​Scam of a different sort

I report scams all the time in the News. Some dear friends recently reported an email from McAfee about their subscription being renewed for $299.55. They don’t have McAfee of course. There was a phone number to call in case they wanted to cancel.

That’s a pretty standard phishing scheme, and she was suspicious, so that was good. It did look real, and she did delete it.

My sister-in-law called us recently, also suspicious. This time it was from Facebook marketplace, where she was selling a bunkbed. A potential buyer wanted to confirm she was not a scammer by ‘sending’ her a 6 digit number which she was to read over the phone to him.
If you didn’t catch what was happening, that’s a scam. Many companies send a 6 digit verification code when a userid is signing on to a new device. In this case, the scammer had my sister-in-law’s gmail address and was trying to sign on from his device. That would automatically cause Google to send a 6 digit verification code to my sister-in-law’s phone, which is the code required by the scammer.
​
It’s super clever, and insidious. Those 6 digit codes are meant for your eyes only. Since the code was to be expected, it wasn’t suspicious to receive one, so naturally a person would then give it to the scammer, thereby giving Google access to a scammer. Don’t ever do that! It’s common for businesses to require 2 factor authentication. This is the second factor and it is not meant to ever be given away to anyone. 
​
I looked it up and it's slightly different from my description. Same idea though. You can read a government report on it HERE.