On: Scammed out of $130K via fake Google call, spoofed Google email and auth sync

[eviks]

> The attacker spoofed the “From” field so it looked like the emails came from @google.com — something Google’s filters should have blocked outright. On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

How is this basic fail still possible?