The cryptocurrency theft occurred from a medical worker in Chicago. First, the scammers sent an email to the victim's address. Then they called his mobile phone. The credibility of the situation was given by the fact that the hackers used the official phone number of Google technical support. Also, the letter was made in the style and form of Google notifications and sent from the official Google mail.
The victim answered the phone call, in which she was told that her mail was compromised and in order to urgently change the password, she needed to enter a special confirmation code sent in the letter.
The victim doctor dictated the confirmation code to the scammers, and they were able to access his mail. There they quickly found a letter with a seed phrase, 12 words needed to enter the crypto wallet. This was easy to do by searching in the mail itself, since people who save passwords in their mail most often call such letters by words such as password, login, crypto, 12 words, and the like.
There is also a possibility that the mail was hacked by acquaintances of the victims. After all, they could have known about the existence of a crypto wallet and that he kept his secret phrases in his e-mail. In any case, this is a matter for the police.
We can only add that today, for an experienced fraudster, creating a fake letter is a trifling matter, 15 minutes. After all, there are a number of services that allow you to simulate sending a letter indicating any mail. But as for forging a phone number from which an alleged Google employee called, this is not an easy task. Perhaps the hackers had an accomplice in telephony, because forging a phone number is quite difficult.