Google Warns of Phone-Based Hacking Attacks Targeting Financial Firms

Google is warning businesses about a growing wave of cyberattacks in which hackers use phone calls to trick employees into giving away login details and security codes.

The attacks are targeting financial and investment companies in the United States. 

Instead of relying only on advanced malware or automated tools, the attackers are using a much simpler method: convincing employees that they are speaking with someone they trust.

Hackers Pretend to Be IT Staff

According to Google’s security researchers, attackers call employees on their personal phones while pretending to be colleagues or company IT support workers.

During the conversation, the attackers try to persuade victims to visit fake websites and enter their usernames, passwords, or multi-factor authentication codes.

This method is commonly referred to as voice phishing, or “vishing.” 

Once attackers obtain these details, they may be able to access company systems and steal sensitive information.

The approach shows that even as cybercrime becomes more advanced, basic social engineering remains highly effective. 

A convincing phone call can sometimes be enough to bypass security measures if an employee trusts the person on the other end.

Stolen Data Used for Extortion

The attackers are not simply looking for access. 

Google says some groups steal valuable corporate information and then threaten to publish it unless the victim pays a ransom.

The stolen material can include confidential business information, software code, intellectual property, or sensitive information connected to important clients.

Google has identified several groups involved in these campaigns and believes they may be connected to a larger operation.

Some of the attackers reportedly maintain websites where they announce successful breaches and pressure companies to negotiate.

Financial Companies Are Valuable Targets

Financial organizations are especially attractive because they often handle highly valuable and confidential information.

Companies involved in investments, mergers, acquisitions, legal matters, and other major financial transactions may hold information that could give criminals significant leverage.

Google says ransom demands from these attackers can range from $750,000 to $3 million. 

One cryptocurrency wallet linked to one of the groups reportedly received about $10 million in Bitcoin during the first few months of this year.

The same type of attackers have also targeted organizations in industries such as healthcare, insurance, manufacturing, technology, transportation, and hospitality.

How Companies Can Reduce the Risk

Businesses can reduce their exposure by training employees to be cautious when receiving unexpected calls about account access or security issues.

Employees should avoid entering passwords or authentication codes through links provided during suspicious calls. 

Companies can also strengthen identity checks and ensure that support teams have clear procedures for verifying a caller’s identity.

Conclusion

Google’s warning shows that sophisticated cybercrime does not always require sophisticated techniques. 

Phone-based hacking attacks can succeed simply by exploiting trust and human behavior. 

For financial firms handling sensitive information, stronger employee awareness and careful verification can be just as important as advanced cybersecurity technology.