I Was Scammed Out of $130,000 — And Google Helped It Happen

On June 19th, my life changed with a phone call.

I was doing yard work when my phone rang. The number showed up as Pacifica, CA — (650) 451-5708. I answered.

The man on the other end calmly told me he was from Google Support. He said there had been a claim submitted to take over my Google account — someone had even submitted a death certificate and a photo ID claiming I had died in October 2024.

It sounded bizarre and I was skeptical. But it also sounded urgent. Was someone trying to get control of my account?

He wasn’t pushy. He sounded official. And then came the clincher: he sent me an email from legal@google.com, signed by someone named Norman Zhu. That’s when I started to believe the scam.

In the Gmail app on iOS, it looked completely legitimate — the branding, the case number, everything. Even the drop-down still showed “@google.com.”

So when he asked me to read back a code — supposedly to prove I was still alive — in a moment of panic, I did.

---

The attacker accessed my Coinbase account

Near the end of the call, he reassured me that I could secure my account by enrolling in Google Advanced Security. He even said he’d send a follow-up email with a link.

When I hung up, I thought I had stopped an impostor. In reality, I had let one in.

The attacker already had access to my Gmail, Drive, Photos — and my Google Authenticator codes, because Google had cloud-synced my codes.

That was the master key. Within minutes, he was inside my Coinbase account.

---

The crypto theft

In just 40 minutes, the attacker shuffled my staked ETH and other tokens through multiple transactions, then drained the account.

Total loss: ~$80,000 at the time — worth about $130,000 today.

Two hours later, I checked my Coinbase balance. Nearly zero. I refreshed again and again in disbelief. Then the pieces started to click: new devices in my Google account, a strange recovery phone number, and a trail of transactions I couldn’t reverse.

The cruel irony

I work in tech. I design authentication experiences. I know you’re not supposed to share verification codes!

And yet, I got phished.

Google failed me in two ways

I made mistakes, yes — but Google made decisions that turned my mistakes into a catastrophe.

1. Phishing emails from “@google.com” made it into Gmail.

   The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

2. Google enabled Authenticator cloud sync by default.

   Coinbase confirmed the attacker used my synced Authenticator codes. Without that feature, the theft would have been stopped cold.

With one breach, the attacker had everything: my email, 2FA codes, documents, even my photo archive. Google has become the vault of our digital lives — and that vault had cracks.

Note: if you’re a developer and your users have gmail accounts, an authenticator code is NOT a 2nd factor, if that user is using Google Authenticator.

My advice

• Change your passwords today. Don’t wait. 16 billion passwords have leaked recently, and yours is probably among them.

• Never share a verification code. Scammers use urgency and fear (“you must resolve this in the next hour”) to get you to act.

• Think twice before enabling Google Authenticator cloud sync. Yes, it makes recovery easier — but it also puts your entire digital identity in one basket.

• Be skeptical of unknown calls. If something feels off, hang up and restart the conversation by contacting the company directly.

---

This mistake cost me $130,000 and months of peace of mind. If my story stops even one person from falling for a scam like this, it will be worth sharing. (DM me if something similar has happened to you.)

Edit (09/16/2025 @ 22:07 UTC):

I believe the attacker had my password via the 16 billion leaked passwords.

I don’t know how though, because I’ve never shared that password (maybe some malware on my machine caught me typing it?). I also don’t use the same password across apps. My Gmail password was unique. However, I hadn’t changed it in a long time. When I shared the recovery code over the phone, I believe this was the attacker bypassing my 2fac.

I don’t have the original email sent from legal@google.com (there were actually 2-3 emails that appeared to come from @google.com).

I lost the original emails—the attacker deleted all evidence and then cleared my trash (and yes I tried using the Google message recovery tool to find deleted emails, but the attacker cleared that too). The reason I have this email is because I forwarded this email on to phishing@google.com, before the attacker deleted everything. When I got control of my account about an hour later, and removed the scammer recovery methods (he added a windows device—I don’t use windows, and a Brazil phone number), the email bounced back from phishing@google.com (apparently Google doesn’t accept that address). So what I have is the bounced-back copy. I don’t think it’s very useful.

