view from the present

an extended meditation on presence (we also have chickens)

the phish aren't biting today

I got an interesting attempt at phishing just now. It was a text message, modeled on the Google 2FA texts. The first sentence was identical to a Google text: "G-[number] is your Google verification code."

The next two sentences, however, said there was a "login attempt" from "Antwerp, Belgium" (in case you confused it with Antwerp, Japan, I guess) and said "If you did not attempt this login, call us at [number]."

Cool, except Google only ever tells me "Don't share this verification code with anyone." Also, more to the point, I do not have a Google account.

I suspect this works on a lot of people, though, because:

• a lot of people DO have a Google account
• a lot of people don't read the entire text or even open it; they just let the verification code part pop up in the notification and read that, then go on with their day
• that message might be unsettling enough to make some people call the number, instead of realizing that anyone trying to access their account *doesn't* have the verification code and thus can't get in anyway, or that the correct answer here if you're worried is to go change your password again

This is most definitely not the first phishing attempt I've seen this week, but it is the first one I've ever seen that tried to fake me out via text message. And for a split second, I almost believed it - even though I do not even have a Google account anymore.

But, if there's anything I've learned about the summers I spent fishing as a kid, it's this: You can make the bait as sophisticated as you want, but if the fish ain't interested, the fish ain't biting.

--

tip jar
email
home