This was so much funnier than I wish it was… ugh. Contacting Google. Good luck.

It’s not (248) 434-5508 ?

I don’t trust anyone calling me who isn’t already in my contacts.

Callers from legitimate businesses treat me like i’m questioning the moon landing when I tell them I’ll need to call them at an official number.

Now try and convince your family to do the same (especially parents who are prime targets).

To be fair I give just about anyone and their dog my CC number. Chargebacks work and my life is that little bit easier for it.

Playing Jason Bourne with your credit card number is not worth the effort if you ask me.

I would even say this is a net positive for the economy: the cost of fraud is outweighed by the lower barrier to payment. I'm sure you'd have made fewer sales had people been more worried about security. Net positive then, right?

“I have the fun of making outbound calls to offer people a public service and collect payment if people desire it.”

Oh so you’re a telemarketer.

In the rare case something worms it's way to collections I just ask for the certified letter. Now in ten years that only happened once. I even called the hospital asking where my bill was and they said I didn't owe anything. Three months later collections!

The great thing about credit cards (as opposed to obvious scams for suckers like cryptocurrency) is that consumers don't have to care about security. They can dispute fraudulent charges and never be out any money.

What happens if you say "yes"?

You don't, but large organizations can have a lot of entry points (or none... but that's a different topic), so you let the caller pick the inbound number that will actually reach them or their department, but then you still independently verify that the number belongs to the organization before trusting it.

Obvious next step to me is malicious bills sent to an address

> It's interesting how easily Google results rankings are manipulated by bad actors, and how unvetted the scams are in paid adverts on and through Google.

Well, SEO, I get that this kind of gaming is hard to prevent, not at Google's scale.

But the AdWords scams? Or all the other fake ad scams, chumboxes and god knows what? The complete lack of audits around something that actually causes money to change hands should be outright banned.

At the high end of ads, think large brand TV spots, you got entire teams of lawyers involved to make sure licensing, actor releases, technical details, corporate identity and a myriad of other things are taken care of.

But at the low end? Some rando from St Petersburg can post an ad for a book "uncovering Western lies about NATO expansion", some Indian can post an ad for "Norton Removal", some American an ad for a f2p game with content that clearly does not describe the actual gameplay or some Chinese can post an ad for penile enlargement pills - and none of the four will get even one human eye on the ad before the campaign goes live and the ads are displayed to actual users, even though all four either violate Western laws outright or are at least banned by the providers/networks.

And the problem isn't just limited to Google, Youtube, AdWords, Unity Ads [1], Taboola [2], Outbrain [3], Facebook/Insta [4] - it's everywhere, the entire low range of ads is infested to the core. Self-service ad platforms should be shut down, period - the industry has shown that "self regulation" doesn't work.

[1] https://discussions.unity.com/t/does-anyone-screen-these-ads...

[2] https://www.vice.com/en/article/taboolas-content-chum-boxes-...

[3] https://www.skeptic.org.uk/2021/01/the-outbrain-drain-why-ne...

[4] https://www.vice.com/en/article/instagram-and-facebook-are-o...

This happened to my father while I was around during the beginning of the COVID lock down. He searched for an Apple support number and was served a targeted ad for a phishing site. Because of the change in search a few years prior, ads now look very much like search results compared to the obvious visual distinction back in the Don't-Be-Evil days. The ad was sufficiently targeted that it only showed up on his device for the search -- nobody else would see it.

Ephemeral ads are not a good thing.

The last I heard, Google relied on spam filters for this.

Supposedly, people have been fired after being falsely accused of harassment. The scam works as follows:

Send a message to bob@gappsdomain.com and notavictim at the same domain. Arrange for the headers to be “from” bob. Now, notavictim reports Bob to HR. If the google admin is competent, they look at the headers, and note that Bob didn’t send the email. (Not sure if they catch the offender or not.)

If they’re incompetent, they see the message in Bob’s from box, and recommend he be fired.

This is a feature that enables dubious workflows, where Bob configures spam bots to bother his coworkers, but wants those messages to be auto filed in his sent box.

I didn’t think it worked when spoofing unrelated domains like Google though. That’s just dumb. Maybe the attacker had the author’s IMAP gateway password and moved the message into the inbox?

I imagine it will be like SIM swapping attacks where attackers will pool all their money together, gain temporary SS7 access and conduct a ton of attacks in a short window of time. Reducing the per-attack cost.

The phone network is just not a secure channel for any sort of communication

https://en.m.wikipedia.org/wiki/Signalling_System_No._7