Search engine ad spoofing and phishing scams

Cybercriminals are utilizing fraudulent advertising keywords on search engines to direct users toward spoofed websites. These malicious links often appear as top sponsored results, mimicking the logos, colors, and professional appearance of legitimate banks and companies to steal credentials or facilitate unauthorized transactions.

In one instance, a company identified a fraudulent site after a customer reported a failed order, noting the fake page occupied the top position on Google via sponsored ads. In another case, banking experts highlighted the difficulty in distinguishing these sites from authentic ones, noting that scammers use brand names as keywords to ensure visibility.

Security experts and organizations, such as the National Cyber Security Centre and INCIBE, recommend that users scrutinize web addresses for unusual characters and avoid approving mobile authentication requests unless they have personally initiated a transaction. Recommended responses for affected entities include reporting deceptive advertisements to search engines, contacting domain registrars, and implementing reinforced brand monitoring.