How Scammers Use Rental Listings To Break Into Google Accounts

PARK CITY, Utah — We have all gotten pretty used to verification codes. We use them to log into our bank accounts, email, even to file taxes. But when scammers used a verification code to trick a man trying to rent out his house, he called the KSL Investigators.

Adam Moffat was looking to rent out his home near Park City. He listed it online and had lots of interest, including from one potential renter who had a question.

“‘Is this a real person?'” recounted Moffat. “And I was like, ‘Yeah, of course it is.”’

Moffat was not totally surprised by the question. He has seen other KSL Investigators reporting on scammers posting bogus rental listings to try and steal security deposits, so he said he was not alarmed by the follow-up question, either.

“‘Do you mind if I send you a verification code? That just verifies that you’re a real person,'” Moffat said. “I was like, ‘Okay, sure.'”

Moffat got the code and texted it back.

He realized his mistake too late — that code actually gave the person he was texting access to his Gmail account.

That individual turned out to be a scammer who found a clever way around two-step verification.

“Whoops is right. That was like, ‘Oh, wait a second,'” said Moffat. “And then I was like, ‘Wait, are you a real person?'”

Once inside your email, a scammer can get access to just about everything: from your Netflix account to social media, or even your bank.

Think about it. Every time you forget a password, the company sends you a password reset link. In many cases, that link goes to your email.

Moffat spent a day frantically changing all his passwords and, to his knowledge, the crook did not get away with anything.

He said he hopes his story serves to keep others from getting duped.

While in this case it was a man trying to rent out his house, variations of this scam often target anyone selling anything through online classifieds.

Just like they did with Adam Moffat, they will ask you to send a verification code back to them, saying they want to be certain the listing is genuine.

Officials said there is no reason for a verification code to rent out a home or to sell something online, unless the sender is a scammer.

So, what do you do if you get asked for a verification code? Do not respond!

If you do send a code back, then immediately change your Gmail account information.