• Journalist Kelly Rissman is an expert in scams, having investigated them for publications like Insider.
  • But while trying to sell furniture, a scammer was able to set up a Google Voice account with her number.
  • "If this person now uses the Google Voice number to do nefarious things, the first line of investigation leads to you, not to them."
  • See more stories on Insider's business page.

Two weeks ago, I perked up when my phone lit up  with a message from the resale app OfferUp: "Hi, is this still available?"

I didn't suspect this person, who was claiming to be interested in buying my old furniture, was trying to get hold of phone numbers to turn themselves into a "real person" on Google Voice .

For months, I had desperately attempted to sell my old apartment furniture to offset a rise in storage rent. Glancing at my phone screen, I already felt relieved by the prospect of the sale.

The message was sent by a woman named Jaree, whose profile picture showed a young, unassuming woman with frizzy, dark hair. The app indicated that Jaree's payment information and phone number were verified. She seemed legitimate.

After I told her that the furniture was still available, she asked for my phone number. I thought it was a great idea; speaking to someone always elicits clearer communication than texting.

I sent it over, despite OfferUp warning: "Sharing contact details with strangers can be unsafe."

Kelly Rissman and the scammer on OfferUp
'Jaree' messages Kelly Rissman on the OfferUp app.
Kelly Rissman

In hindsight, this should have served as a red flag. But I trusted Jaree, her kind-looking face and her ability to lift the weight of the increasingly expensive furniture off my shoulders. Plus, she had my phone number, not my bank account details.

As a reporter – one who writes about scams, in fact – I am accustomed to doling out my phone number for interviews, so sharing it hardly felt like the type of "contact details" that OfferUp needed to warn me about. I ignored the message and mentally prepared myself for a negotiation. 

But Jaree and I never spoke over the phone. Our exchange merely shifted from texting via app to texting via phone. And my desire to sell my furniture waved away yet another red flag: she wanted to prove I was "a real person" before proceeding.

She texted in broken English that I would need to send over a six-digit code I would receive I was perplexed. What about me suggested that I wasn't a real person?

The promised code arrived in my text messages. Beside the code were the words "Google Voice" and a sentence written in, what I later discovered, was Filipino.

The message was sent by a 220-00 number. A quick Google search confirmed that message was sent from Google, which for whatever reason, made Jaree appear even more legitimate to me.

JareeTextEdit
The scammer asks for a six-digit number in broken English.
Kelly Rissman

Anxious to sell, I sent the code back. If I had actually translated the Filipino text, I would have known it was telling me the code was "your Google Voice verification code. Don't share it with anyone else."  

"Sorry dude…!! This number verify is a problem. Can you sent me another call number?" Jaree replied. She actually sent it twice in a row in one block of text – almost like she was sloppily copying and pasting a script.

At this point, I'm embarrassed to say, the ironic reality of the situation hit: I research and write about scams, yet I just fell for one.

The strange part was, I didn't understand how I was being scammed. The scams I've researched dealt with fraudsters extracting a victim's personal information, like a driver's license or a bank account number.

But Jaree didn't even have my full name, just my personal phone number. It turns out that a "real" phone number is all that some scammers want. 

SEE ALSO: These are the 8 biggest scams people are most likely to fall for online

It's called a Google Voice scam. "This trope of verifying is a very common thing that scammers use," Satnam Narang, a staff research engineer at cyber-exposure company Tenable, tells me.

Variations of the scheme have been around for quite some time, often popping up in the early days of Craigslist or Facebook.

More recently, WhatsApp and TikTok users have experienced versions of the verification scam as well. 

"Scammers are basically just trying to piggyback off of people like yourself who are selling products on the services, in order to create Google Voice numbers," Narang adds.

But why, I ask, would they want a Google Voice number? "To perpetuate further scams," Narang says.

Jaree would've signed up for a Google Voice account, which would grant her a new internet number – one that is not tied to her phone bills or full name, making her anonymous.

