Jan 17, 2023
Getting spammed with "Accept your invitation to access a Google Ads account"
Recently I started getting almost daily emails inviting me to access a google ads account of someone I don't know.
I suspect this is the newest iteration of google chat, hangouts, photos, drive or calendar phishing scams though haven't heard of it or a solution before, so reporting here and asking how I can block these types of spammy invites.
To confirm, I do not currently have a Google Ads or Adwords account nor run any business that would make use of one. I do not admin any sites or know of anyone who would want me to assist them with their Google Ads.
Here is a sample of what the messages say: xxx has invited you to access the following Google Ads account. Google Ads Account Name: xxx [some url] Google Ads Customer ID: xxx-xxx-xxxx Access Level: Administrative. To access the account, click the “Accept invitation” button below and complete the steps on the next page.
I then click through to decline the invitation. At first I thought someone simply sent an invite email to me by mistake, though now as I've gotten 7 of them from different addresses, at least one per day, it seems like a phishing scam.
Can I somehow add my gmail address to a list of "do not invite to admin Google Ads" or for that matter, something like "do not send google drive shares to this recipient"?
Some ideas for Google coders to resolve this from their end:
- Some form of opt-in validation, like a special authenticator code or 2FA that prevents people from randomly spamming everyone on the planet with these should suffice...
- Perhaps an abuse/report spam function in lieu of having to jump through hoops to decline an invite, something that would trigger internal systems when x number of people click it, it will stop them from sending any more invites, lock that Google Ads account and flag it for abuse until the matter is cleared.
- Alert relevant privacy/security authorities and proceed with criminal investigations in extreme examples of obvious shenanigans?
Help?
My thanks.
Details
Informational notification.
This question is locked and replying has been disabled.
Community content may not be verified or up-to-date. Learn more.
All Replies (11)
Jan 18, 2023
Jan 18, 2023
Jan 18, 2023
Some ideas for Google coders to resolve this from their end:
- Some form of opt-in validation, like a special authenticator code or 2FA that prevents people from randomly spamming everyone on the planet with these should suffice...
- Perhaps an abuse/report spam function in lieu of having to jump through hoops to decline an invite, something that would trigger internal systems when x number of people click it, it will stop them from sending any more invites, lock that Google Ads account and flag it for abuse until the matter is cleared.
- Alert relevant privacy/security authorities and proceed with criminal investigations in extreme examples of obvious shenanigans?
Your ideas sound good. I too had the same problem. The media write more and more information about phishing campaigns. Sending mass messages hoping that someone will be tempted. You need to be careful.
But I likewise believe that we should have tools to report a critical alert so that Google's security department has a quick massive signal about the problem.
Last edited Jan 18, 2023
This is hard to manage with billion accounts;
The easiest (because this is a repeated attempt) would be to report this as phishing;
Jan 19, 2023
Jan 19, 2023
Jan 19, 2023
In the later case, I can click a link to block the person, but that doesn't seem to actually report them as spam/scam/phishing...? From my view, this only stops that one single disposable account from sending yet another invite to me, but won't stop them when they create a new disposable account a few moments later.
In other words -- as far as I know -- this does not actually flag nor block the person/bot IP, MAC or other identifying data in the header, which, through my decades of knowledge how email works, would be quite useful to people who work at Google... If you're having a hard time "managing the billions of accounts" vis a vis as MosheTLV so eloquently put it, those valuable nuggets may help curb the rampant loophole these phishing criminals are exploiting.
Granted, my spam filter will learn what some of these emails look like over time, and subsequently block them, though I do get valid drive shares from time to time.
I really have no interest in Google Ads, since it isn't a product I personally use. As a coder, I imagine a user could simply block the entire "service" and any invites therefrom, as simply as deciding whether or not I want to use Google cloud services, photos, drive, voice, etc...
Wouldn't that be an easy solution? Then, if someone tries to send you a spammy invite, it will simply look to see if you have an Ads account, and if not, simply say "oops, that person doesn't have an Ads account. They'll need to set one up before we can send them an invite to admin your phishing scheme" or something written a bit better...
But I digress, how to report them as phishing, please?
I am happy to forward each of these with full headers to somewhere other than /dev/null if it can be actioned...
Again, my thanks.
Last edited Jan 19, 2023
Jan 19, 2023
Jan 19, 2023
I have already received at least 10 messages of the same type from different senders (Lady Dialog Open,Beautiful Converse Knob,Peach Talk Screw...)
Jan 20, 2023
Jan 21, 2023
Jan 21, 2023
Jan 25, 2023
This is obviously some new scam tactic, but jeez is it annoying.
Jan 29, 2023
Usually if you search for the word "incoming" you will see a line that says Incoming Transfter.
Just above that will be a RECEIVED block that contains the IP address, and timestamp info.
I copy that entire block and give it to Google to find the spammer easier.
You can also use this info to look up where that IP came from if it's not Goggle using some WHOIS site.
https://support.google.com/mail/contact/abuse
Here is an example of looking the IP Address using a WHOIS site.
As you can see 209.85 is Google.
https://ipinfo.io/209.85.208.66
Last edited Jan 29, 2023