Beware the New Breed of Phishing Scams: When the “Hackers” Sound Legit

Imagine getting a phone call from someone sounding familiar, claiming to be from Google. They tell you your account is compromised, and to prove it, they email you from a Google-verified address like forms-receipts-noreply@google.com. The link they send is hosted on a legit-looking Google Sites page, something like https://sites.google.com/view/pendingtickets. You’re told to reset your password – quietly, while they stay on the line. Seems real, right?

That’s exactly what happened to an Executive at Meta this past weekend, and it’s a textbook example of how phishing attacks are evolving.

What Made This Scam So Convincing?

1. The Caller Spoofed Legitimacy: They called from a local number (818-538-7922), sounding professional and knowledgeable.
2. The Email Looked Real: It came from an official-looking Google address. These addresses can be spoofed or sometimes legitimately used by scammers abusing Google’s tools like Forms or Sites.
3. The Link Was on a Google Domain: A legitimate google.com domain adds a false sense of security.
4. They Didn’t Ask for the Password: Instead, they guided the user to “securely” enter it—creating the illusion that no information was shared aloud or insecurely.

This type of attack blends social engineering with technical trickery—making it one of the most dangerous forms of phishing out there.

How to Protect Yourself from Sophisticated Phishing Scams

Here are 7 steps you can take to protect yourself, even from scams that appear completely legit:

1. Never Trust Unsolicited Calls About Account Security

Google, Apple, banks, and most legitimate companies will not call you out of the blue to fix a security issue, especially not in real time.

2. Check the “From” Email, but Don’t Rely on It Alone

Even if an email comes from a trusted address, look for red flags:

• Unexpected requests
• Links asking you to “verify” your account
• Password reset prompts you didn’t initiate

3. Don’t Click Links in Unexpected Emails – Even Google Ones

If you’re ever in doubt, open a new browser window and go directly to the company’s official website. Never follow links or attachments you weren’t expecting.

4. Don’t Make Changes While on the Phone

Legitimate security teams will not ask you to change your password while you’re on the line. This tactic is used to pressure and confuse you.

5. Be Skeptical of Google Forms and Google Sites

Scammers can use legitimate tools like Google Sites, Forms, or Docs to host malicious content. Just because it’s hosted on a Google domain doesn’t mean it’s trustworthy.

6. Enable Two-Factor Authentication (2FA)

This adds an extra layer of security—even if someone gets your password, they won’t be able to access your account without your 2FA code.

7. Report the Scam

You can report phishing attempts to Google directly at https://support.google.com/mail/contact/abuse. Also block the phone number and alert others.

Final Thoughts

Scammers are getting more creative and convincing by the day. Trust your instincts: if something feels off, slow down. No legitimate company will rush or pressure you into changing security settings without proper verification.

Stay vigilant and share this with someone you care about. The more we talk about these scams, the harder it is for scammers to succeed.