Google Ad Scams Target Users With Fake Business Logins

The FBI’s Internet Crime Complaint Center has issued a warning about a growing scheme involving paid search advertisements. Criminals are buying ads that mimic well-known businesses to direct users to fraudulent websites. These fake pages are designed to capture passwords and financial details, granting attackers full access to victims' accounts.

The exploit relies on a common user habit: searching for a company name and clicking the first prominent result without verifying the destination. A familiar logo or business name does not guarantee authenticity. Scammers replicate legitimate web pages and often use domain names with minor spelling errors or misplaced letters.

The FBI advises consumers to inspect the web address before clicking any advertisement. Users should look for misspellings or domains that differ from the company's verified URL. While search ads are not automatically fraudulent, a sponsored placement should not replace a manual check of the destination site. Pressure to act immediately is another indicator of a scam. A page claiming an account requires urgent attention often aims to rush users into sharing information before they can verify the request.

Payment methods can also reveal a trap. The Federal Trade Commission warns against sellers who insist on bank transfers, wire transfers, cryptocurrency, payment apps, or gift cards. For banking and other sensitive accounts, it is safer to type the verified website address directly into the browser or use a bookmark created from the legitimate site. Multifactor authentication provides protection beyond a password, but it does not secure a fake login page. Attackers may also try to obtain one-time security codes by posing as bank employees or technical support staff.

If a request seems incorrect, contact the company using independently verified contact information. To flag a suspicious Google advertisement, users should open the ad's More or Info menu and select Report ad. Google’s reporting instructions require completing a form to submit the complaint.

Those who entered credentials on a fraudulent site should reset the affected passwords immediately. If financial accounts may be compromised, contact the bank without delay. Victims can also report scams through the FTC’s fraud-reporting website.