How To Avoid the Google Voice Verification Code Scam (2022)

Is Someone Asking for Your Google Voice Code? 

An Ohio resident who posted on Facebook looking for their missing cat was relieved to get a response from someone claiming to have found the beloved pet [*]. But that relief quickly turned to confusion when the person demanded “proof” of the cat’s true ownership — in the form of a six-digit Google Voice activation code. 

Stories like this happen over and over again. Scammers bypass your natural suspicions by pretending to be cautious themselves, asking for “verification” from their targets.

But although they claim to be protecting themselves from a scam, it’s just an excuse to request your private information. 

The Identity Theft Resource Center (ITRC) reported a record-breaking 26% increase in identity crimes from 2020 to 2021 [*]. Among those crimes, a staggering 53% involved Google Voice verification code scams [*].

So, why do scammers want your Google Voice verification code? What can they do with it? And what should you do if you’ve given a scammer your code?

{{show-toc}}

What Is Google Voice? Why Do Scammers Want Access to Your Number?

Google Voice is a call app offered by Google. It generates a phone number for you that is linked to your Google account. Once it’s set up, the number can automatically forward text messages and calls to other cell phone numbers that you specify (or even to your Gmail inbox). It can also be used like a regular phone number to make and receive calls — all for free.

Criminals like Google Voice because it gives them a free, mostly untraceable phone number that they can use to scam people.

But here’s the catch: Google Voice is only available in the United States and needs to be linked to an existing U.S. number. Scammers who are based internationally don’t have access to a U.S. number; so to set up Google Voice, they need to find someone who does have a number.

How Does the Google Voice Verification Code Scam Work?

Google Voice scams occur when fraudsters link a Google Voice number to your phone number. All they need is a unique verification code that they get from you. 

This allows scammers to forward all calls and texts made to your phone to a number that they control.  

Here’s how the Google Voice code verification scam works:

• First, scammers visit online marketplaces like Facebook Marketplace, Craigslist, and OfferUp. Other common targets include people looking for help finding a lost pet via social media.
• Scammers contact the number on the listing and express interest. However, they use an excuse to request that the seller send them a Google Voice verification code. For example, they’ll say that they need to “verify” that you’re a real person [*].

• If the seller agrees, the scammer sets up a Google Voice account and links it to the target’s cell phone number (which they got from the listing).
• The Google authentication process prompts the scammer to prove that they own the number by entering a six-digit code sent to the victim’s phone.
• The scammer tricks the victim into sharing the verification code, then uses this to “prove” they have access to the victim’s U.S. number. 
• Once the verification process is complete, they can use the Google Voice number to scam others.

Related: Did You Get Scammed on Facebook Marketplace? Do This →

Google Voice Scams: What Can Someone Do With Your Google Voice Code?

While it’s not ideal to have a stranger use a number that’s connected to your Google account, can it really cause serious harm?

Unfortunately, the answer is yes. 

Here’s what scammers can do once they’ve gained access to a Google Voice account linked to your phone number: 

1. Commit crimes that can be traced back to you

Scammers can exploit Google Voice numbers because they’re nearly untraceable. But  if law enforcement gets involved, Google will hand over all information on the offending account, including your linked number.

How the scam works:

• Scammers link your phone number to their Google Voice number, then use that number to commit crimes like fraud and identity theft. Since it’s on the Google Voice account and not your personal number, it happens without your knowledge.
• Law enforcement or government agencies take action against the account and present a warrant or subpoena to Google.
• Google shares information about the scammer’s account and all linked information, including your phone number.
• Using the linked phone number, law enforcement or government agencies track you down as the suspect for crimes that were committed by the scammer through their Google Voice account.

Related: Can Someone Hack You With Just Your Phone Number? →

2. Scam your friends and family using your phone number 

Scammers know that your friends and family members are more likely to fall for a scam if they think the message is coming from someone they know. Using the Google Voice number linked to your number, scammers can put your closest contacts at risk of losing money, sensitive information, or worse.

How the scam works:

• Scammers pose as you by calling or texting your friends and family members using software that spoofs your phone number.
• From there, they’ll use social engineering to ask your close contacts to send “you” money via cash apps or wire transfers (e.g., to help you out of a desperate situation).
• The scammer will collect all the money or personal information that your contacts send.

💡 Related: The 11 Latest Facebook Scams You Didn't Know About (Until Now) →

3. Open new accounts in your name

Hackers and scammers can use an authentic name and phone number as the launching point for identity theft. With just these pieces of information, they can start to open new accounts in your name and create a false identity without your knowledge.

How the scam works:

• Once scammers have one piece of information about you, they can start looking for more. They can even do a reverse search of your number to find your name and additional personal information.
• Scammers use your name, number, and other data to open new accounts in your name (such as fake social media and email accounts).
• By impersonating you on the internet, scammers also connect you to suspicious online activity without your knowledge.

4. Take over your online accounts using verification codes

A scammer can use the forwarding feature on Google Voice to receive two-factor authentication codes (2FA) meant for you. This can give them easy access to any accounts that are connected to your phone number.

