These messages are dangerous
getty
Republished on September 28 as new Google Messages upgrade leaks.
America’s smartphone users are under attack from a plague of malicious texts designed to steal your passwords, your money, even your identity. Forget TikTok — this is China’s most dangerous technical export, powered by the country’s organized criminal gangs.
A new warning from Bitdefender is for Google account holders, whose logins “unlock an array of services, including Gmail, YouTube, Drive, Photos.” But beware — Google will never message to say “you won something because Google is celebrating today.”
The “danger” is that these so-called Google Day scams “lead directly to stolen personal information, drained bank accounts or full-blown account takeovers.” If you receive any Google texts touting “Google Day,” delete them all right away.
Bitdefender says the Google messages scams have included “fake prize schemes branded as ‘Google Day’ or ‘Google Anniversary’ celebrations have circulated online, tempting victims with promises of rewards for being a ‘lucky searcher’ or ‘long-time user’.”
All these messages include a malicious link to a website that will lure you into giving away information or payment details. “Understanding how ‘Google Day’ scams work, why they succeed, and how to defend against them is crucial for staying safe online.”
Google is just one of the names impersonated for such scams. Parcel delivery texts mimic USPS, FedEx or UPS, unpaid toll and DMV fines mimic real or imagined state agencies, refund scams mimic Amazon, lost password scams mimic Apple or Gmail.
Bitdefender warns that “a compromised Google account often means losing access to Gmail, YouTube, Drive, Photos, and other linked services. That kind of takeover can derail a person’s livelihood.” It’s easily avoided. Make sure you don’t fall victim.
They key advice here is that the entire premise behind these messages is fake. “There’s no such thing as official ‘Google Day’ giveaways or sweepstakes. If you realize that, you’ve already won most of the battle.” That’s why you can delete all such texts.
Specific lures may vary. But none of it is real. “Claims you have won a prize because it’s ‘customer appreciation’ day or an occasion to celebrate an ‘anniversary’ or the ‘5-billionth search’” are as ridiculous and spurious as they sound.
Is this text real?
Bitdefender
If you are lured into that click, you could even see two-factor authentication stolen via session cookies (the browser authentication codes that keep you signed in), as well as the user name and password you enter into a fake login page. That’s why it’s so critical to add a passkey to your Google Account. it cannot be intercepted, stolen or shared.
Guardio warns “you can recognize a fake text message by its sense of urgency, unfamiliar sender, and suspicious links designed to trick you.” Their team provides a guide on how to spot a fake text message here. Google Day fits right in.
The FBI’s advice is to delete all scam texts immediately — do not leave them on your phone, even though links are often blocked within a few hours.
Scam text messages usually include malicious links, and where those are more than a simple link to a fake sign-in page, how the content displays is critical — this is the lure.
On that, pre-release Google Messages code suggests a major change is coming. As spotted by Android Authority, “Google devs appear to be considering implementing some changes to how Messages displays link previews. Previews could drop the full URL, and might start omitting page descriptions.”
When scams push rich content — such as fake Google marketing campaigns or charity scams, previewing the click-through content is more critical.
“Are you the sort of user who scrutinizes the URL” the website asks, “looking for any info that may help clarify what sort of content awaits on the other end? Do you just blindly click through without thinking twice?”
Google’s recent Android update promises its AI will now “recognize dangerous crypto and financial scams, toll road scams, gift card scams and more to help keep you safe. This now moves beyond package delivery and job seeking scams to include “a wider variety of sophisticated scams.” We await to see if this includes Google Day scams.
Bitdefender tells users that “even though Google Day scams come unexpectedly (they do tend to intensify around Google’s anniversary), that doesn’t mean you shouldn’t be prepared for unwanted guests.” You should tighten the defenses on your phone.
That means passkeys, strong and unique passwords, a non-SMS form of two-factor authentication (2FA) and ensuring your smartphone OS is updated. If you have concerns, you can run a Security Checkup from your Google Account home page.
