> So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.

I am not clear how the account access occurred. What code did he read? He voluntarily read his own 2FA code from his Authenticator?

Seems likely to be an SMS code, Google will use a phone for recovery if you claim to have no other access.

This person read an SMS code — one that explicitly says not to give it to anyone — and then they said "I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes! And yet, I got phished."

This person's greatest mistake was answering the phone to a stranger. Who knows what hell can be unleashed on one's emotions nowadays with AI. One cannot expect to be rational in a lion's den.

They are royally fucking up their PSA by throwing Google under the bus rather than telling people to avoid answering their phone to scammers. I suspect this PSA will help approximately no one because of that. Not getting your voice captured (for AI synthesis) is, by itself, a great reason not to answer random calls like this.