Delivered-To: REDACTED@gmail.com
Received: by 2002:adf:f882:0:b0:3a4:d0c1:d603 with SMTP id u2csp479991wrp;
        Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
X-Received: by 2002:a05:600c:3b15:b0:450:cf46:5510 with SMTP id 5b1f17b1804b1-453656c3641mr7158905e9.29.1750382587766;
        Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1750382587; cv=none;
        d=google.com; s=arc-20240605;
        b=UDtN4PMMuNJOgiP0pTKXPqosx4aCN44KIKlObL5v3C34Ebti7ZN4vxlwn84XqfuV9/
         e7oVI7a225TLRKJWpcsQcMc/uF+UX25J2AJ+mGbrzlnoLiJwiMaiUHH/c+XMqgSNDouJ
         03+wCTX/ipX73jS/13moR6UCECgChK8QmSBK1Tsa9rE31YXHyehjX5OUsPJ7Q+WIup83
         0mSUzkt+9RZLB5M7LsGEhpSZ8wddaD+X7zWFabQtOfbHJ2DThIp+q0GDmZ2MmRaiyDwT
         TAfbCzYgQVS2QiobWvzvQUE2WaG5b+JThebjPhlu9zAwpwNyMBVsCJPAMSGf5Gd8EDJb
         8U0Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:mime-version:dkim-signature;
        bh=5CxJVlHqanjHyKBrEmY7xu5ejsDNfaLKEraCcPQxp4k=;
        fh=iPABb/JoR3JnTfniLQajuKfhT3XX/NwwdIiOHh+BD3U=;
        b=O2coPS2kRr0UZUkuwyiodXiFtflBS30LF6qeFHk9Bx12WLh8aJLJYwVgXNP7edUnEc
         aA3epAxa9sYSXcCTLpRoLoTVpiIbhyeb0Lm+ROW98+XITpbGeOgyzJkbcE77L7nawLq4
         G9rLnR9A8rBPSNojXL0BwKrtfR09M0XwQE0M63hUOT0LgZXym6zEBQLBONcE1WnsbqdE
         BiOe536W2mt3dBPgkw/1YVpAhpZGjlcsla9HdHFGxJbbHlKUrlIQBmaKMjGv9o2bk4oI
         fotqrf1juZrdzpCJjcJAWSiHmY8lSZ78AlYPw/7a1wbP6zeHqxQwdYGAmNz/YaYIUOCM
         Kzsw==;
        dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@googlemail.com header.s=20230601 header.b=c17erkxd;
       spf=none (google.com: postmaster@mail-sor-f65.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f65.google.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com;
       dara=pass header.i=@gmail.com
Return-Path: <>
Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])
        by mx.google.com with SMTPS id 5b1f17b1804b1-453663b7b7esor9775e9.1.2025.06.19.18.23.07
        for <REDACTED@gmail.com>
        (Google Transport Security);
        Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
Received-SPF: none (google.com: postmaster@mail-sor-f65.google.com does not designate permitted sender hosts) client-ip=209.85.220.65;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@googlemail.com header.s=20230601 header.b=c17erkxd;
       spf=none (google.com: postmaster@mail-sor-f65.google.com does not designate permitted sender hosts) smtp.helo=mail-sor-f65.google.com;
       dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=googlemail.com;
