What happened

According to security researcher Sam Mitrovic, who experienced it first hand, the scam begins with an unexpected notification asking users to approve a recovery request they had not initiated. 

Following this, victims typically receive a phone call from someone posing as a Google support representative, using a convincing American accent and professional demeanour. 

The American voice explained there had been some suspicious activity on Mitrovic's Google account and someone had accessed it a week ago. The apparent Google employee offered to send an email detailing what happened, and that message promptly arrived from an official Google address. 

However, Mitrovic realised the voice was actually AI-manipulated or generated and hung up.

Why it happened

With nearly 2.5 billion users globally, Gmail is an appealing target for cybercriminals. 

Scammers use sophisticated techniques, including AI-generated voices and spoofed email addresses, to create a sense of legitimacy. The use of AI enhances the realism of the calls, making it harder for victims to detect the fraud. 

In addition, the scammers take advantage of common fears about account security, manipulating users into acting quickly without verifying the authenticity of the requests.