Damn I assumed google customer reps couldn’t do that without verifying. How do you even protect from that? Besides not using one account for everything
Edit: I assumed porting out scam too but what confuses me about it was that his carrier line was still actively recieveing SMS and my understanding is that after a port out, the old sim becomes invalid/not working.