How to Lose a Fortune with Just One Bad Click

I must have missed it, but I don't understand how it worked just from clicking "yes, it's me". They must've already hacked the email accounts prior to starting all this? That part wasn't clear to me from the article, or was it stated somewhere?

 

To be honest, I also didn't understand everything. But I don't use mobile phones a lot, which is probably a good thing.

 

This is a great example that sensitive financial data should never be stored in the cloud or on your PC/phone, for that matter.

 

Indeed.

I'm still missing something from the process. I guess I'm not familiar with Google Photos in the cloud. Was the photo accessible to anyone? How did the scammers know his phone number to call in the first place? And how did they trigger the "it's me" notification on his phone, unless they already had access to his account? It seems like there's a piece missing, where his account was already compromised somehow, it wasn't just "out of the blue".