       dara=pass header.i=@gmail.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=20230601; t=1750382587; x=1750987387; dara=google.com;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:mime-version:from:to:cc:subject:date:message-id:reply-to;
        bh=5CxJVlHqanjHyKBrEmY7xu5ejsDNfaLKEraCcPQxp4k=;
        b=c17erkxd8kBuYo3Nl/1HgeHQDBxotEy9im53FDGYqGz0DNjWXrejd7nsD7k5Qm6cvq
         MwwkoszOwdJ1mPDEStEA/UdoUTlxBe56iDHl+LFP+HXB4CzsfFm5MRPo0BuHtTdxoHSu
         rGuZgqd/Rre4+19xc91vJdjPF9BSg2fa0QbpE5uutsCE7Nlt5I3Imz2VBBvYviKbFYAy
         4e5jI49l80ksdap6Aew11e5xA21X40WOvuTApflwbnbO8O9z2Mtv1S5E8OAYCLFi+FBZ
         Q8VftZpmtUQPeG0BJTPo+bi74if+1x5ALbiQF3kCtJ6NQvhV8rzwHUZEIxj9ttXMcZHR
         Hvmg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1750382587; x=1750987387;
        h=in-reply-to:references:subject:from:date:message-id:auto-submitted
         :to:mime-version:x-gm-message-state:from:to:cc:subject:date
         :message-id:reply-to;
        bh=5CxJVlHqanjHyKBrEmY7xu5ejsDNfaLKEraCcPQxp4k=;
        b=dRzAMc6tzgTzoCG6ulCfJbxfwJbZ0+FI5D4UuWkjb6oBpb6MocmsbkrsSsMUmVWm4v
         ozly5VFzW8Jl17n3IE+XfOlgLpqCZfH/UUDghNy1kU0LgkVgtZQ8DuucLP4tbool6wcz
         wwg6f3+C4OgCtWKZbgwUWE5oam5wdIncLjLl0/v1bvQNB1kiooCvmAv1wqtvepjl9cVO
         YpkQeXlp/u7WgABp0ssHqLffgIGlE4BW0dDQ9Mq8NPAqVeweOIZavkxuWc1KrVn5LWsw
         GyUJ25Sk8ts/hiPYT4bIhUkSnNhN60wqxU6bLz/FTIrvlQhsQ+lAE4uwHL7THqHLOVE0
         qGWw==
X-Gm-Message-State: AOJu0Yy0jAsN3LMz+nd+JKI1TyC/E3ZJF/MN1OM6EIl6COM9eqIMhemC zYgL57ZC5hqNR41VkLkkpsK4k4G0r415wV5dC/qB8wAHByU8hkd8r53UuvIYFcGBojiJrnIwFMt 8A5wiLJUsHz8nOwEwSKpmQKf83cfjWI6vxVVhreWwTmoeatBuT9iKtzs+2Q==
X-Google-Smtp-Source: AGHT+IHx/i4Rwyuffrk+krlfezODNpHmOr16wv6RTw8xQajSLJOG/2H+qvJtINhP4JhWy91t7bcnLzNt5S2CeNtoURxmmxw0UXy787o=
X-Received: by 2002:a05:600c:35c6:b0:453:6133:2e96 with SMTP id 5b1f17b1804b1-45361333299mr1201795e9.0.1750382587645;
        Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
MIME-Version: 1.0
To: REDACTED@gmail.com
Received: by 2002:a05:600c:35c6:b0:453:6133:2e96 with SMTP id 5b1f17b1804b1-45361333299mr2043805e9.0; Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
Return-Path: <>
Auto-Submitted: auto-replied
Message-ID: <6854b7fb.050a0220.141c3.0374.GMR@mx.google.com>
Date: Thu, 19 Jun 2025 18:23:07 -0700 (PDT)
From: Mail Delivery Subsystem <mailer-daemon@googlemail.com>
Subject: Delivery Status Notification (Failure)
References: <-706448407191667437@unknownmsgid> <CALyzdPRkd7RyVV5gUOc9cKqFV+LC1iErFMDJWbSqOHeFhxSo2g@mail.gmail.com>
In-Reply-To: <CALyzdPRkd7RyVV5gUOc9cKqFV+LC1iErFMDJWbSqOHeFhxSo2g@mail.gmail.com>
X-Failed-Recipients: phishing@google.com
Content-Type: text/plain; charset="UTF-8"

