Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

Question

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is my Gmail account safe?

I got an email from a friend suggesting I download a document. We frequently exchange articles but I was suspicious so I emailed him back asking if he had sent me the first email.

He responded that he had and, dumb me, mentioning no specific details suggested I would think it was great. "How could a phishing scam respond like that?" I thought. I clicked the link, entered my Gmail username and password on my phone but couldn't access the "article."

I then logged into my Gmail (using 2-step verification) on one of the computers at work (a hospital with old Netscape browsers behind hospital network firewall) and opened the email and clicked the link. I typed in my Gmail username and password again (but no authenticator Google 2nd step access code because I wasn't prompted.)

Still unable to access the "document," I moved my friend's email into my Gmail account's "Follow-up with" folder thinking I would try later at home with a modern browser.

I hadn't yet followed up when this morning I got an email from my friend explaining that his yahoo account had been hacked from Korea and that it was even generating automated responses. He added, "Don't click on any links!"

I immediately changed my account's password (about 17 hours after entering my info into the scam's site) but even if I didn't, those baddies don't have access to my phone and it's authenticator app so couldn't access my email, right?

Anyone have any thoughts?

Answer 1

Since you didn't enter your second factor code from your phone, and since you didn't say that you received a text requesting the second factor, you should be safe.

However, if you want to be sure that all bases are covered (or if you hadn't enabled 2 factor authentication), there are a few things to check to be sure that you haven't been compromised and that there are no further back doors into your account.

The first thing you should do is click the Account Activity Details link at the bottom of the Gmail webpage. Then check the history list for any unidentified activity. It doesn't show a lot of history (I can only see 8 hours back on my page), so it may not show you all activity from the time you entered the bad credentials but if you see an unknown IP in the list, you'll know that someone is logging on to your account.

At the top of that Account Activity window, there's a link to "Sign out all other web sessions", which you should click to make sure that no other web sessions are signed in.

Additionally, go to your account settings from the drop-down near the top of the page, then go to Accounts and Import, then check your Account Recovery Options to ensure that no one has set up their account as a recovery account.

Then to to Other Google Account Settings and then go to Sign-in & Security. From here, verify that your 2-Step Verification options are set to only go to your phone number -- make sure no one added an alternate phone or generated backup codes. If you see that backup codes were generated and you didn't generate them, then generate a new list to invalidate the old ones. Also, check the App passwords to make sure that no one has generated an App specific password (which allows them to bypass 2 factor authentication), revoke any credentials that you did not create yourself.

Also in the account settings, verify that no one has set up email forwarding to another address. If they forward a copy of your emails to their own address, they can use your account for Phishing responses and/or to reset passwords for sites that use email for password recovery. While you're there, make sure they haven't turned on POP/IMAP access, though that shouldn't help them unless they have changed your authentication options.

If you found that someone had reset any of your authentication options above, then reset your password one more time, but if you've verified that all of the options are exactly as you set them youself, then you should be safe from someone breaking into your account.

If you have reason to believe that someone did access your account illicitly, then you have to worry that they gained access to any of your other accounts that use email to reset the password, for good measure, reset important passwords like for online banking, credit cards, shopping sites that have stored credit card numbers, etc.

Check all folders (including trash and spam) for any password reset emails that the attacker may have received. Also, check your sent folder to see if he used your account to send emails to others. This is not a foolproof check since the attacker may have permanently deleted any traces of his work.