How scammers steal cryptocurrency through Zoom and Google

Social Engineering Against Crypto Investors: How Scammers Use Zoom and Google to Steal Funds

Crypto scammers are constantly refining their tactics, moving from simple schemes to sophisticated attacks based on social engineering. One of the most dangerous and intricate techniques doesn't require hacking or stealing passwords—it manipulates the user directly to gain access to their accounts. A real-life incident involving an experienced professional illustrates how a combination of a convincing backstory and precise timing leads to financial losses—even with two-factor authentication (2FA) in place.

Attack Mechanism: From First Contact to Theft

The attack begins not with technical exploitation, but psychological manipulation. Scammers meticulously study their target—examining their professional activities, public contacts, and potential vulnerabilities. In this case, the target was identified in a crypto chat where their profile indicated involvement in marketing. This allowed for the creation of a realistic cover story.

Interaction Stages:

• Initial Contact: The scammer poses as an assistant to a real company director, providing verifiable details (company name, website with history, geographic proximity).
• Building Trust: A prolonged professional exchange takes place, discussing project details, asking questions, sharing voice messages—all mimicking a standard contractor hiring process.
• Transition to the 'Decisive' Meeting: The scammer proposes a Zoom call with the 'director' to finalize terms. They emphasize punctuality, creating psychological pressure.

The key moment is when the Zoom meeting link is sent exactly at the scheduled time. It's legitimate, but the conference is configured to require authentication before joining. This triggers the core mechanism of the attack.

Technical Execution: Manipulating the Authentication Process

When the user attempts to join the meeting, Zoom prompts authentication—e.g., via Google. At that exact moment, the scammer on their device initiates login to the target’s Google account using the known email.

Google detects the login attempt from a new device and sends a push notification to the account owner’s phone requesting confirmation. The user, expecting to join a critical business meeting and seeing a Zoom authentication request, naturally confirms it—unaware they’re simultaneously granting the scammer access to their Google account.

What happens after confirmation:

• The scammer gains full access to the target’s Google account.
• Since the user’s device is already trusted, the scammer also successfully authenticates into Zoom and joins the meeting.
• Two people—the real owner and the scammer—are now simultaneously present in the account, but the victim remains unaware.

During the one-hour meeting, where the scammers (posing as the 'assistant' and 'director') conduct detailed and realistic business discussions, a second scammer uses access to the Google account to steal funds.

Why Two-Factor Authentication (2FA) Doesn’t Help

In this case, the target had 2FA enabled on their crypto exchange via Google Authenticator. Yet this did not stop the attackers.

Critical Vulnerability: By default, Google Authenticator synchronizes secret keys (seeds) through the user’s Google Account. When the scammer gains access to the primary Google account, they automatically gain access to these synchronized 2FA keys. As a result, all tokens protected by Authenticator become vulnerable.

Google does not clearly communicate this risk to average users. Synchronization settings often default to on or are described in documentation without emphasizing the associated security threats.

Practical Protection Measures for Technical Specialists

For developers and IT professionals working with cryptocurrencies or managing critical accounts, specific technical actions are essential to reduce the risk of such attacks.

List of Required Settings and Practices:

• Disable Sync in Google Authenticator: In the app settings, explicitly turn off the feature that syncs keys through the Google Account. This prevents key compromise if the main account is breached.
• Use Independent Hardware or Software 2FA Solutions: Consider switching to standalone solutions like YubiKey or authenticator apps that don’t sync data through cloud services (e.g., Authy with sync disabled or Aegis).
• Configure Exchange Limits and Delays: On crypto exchanges, always enable:

* Withdrawal only to addresses pre-approved in a 'whitelist' (address book).

* A delay (e.g., 24 hours) for the first withdrawal to any new address added to the list.

• Critical Verification of Push Notifications: Never confirm login or authorization requests without verifying context. If you’re not expecting to log in to a specific service right now—ignore or reject the request.
• Account Segregation: Do not use a single primary email (especially a public one) for logging into all critical services like exchanges, banking, or cloud storage. Create separate accounts for high-risk operations.

Key Takeaways from the Case

• Social engineering is the primary vector. Today’s most dangerous attacks rely on manipulating human behavior, not exploiting technical flaws.
• 2FA synchronization is a hidden threat. Using Google Authenticator with sync enabled via Google Account creates a single point of compromise.
• Timing is a scammer’s tool. Skillful coordination of actions (sending the link, starting the meeting, triggering the auth request) creates a logical context where the user unknowingly grants access.
• Distraction is part of the scheme. Lengthy, realistic interactions (calls, messaging) are used to prevent the account owner from noticing parallel activity in their services (login alerts, setting changes).
• Public information is a targeting source. Scammers analyze public profiles on professional networks and chats to identify targets and build personalized stories.

This attack demonstrates the evolution of threats: scammers now invest time in crafting complex, multi-stage scenarios that bypass traditional technical defenses. The response must go beyond system configuration—it requires heightened awareness of psychological manipulation and a reevaluation of personal account security architecture, especially for those handling digital assets.

— Editorial Team