63 minutes ago someone called to tell me I was dead
Not metaphorically. They had already filed an official Google support case claiming I had passed away.
And they wanted everything:
• My Google Workspace account
• My entire digital presence
• My business domain
• My emails
The caller introduced himself as David Odza from Google Support.
Professional voice. Palo Alto phone number. A legitimate Google confirmation email sitting right in my inbox.
Everything checked out.
Except one thing.
I knew it was a scam.
Here's where it gets interesting.
He kept asking about my email address. Fishing. Guessing. Circling back to it repeatedly, trying to confirm which account was actually mine.
Then he landed on an old Gmail address.
He asked me directly, "Is this your email?"
I said yes.
What he didn't know was that he'd just found my honeypot.
A honeypot is a fake account that looks real, set up specifically to attract attackers. No real data. No connections to anything important. No value whatsoever.
A trap dressed up as a target.
I keep one precisely for moments like this — an old Gmail address I've never used for anything real, sitting there waiting for exactly this kind of situation.
He thought he'd struck gold.
I let him think that.
Because I had a reason.
I needed his IP address for the fraud report.
He initiated account recovery. Walked me through approving it on the phone — a classic social engineering move where they get you to authorize your own account takeover in real time.
I played along.
Then I watched it unfold in real time:
• He logged in from Massachusetts
• Changed the password trying to lock me out permanently
• I changed it back first
• Kicked him off a Windows machine he had no business being on
And walked away with his IP addresses, phone number, and fake identities
They spent hours planning a sophisticated deceased account takeover.
They got into an empty trap.
Got absolutely nothing.
Now everything, the IPs, the phone number, the fake identities "David Odza" and "Timothy Casper", is sitting in a fraud report heading straight to Google's security team.
The lesson?
These attacks are becoming more sophisticated every day. They use:
• Real confirmation emails
• Real Google infrastructure
• Real support case numbers
Set up a honeypot. Trust your instincts. And if someone calls to tell you that you're dead, maybe don't take their word for it.
This month I'll be running a workshop on how to use AI to protect yourself and your business from phishing attacks.
Stay tuned for my emails to know when it will go live.