Hello REDACTED@gmail.com,

We're writing to let you know that the group you tried to contact (phishing) may not exist, or you may not have permission to post messages to the group. A few more details on why you weren't able to post:

 * You might have spelled or formatted the group name incorrectly.
 * The owner of the group may have removed this group.
 * You may need to join the group before receiving permission to post.
 * This group may not be open to posting.

If you have questions related to this or any other Google Group, visit the Help Center at https://support.google.com/a/google.com/bin/topic.py?topic=25838.

Thanks,

google.com admins



----- Original message -----

X-Received: by 2002:a05:600c:35c6:b0:453:6133:2e96 with SMTP id 5b1f17b1804b1-45361333299mr1201765e9.0.1750382586139;
        Thu, 19 Jun 2025 18:23:06 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1750382586; cv=none;
        d=google.com; s=arc-20240605;
        b=YF4PH8S0wxb+gPJEJaW4vL5APgrGO8IqBrCdjEPGhUafX0hdIwx/b1y/PjuYzDoIDd
         VTofHJH2HWHOjNP0VPAwdkvVgj7FFSnyaYc/hXkAAPyL4YoL4ClteCvGXCZxHsUTzV4U
         I8+5lMg40WmpnnaX2lge88qanhZMCOKUQsXS3zR7gzg3MxL6m0vw6vQlcMJii1wZPMi6
         YHiNsqSyEZUOjZ0cmNNNzK8R1tMiNDkm9kd3edFV37YalAvNXtZhstS1tlUmqdbBbxgt
         vtp7aJgNVUCBRGFKZxnMLW7d2bUKUfaw8Uv3RIkksDwGTzGbrd64T5W1rTdNrMPKAgaq
         vq7w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :dkim-signature;
        bh=2J6Q4ptPqoBmBi0FN9/BbnlvwDzP3Bq5lJVoSF/mGTo=;
        fh=tx/O1xJiAW23ulsf23QIyL3xMW85l6xjJ2Xs38eB1Ss=;
        b=LvrwhhAB0I8u62T+SWyR9kMoYrdHZn4iBWKxAzWXNrYBd5WFI7tGHnou1uMjgxbPOE
         t3hs+AEx8+RpUAqSwZqdci0Aoi4H1q4HPJf51xo3ygosGcj9C/LMRHbILioHmTlXg3pC
         6UA9aRXl6QG4EWM/LluNXxA/vTU4A6GKxXYYTI9uekU8JQFSN6hUekE2yY+XhPcfn5ZB
         YreR7r3cix4Yiqu+SJV/J6vxmq5fuvOkCRk8PLD0QAy/+sc5r+4jA2dCJbNjQ0abieii
         LdqLBmoWY4vxjetAerVIGrOtleO17sECfqpx9wmKq5gtl7m1NsxLBhjVNF8Key2LAAUT
         RmbQ==;
        dara=google.com
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=gdeBVLEU;
       spf=pass (google.com: domain of REDACTED@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=REDACTED@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@google.com
Return-Path: <REDACTED@gmail.com>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
        by mx.google.com with SMTPS id ffacd0b85a97d-3a6d1434695sor107817f8f.9.2025.06.19.18.23.05
        for <phishing@google.com>
        (Google Transport Security);
        Thu, 19 Jun 2025 18:23:06 -0700 (PDT)
Received-SPF: pass (google.com: domain of REDACTED@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@gmail.com header.s=20230601 header.b=gdeBVLEU;