How the scam works:

• Scammers set up text message forwarding to have all texts sent to your personal phone number redirected to the Google Voice number that they control.
• Then, the scammers find email addresses or usernames linked to your personal number on criminal marketplaces, or they look for accounts that let them sign in with just a phone number.
• The scammer tries to sign in to websites — like social media, email, or even bank accounts — using your email address. They click “forgot password” and select the option to verify their identity using a code sent to the phone on the account.
• The verification code is forwarded to the Google Voice account (without your knowledge), and the scammer gains access to your account without needing to enter your password.

Related: How To Protect Yourself From Account Takeover Fraud →

5. Harvest more sensitive information to steal your identity

Once a fraudster has a piece of your identity, there’s no reason for them to stop there. 

With a little work, a scammer can leverage your name and phone number to collect even more information about you. And once they have enough to piece together, they can commit other types of identity theft like falsified loan applications or medical fraud.

How this scam works:

• Scammers use details they already have about you to impersonate you over the phone. For example, a fraudster could spoof your number and call your bank or credit card company posing as you.
• Even if scammers aren’t successful at hacking into your accounts, they can use social engineering tactics to get the operator to share more information, which makes future attacks more successful.
• Scammers can then use this information to steal your identity, or sell it to other criminals on the Dark Web.

💡 Related: Has Your Gmail Been Hacked? Here's How To Secure Your Account →

Did You Give Away a Google Voice Verification Code? Do This!

If you’ve already fallen victim to a Google Voice scam, follow these steps to reverse the damage as soon as possible.

Start by getting your number back:

• Visit the Google Voice website and follow the instructions to set up a Google Voice number. You’ll need to link it to a different phone number that hasn’t been compromised (such as a landline, your office phone, or the number of a trusted friend or family member).
• Once you receive an automated call or text with the six-digit code, visit https://voice.google.com/settings and add a new linked number. 
• If the scammer is still using your number, Google will ask if you want to claim it and unlink it from the scammer's account. If you don’t see this warning, you’ll know the scammer has moved on.
• Once you’ve reclaimed your original number, be sure to remove the first number you added (if it’s not one that you own).

Then, secure your identity and report the fraud:

• Update your account passwords and set up 2FA using an authenticator app rather than SMS. This is much more secure as scammers can’t bypass your 2FA if they link your phone number to a Google Voice account.  
• File fraud reports with the Federal Trade Commission (FTC) at IdentityTheft.gov and the FBI’s Internet Crime Complaint Center.
• Be on the lookout for signs of identity theft. Although most Google Voice scammers will move on after linking your number, they may leverage that information to commit other types of identity theft.
• Go through the fraud victim’s checklist and follow the steps. Many of these are preventative measures that defend you against future attacks that fraudsters may attempt.

How To Protect Yourself Against Google Voice Scams

You can prevent most types of scams by never sharing personal information with scammers. But Google Voice scams are unique because the scammer will almost never ask you for personal information. 

Here’s how to stay safe from Google Voice code scammers:

• Never share a Google Voice verification code. There is never any legitimate reason to share this code with anyone. 
• Avoid posting your phone number online or in public places. As inconvenient as this precaution may be, it’s essential. Hackers are skilled enough to do a lot of damage with just your phone number as a starting point. 
• Be extra cautious when selling items online. If any interaction seems suspicious, trust your instincts and don’t rush in. The sale isn’t worth the security risk. 
• Only sell to verified buyers on online marketplaces. Choose platforms that allow you to check whether or not the buyer is “verified” or trustworthy. 
• Don’t agree to give additional personal information to prospective buyers. Requests for more personal information to make sure you’re not a “bot” or a “scammer” are almost sure signs of a scam. 
• Don’t move off the platform when selling. It’s safest to complete the sale on the platform so that you don’t have to give away additional information (like your email address).
• Don’t deal with nontraditional payment methods. Anyone who tries to complete transactions via gift cards, cryptocurrency, postal money orders, or similar payment methods is almost certainly a scammer. Also, don’t use payment apps like Cash App, Zelle, or Venmo unless you know the person or have met offline. 
• Only set up in-person meetings with buyers. Make sure that you meet in a safe location and in a place where you feel comfortable. 
• Monitor your online accounts and credit for suspicious activity. Even if you haven’t been engaging in risky transactions, a fraudster could still target you unexpectedly. Use a credit monitoring app to alert you about fraudulent activity — such as new accounts opened in your name or large transactions that you didn’t approve. 
• Make your online accounts more secure. Improve your passwords, choose tighter security settings, enable 2FA, and set up a password manager to keep all of your accounts airtight. 
• Consider signing up for an all-in-one identity theft protection service. Aura combines #1-rated identity theft protection with 24/7 credit monitoring, antivirus software, and a military-grade virtual private network (VPN) to protect you from scammers and hackers. Plus, if the worst should happen, every adult member on an Aura plan is covered by a $1 million insurance plan for eligible losses due to identity theft.

The Bottom Line: Don’t Fall for Google Voice Code Scams

Anytime someone else uses a number connected to your identity, your cybersecurity, identity, and finances are at risk.

If you’re lucky, the scammer will dump your phone number and move on to the next target. But the worst-case scenario isn’t one that you want to risk. 

Never give out 2FA codes, and keep your personal information as private as possible online. And for added security, consider signing up for Aura’s all-in-one digital security solution. 

Stay safe and shut down scammers. Try Aura free for 14 days.