[UK] Nearly got caught out (Google Account Take Over)

Received a email from Google that looked legit and when first glancing at it, it looked like a 2-step code from my account saying a new email address as been added as a recovery email. Then I received a phone call from a private number. Guy sounded legit, was English speaking (am in the UK) and give me his name and asked if I had tried to login with a iPhone 15 from Portsmouth. I told him no and he said he will go through the steps to remove that device from my account and make my phone back as the main device.

He gave me a case number and his full name and said he will now remove the iPhone and add my phone as the main device and I should get a notification. Obviously no notification came and he then asked me to go into the Google App, still nothing and then he asked me to go to Google Authenticator and give him the code. That’s where he messed up, as before that I believed he was calling from Google. I didn’t give him the code and I hung up, he tried to call again but I dismissed it and no further calls.

I went straight on and changed my password.

Now I have had time to have a proper look at the email with the code, it is from Google but it’s not for my account. He setup a gmail account and added me as a recovery email address, hence I get a code from google. But on a quick glance it looks like someone has added a new recovery email to my account and you basically panic, then the phone call comes.

So they had my email address and phone number and no other information.

Hope I have explained this properly and it helps other people.