The scammers used realistic imitations of official Google phone numbers and email addresses, called “spoofing”