the form called a telegram webhook send the form contents as a message to a group.

I told the guy “this is a scam” (something I knew from the start) and he hemmed and hawed about how “it’s Google.com! It can’t be a scam” before I hung up.

I get 0-5 calls a day from someone telling me my Google account is compromised or similar. It ebbs and flows and has been going on for about a month now. Thank god for iOS call screening.

Lastly, I knew it was a scam because:

A. They called me

B. They called multiple times

Google just doesn’t give enough of a shit to do any of that.

Pyrodogg 18 days ago |

Probably abuse of some product like Google Forms or another service.

Different subdomain, but same issue https://www.suped.com/learn/dmarc/how-to-deal-with-spam-from...