Fake Google Ads Steal Logins: FBI Warns

Scammers are purchasing search advertisements that mimic established businesses to funnel users to counterfeit websites. The FBI’s Internet Crime Complaint Center reports that these pages capture passwords and financial data, allowing criminals to seize control of victims’ accounts.

The scheme relies on users typing a company name into a search engine and clicking the first prominent result without verifying the destination. A familiar logo or business name on a page does not confirm ownership. Attackers replicate legitimate layouts and use domain names with minor spelling errors or misplaced letters.

The FBI advises checking the web address before clicking any sponsored link. Users should look for misspellings or domains that differ from the company’s verified address. Search ads are not automatically fraudulent, but a sponsored placement is not a guarantee of authenticity.

Urgency is a common tactic used to rush victims. A page claiming an account needs immediate attention may pressure users to provide information before they verify the request. Payment instructions also serve as red flags. The Federal Trade Commission warns against sellers who insist on bank transfers, wire transfers, cryptocurrency, payment apps, or gift cards.

To protect sensitive accounts, users should type the verified website address directly into their browser or use a pre-saved bookmark from the legitimate site. Multifactor authentication adds a layer of security beyond a password, but it does not make a fake login page safe. Criminals may also try to obtain one-time security codes by posing as bank employees or technical support staff, according to the FBI.

If a page seems incorrect, contact the company using independently verified contact information. To flag a suspicious Google advertisement, open the More or Info menu, select Report ad, and complete the form. If credentials were entered on a fraudulent site, reset the affected passwords and contact the bank immediately if financial accounts are compromised. Reports can also be filed through the FTC’s fraud-reporting website.