       spf=pass (google.com: domain of REDACTED@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=REDACTED@gmail.com;
       dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;
       dara=pass header.i=@google.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1750382585; x=1750987385; dara=google.com;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :from:to:cc:subject:date:message-id:reply-to;
        bh=2J6Q4ptPqoBmBi0FN9/BbnlvwDzP3Bq5lJVoSF/mGTo=;
        b=gdeBVLEU/mnEZ9PZUNq3p/cZCvxHTddWUgTUPRcSGV83nbrnSkSlb8j6AX9QYCZ5FJ
         +oSMcwqL/A2INQbEO2+8b+fh8ZPlIvAmMgaNr7w26AgLtJaoSGVVD9SHY5MbRHQ/Q6Z2
         hw/4/uJFdE3nZEIbR4dFmPQEPTs1F2wJokjCUgh/vHD5juYZcBbRE1YmMJzgT2RcUgJ9
         vJVQ88NYoHbhRkqrrdCT0+v+H7Cv15CgdAAEmzyjrlDD91TAdxyct9Bm4B03ylR5XPPB
         rsA1s1XmlyWc2/uUvr5k8gv67omb3L5ruzozfXAEfLTAYd113dZZiiGTEZhBrBhRIL1/
         DPew==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1750382585; x=1750987385;
        h=to:subject:message-id:date:from:in-reply-to:references:mime-version
         :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
        bh=2J6Q4ptPqoBmBi0FN9/BbnlvwDzP3Bq5lJVoSF/mGTo=;
        b=WgwfyhMIJhNmQMsY9VzQ7Cy90IApM+9lBY6xwifb4PaJXmX4KHd6a9sfj7OUxe94Qi
         xzbFHD0DAjZl2dbKbNLRCVi6r4RNTrrNqiCQrHLS8xbB1m17bejDu4zjR/G4qLKjWw3E
         dKHJB8fU7I5xoMiHds753GiqB93RBSbRoph4/de7tDvOy6val5qyDvTg4hQShhhNyTj2
         M77UolQPa/5Z6DS3tPkkEF/2sVTDPMs9SNVrYnwUK2gd5+wPbaaa4RaGFbbdShTaVTXl
         pBW2PNfOutIa/DPfPxIM+NHnAhi9YbHF1IqilcQLtKlzsHOI69gRGH4TwEoU/3WtU3Xt
         VT7A==
X-Gm-Message-State: AOJu0YxtAbQ5/3UFr2mOo0p4MTYwLXpHJfmzsqXKDAV20yQHQFxrozyp
	c60EvP4f05TfRrq5u7FH0K/mgyYV7+Ag858seOGyMkaoOgpha0/BZnsz7qtPltNPRmRcW07IuvS
	Ywm8PbsYhQgnQ0zc0/09WFXMXQboZYHWrr3vhqLw=
X-Gm-Gg: ASbGncsQkFpFd+dLQZ+5I8QPiQp5E0tTxrWCdKo7ON8oiTNJKZYSVVK36hgvojwKTUC
	y0u92u+da+We5LfTehAvFoviAoERehSECX1I4PCmysdp1JXekNb7eGHJpWAkiDz6pnNp6sFPc1D
	O3WsrhLdjWPD+I3LIApeSh2PfSghnA0Y9tUvfRKE+mhZ7hA7s2Zm43Z2qAI5TfU9FrxQRSFWUMg
	po=
X-Google-Smtp-Source: AGHT+IFjsxcIYbLlkx2vKfyE+7Fo/WHtfARPTpqIHoLDLh1lfhR/Kx3k2WCMTjSvgobsuIzHudzz1TyAf53vLLn+ouY=
X-Received: by 2002:a5d:5f4b:0:b0:3a5:7944:c9b with SMTP id
 ffacd0b85a97d-3a6d12a0682mr654357f8f.16.1750382584520; Thu, 19 Jun 2025
 18:23:04 -0700 (PDT)
MIME-Version: 1.0
References: <-706448407191667437@unknownmsgid>
In-Reply-To: <-706448407191667437@unknownmsgid>
From: REDACTED <REDACTED@gmail.com>
Date: Thu, 19 Jun 2025 18:22:53 -0700
X-Gm-Features: Ac12FXzgMRx2LlT6wTm8moPVU5aQ6jmBDzrzKwqKgBAmbCxAgxoKVCRjXte3Wp8
Message-ID: <CALyzdPRkd7RyVV5gUOc9cKqFV+LC1iErFMDJWbSqOHeFhxSo2g@mail.gmail.com>
Subject: Fwd: Recent Case Status
To: phishing@google.com
Content-Type: multipart/alternative; boundary="0000000000002be7050637f6b44c"