SEE ALSO: Hackers are getting better at tricking people into handing over passwords — here's what to look out for, according to experts

But in order to create a Google Voice account, the scammer first needed a legitimate phone number to which to link the account. 

That's where I came in. Equipped with my real, verified phone number, Jaree created a Google Voice number. Anonymously, Jaree could have scammed others into sending her money or bank information – with my name on the line.

"If this person now uses the Google Voice number to do nefarious things, the first line of investigation leads to you, not to them," says Christoph Hebeisen, director of security intelligence research at Lookout.

"I don't know what all of the reasons are that Google requires a real phone number to verify for Google Voice, but I would imagine that having some kind of handle on who the real person is who is trying to register that account is one of the motivations behind that. And this totally subverts that process."

I managed to stop Jaree from using me to scam others. As soon as I was scammed, I created a Google Voice account and linked it to my number – the same steps I'd realized Jaree had recently taken.

READ MORE: What is phishing? Here's what you should know about the virtual scamming technique and how to protect yourself from data theft

A pop-up message informed me that this phone number was already in use. Jaree had successfully created an account within five minutes of tricking me.

Fortunately, Google Voice only allows you to register a phone number once. Perhaps that's why Jaree had tried to extract as many legitimate phone numbers from a sucker like me. So when I signed up, Google sent me another code (in English), and I was able to verify it and reclaim my number.

Reports of fraud initiated on websites or apps in the United States nearly doubled from 2019 to 2020, rising from 70,070 cases to 134,416.

The actual number of verification scam victims is likely to be even higher. Hebeisen speculates that the Google Voice scam and its variants may often go unnoticed because the victims suffer no financial loss.

"Everybody knows not to give out their credit card number, but not responding to giving somebody a verification code that you got on your phone? That's something I think people aren't very aware of," he says.

Narang says that, while scammers sometimes un-link the Google Voice account they've created from the number they obtained, the consequences can be dire in other cases.

He describes a SIM swapping scam, in which a fraudster can "physically go into a store, claim to be you, say they want to transfer the SIM from your existing phone … to their new phone and they basically take over your number.

"And they're able to then access your accounts, reset your passwords, and then log into your Gmail, log into your banking institution and basically pillage all of your accounts."

Narang says the chances of a SIM swapping scam following a Google Voice scam is unlikely but "not out of the realm of possibility."

I didn't immediately realize just how lucky I was to have reclaimed my number so quickly. Once hackers have one piece of personal information, like a phone number or email address, they possess "the keys to your digital kingdom," says Doug Fodeman, content director of TheDailyScam.com, a website dedicated to cyber-scam awareness.

With only my phone number and first name, Jaree could have easily typed my information into a data brokerage site, like Spokeo or BeenVerified, and collected even more personal information. Now we are moving into potential identity theft territory.

"People don't know how much personal information is out there on the internet," Fodeman says. "We want to make it harder by removing as much of this data as we can. Specifically, your phone number and your email address are critically important to digital identities."

He recommends signing up for OneRep.com, a website that will remove your personal information from data brokerage sites. After punching in my full name and location on the site, my jaw dropped.

Of the 103 data brokers analyzed, my information was on 40 of them. 

Either you can pay for OneRep's service, which will sweep your personal information from all websites instantaneously, or you can choose to opt out manually.

Tucked away at the bottom of data brokerage sites sits a button that says "Do Not Sell My Personal Information," allowing you to remove your information from the website's claws.

"The absolute lesson in all of this is that if you ever get a code, you don't share that with anyone for any reason," Fodeman says.

Ironically, the best way to protect oneself from encountering a verification scam? Creating a Google Voice account.

Using OfferUp, I can now send a Google Voice number to people I'm selling items to rather than my personal phone number, Narang points out.

Lesson learned. Thanks to my scammer, my Google Voice account is ready to go. Anybody want some furniture?