The Google Voice Verification Scam — How It Works and How to Protect Yourself

You're selling something on Facebook Marketplace or Craigslist. A buyer messages you, seems interested, and then asks for a small favor: "I just need to verify you're a real person — can you read me the code I'm about to send to your phone?"

It sounds harmless. It's not. This is the Google Voice verification scam, and it's one of the most effective social engineering attacks targeting everyday people. Here's exactly how it works, why it's dangerous, and what to do if you've already been caught.

---

How the Google Voice Scam Works

The scam follows a predictable pattern, but it's designed to feel natural and reasonable in the moment.

Step 1: The Setup

The scammer finds you through an online marketplace, classified ad, or forum where you've posted your phone number. They reach out about your listing, showing interest to build rapport.

Step 2: The "Verification" Request

After a brief exchange, the scammer tells you they want to make sure you're "not a bot" or "not a scammer" — ironic, given what comes next. They say they'll send a verification code to your phone number and ask you to read it back to them.

Step 3: The Code Arrives

You receive a text message from Google containing a 6-digit verification code. The message itself warns you not to share it:

"G-XXXXXX is your Google Voice verification code. Don't share it with anyone."

Step 4: You Share the Code

Under the guise of "verifying your identity," the scammer asks you to read the code aloud or type it in a message. The moment you do, they enter it into Google Voice — and link your phone number to their Google Voice account.

Step 5: Your Number Is Hijacked

The scammer now has a Google Voice number tied to your real phone number. They can use it to:

• Make and receive calls that appear to come from your number
• Send text messages that trace back to you
• Run additional scams using your number as a trust signal
• Intercept verification codes sent to your number

---

Why This Scam Is So Dangerous

The Google Voice scam doesn't steal your money directly. Its damage is more insidious:

Your Number Becomes a Scam Tool

The scammer uses your number to defraud others. When victims of those scams report the number, it's your number that gets flagged — not the criminal's.

Identity Verification Abuse

Many online services use phone numbers for identity verification. With control of a Google Voice number linked to you, an attacker can potentially intercept SMS-based two-factor authentication codes for other accounts.

Cascading Account Compromise

If the attacker gains access to verification codes, they can attempt password resets on your email, banking, or social media accounts — especially if those accounts use SMS-based 2FA.

---

Red Flags to Watch For

Learn to recognize these warning signs before it's too late:

Golden rule: No legitimate buyer, seller, or service will ever ask you to share a verification code. Period. Those codes are for your accounts, not theirs.

---

What to Do If You've Been Scammed

If you've already shared a Google Voice verification code, act quickly:

1. Reclaim Your Google Voice Number

Visit voice.google.com and sign in with your Google account. If the scammer linked your number, Google provides a process to reclaim it:

• Go to Settings > Account > Linked Numbers
• Follow the prompts to verify ownership and unlink the scammer's access

2. Change Your Google Account Password

Immediately update your Google password to something strong and unique. If you use this password elsewhere (you shouldn't), change it there too.

3. Enable Two-Factor Authentication

Set up 2FA on your Google account using an authenticator app (Google Authenticator, Authy, or similar) rather than SMS verification. App-based 2FA is significantly harder for attackers to intercept.

4. Review Your Account Activity

Check your Google account's recent security events at myaccount.google.com/security. Look for:

• Unrecognized sign-ins
• New devices you didn't add
• Recovery email or phone changes you didn't make

5. Report the Scammer

Report the scammer on the platform where you were contacted (Facebook Marketplace, Craigslist, etc.). You can also file a report with:

• The FTC at reportfraud.ftc.gov
• The FBI's IC3 at ic3.gov

---

How to Protect Yourself Going Forward

Never Share Verification Codes

This bears repeating: no one legitimate will ever ask for your verification code. Not a buyer, not a seller, not tech support, not your bank. If someone asks, it's a scam. Every time.

Use a Separate Number for Online Listings

If you regularly sell items online, consider using a Google Voice number (that you control) as your public-facing number. Keep your real number private.

Be Skeptical of "Verification" Requests

Any unsolicited request to "verify" your identity through a code, link, or third-party service should be treated as suspicious by default.

Use a VPN on Public Networks

While a VPN won't prevent someone from social-engineering a verification code out of you, it does protect your broader digital footprint. A VPN with AES-256 encryption secures your traffic from network-level eavesdropping and keeps your IP address — and by extension, your rough location — hidden from potential stalkers and scammers.

Monitor Your Accounts Regularly

Set up login notifications on all important accounts. If someone attempts to use your phone number to reset a password or verify an account, you'll know immediately.

---

The Bigger Picture

The Google Voice verification scam is a textbook example of social engineering — attacks that exploit human psychology rather than technical vulnerabilities. The code itself is legitimate. The process is legitimate. The only thing that's illegitimate is the person asking for it.

This is why cybersecurity isn't just about software and encryption. It's about awareness. The best firewall in the world can't help you if you willingly hand over the keys.

Stay skeptical. Never share verification codes. And if something feels off, trust your instincts — they're usually right.