--0000000000002be7050637f6b44c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

REDACTED



---------- Forwarded message ---------
From: Google <legal@google.com>
Date: Thu, Jun 19, 2025 at 3:53=E2=80=AFPM
Subject: Recent Case Status
To: <REDACTED@gmail.com>


[image: Google]
Recent Case Status

Reference Number: *EI-GR15F233VC*

Thank you for your assistance and understanding during your recent support
call, regarding a ficticious request aimed at accessing your Google
account. The account custody change submitted to us has been formally
rejected following your discussion with one of our team members. We'll be
conducting an internal review of this incident to ensure you're able to
confidently use our services without any concern for the security of your
data & privacy.

To follow all guidelines of the internal review properly. Please keep a
secure note with the temporary password which your support representative
has provided to you. Our internal review period has a duration of 6-12
hours. On the completion of this review, you'll receive an automated email
from us with instructions on updating the security settings for your
account. Changes to security settings during this review period are
restricted to safeguard your account while we work diligently to identify
reasoning behind the cause of any security related incidents.
Representative Case ID Department
Norman Zhu 70048173 Integrations

Please save a copy of this email for your personal records. Do not share
the content of this email with anyone who has not been given your
authorization to acknowledge the details of this case.

--0000000000002be7050637f6b44c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div><br clear=3D"all"><br clear=3D"all"><div><div dir=3D"ltr" class=3D"gma=
il_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><spa=
n style=3D"font-size:13px;border-collapse:collapse"><font face=3D"arial, he=
lvetica, sans-serif"><div style=3D"margin-top:0pt;margin-right:0pt;margin-b=
ottom:8px;margin-left:0pt"><font color=3D"#333333">David Scoville</font></d=
iv></font></span></div><div><span></span><span></span><br></div></div></div=
></div></div><div><br></div><div><br><div class=3D"gmail_quote gmail_quote_=
container"><div dir=3D"ltr" class=3D"gmail_attr">---------- Forwarded messa=
ge ---------<br>From: <strong class=3D"gmail_sendername" dir=3D"auto">Googl=
e</strong> <span dir=3D"auto">&lt;<a href=3D"mailto:legal@google.com">legal=
@google.com</a>&gt;</span><br>Date: Thu, Jun 19, 2025 at 3:53=E2=80=AFPM<br=
>Subject: Recent Case Status<br>To:  &lt;<a href=3D"mailto:REDACTED@gm=
ail.com">REDACTED@gmail.com</a>&gt;<br></div><br><br><u></u>  <div sty=
le=3D"margin:0;padding:0;font-family:Arial,sans-serif;background-color:#fff=
fff;color:#202124"> <table role=3D"presentation" cellspacing=3D"0" cellpadd=
ing=3D"0" style=3D"width:100%;max-width:600px;background-color:#ffffff;marg=
in:40px auto;border-radius:8px;border:1px solid #dadce0"> <tbody><tr> <td s=
tyle=3D"padding:24px">  <img src=3D"https://www.google.com/images/branding/=
googlelogo/2x/googlelogo_color_92x30dp.png" alt=3D"Google" width=3D"92" hei=
ght=3D"30" style=3D"display:block;margin:0 auto 20px">  <div style=3D"font-=
size:22px;font-weight:500;color:#202124;margin-bottom:8px"> Recent Case Sta=
tus </div> <p style=3D"font-size:13px;color:#5f6368;margin:0 0 24px"> Refer=
ence Number: <strong>EI-GR15F233VC</strong> </p>  <div style=3D"border-top:=
1px solid #dadce0;margin:20px 0"></div>  <p style=3D"font-size:13px;color:#=
202124;line-height:1.6;margin:0"> Thank you for your assistance and underst=
anding during your recent support call, regarding a ficticious request aime=
d at accessing your Google account. The account custody change submitted to=
 us has been formally rejected following your discussion with one of our te=
am members. We&#39;ll be conducting an internal review of this incident to =
ensure you&#39;re able to confidently use our services without any concern =
for the security of your data &amp; privacy. </p> <p style=3D"font-size:13p=
x;color:#202124;line-height:1.6;margin:13px 0"> To follow all guidelines of=
 the internal review properly. Please keep a secure note with the temporary=
 password which your support representative has provided to you. Our intern=
al review period has a duration of 6-12 hours. On the completion of this re=
view, you&#39;ll receive an automated email from us with instructions on up=
dating the security settings for your account. Changes to security settings=
 during this review period are restricted to safeguard your account while w=
e work diligently to identify reasoning behind the cause of any security re=
lated incidents. </p>  <table role=3D"presentation" cellspacing=3D"0" cellp=
adding=3D"0" style=3D"width:100%;margin:20px 0;background-color:#ffffff;bor=
der:1px solid #e0e0e0;border-radius:8px;overflow:hidden">  <tbody><tr style=
=3D"background-color:#f1f3f4"> <td style=3D"padding:14px;font-size:14px;fon=
t-weight:bold;color:#5f6368;text-align:left;border-bottom:1px solid #e0e0e0=
"> Representative </td> <td style=3D"padding:14px;font-size:14px;font-weigh=
t:bold;color:#5f6368;text-align:left;border-bottom:1px solid #e0e0e0"> Case=
 ID </td> <td style=3D"padding:14px;font-size:14px;font-weight:bold;color:#=
5f6368;text-align:left;border-bottom:1px solid #e0e0e0"> Department </td> <=
/tr>  <tr> <td style=3D"padding:14px;font-size:15px;color:#202124;text-alig=
n:left;border-bottom:1px solid #e0e0e0"> Norman Zhu </td> <td style=3D"padd=
ing:14px;font-size:15px;color:#202124;text-align:left;border-bottom:1px sol=
id #e0e0e0"> 70048173 </td> <td style=3D"padding:14px;font-size:15px;color:=
#1a73e8;text-align:left"> Integrations </td> </tr> </tbody></table> <p styl=
e=3D"font-size:13px;color:#202124;line-height:1.6;margin:13px 0"> Please sa=
ve a copy of this email for your personal records. Do not share the content=
 of this email with anyone who has not been given your authorization to ack=
nowledge the details of this case. </p> <div style=3D"border-top:1px solid =
#dadce0;margin:20px 0"></div> <div style=3D"text-align:center"> <p style=3D=
"font-size:12px;color:#5f6368;line-height:1.6;margin:8px 0 0 0"></p> </div>=
 </td> </tr> </tbody></table></div>
</div></div>

--0000000000002be7050637f6b44c--