accessibility-icon
share-icon

VIDEO

Illustration | Created using AI

Cyber Directorate Warns of Fake Google "Tehran" Calls

Asaf Nissan

By: Adam Mikhalashvili

Editor: Asaf Nissan

About an hour ago

The National Cyber Directorate issued an emergency warning on Sunday alerting Israelis to a widespread voice-phishing campaign impersonating Google's global security team. The automated robocalls, delivered in English, falsely inform recipients that their account phone number was modified from Tehran, Iran, and prompt them to "press 1" to dispute the change; cybersecurity officials stressed that receiving the call does not indicate an actual breach, urging citizens to immediately hang up, refrain from pressing any digits or disclosing verification codes, and report suspicious incidents to the 119 cyber emergency hotline.


A wave of deceptive automated telephone calls has prompted the National Cyber Directorate to issue an urgent public warning on Sunday, cautioning Israeli citizens against an active voice-phishing (vishing) campaign designed to harvest personal credentials under the guise of official Google security alerts.

maximize-image
images-count1+
אילוסטרציה | נוצר באמצעות AI

According to reports logged by the directorate, citizens across the country have received automated calls delivered in English, purporting to originate from Google’s global customer security apparatus. The recorded message warns recipients that unauthorized changes were made to their private profiles: “Google security notification. We have detected a change in your phone number on your Google account. The activity appears to originate from Tehran, Iran.” The automated system then directs the recipient to press 1 on their telephone keypad if they did not authorize the change, instructing those who recognize the activity to take no further action. Cybersecurity specialists noted that the campaign relies on acute psychological leverage—specifically public sensitivity to hostile Iranian cyber warfare—to induce immediate panic and push targets to press numbers, transfer to malicious operators, or divulge critical authentication data.

The National Cyber Directorate made clear that receiving such a telephone call is not proof that the user’s Google account has been compromised or that unauthorized access from Iranian territory took place. The agency advised the public to adopt immediate defensive protocols: hang up at once, refrain from pressing any keys on the keypad, and refuse further communication with the calling party. Officials also reiterated standard digital hygiene rules: never disclose account passwords, two-factor authentication codes sent via SMS, or approve on-screen security prompts that the account owner did not initiate.

maximize-image
images-count1+
Iran hacker | Photo: Nati Shohat, Flash90

Users with genuine concerns about their account status are instructed to check their security settings independently by accessing the official Google app or website, rather than relying on phone numbers, prompts, or callback links provided during suspicious interactions. The National Cyber Directorate urged anyone who encountered this robocall campaign—especially those who pressed digits or shared sensitive personal information—to dial the national cyber emergency hotline at 119 to report the incident and get immediate technical guidance.

The bottom line: Got a call warning about suspicious activity from Tehran? Don’t press any numbers, hang up, and check your account directly with Google.