How scammers use Google to lure victims

Savers, people facing a debt crisis and even victims of road-traffic accidents are being routinely misdirected by unscrupulous and scam adverts on Google that sit above genuine search results, Which? is warning.

Our investigation found an array of untrustworthy and outright scam adverts spanning much of the financial services sector, with many posing as legitimate charities and financial firms to trick victims out of money or personal details.

In one case, con artists posing as insurance and investments giant Aviva duped a victim into investing £160,000 in fake bonds - although Which? later helped her recover the money.

Read on to find out what to look out for, and how to stay safe when browsing.

• Sign up to free scam alerts to get the latest on emerging scams, how to avoid them and the steps to take if you've lost money.

How Google search works

With an estimated 85-90% of the global search engine market share, Google influences billions of our buying decisions every year.

In the case of 'organic' search results, Google's notoriously complex and ever-evolving algorithms are designed to select the sites that look most trustworthy and have the greatest relevance to our search term (for example, 'debt advice'). Sites that try to game the system - perhaps by repeating keywords far more than is natural - are viewed as less trustworthy, and filtered out of the top positions.

You might assume that the results considered most authentic would always sit in prime position at the very top of your screen. Yet frequently they don't.

That honour is instead reserved for up to four 'pay-per-click' (PPC) adverts, which allow advertisers to pay Google for the privilege of circumventing some of its complex rules and appearing first in our line of sight when we search particular terms.

This option is used legitimately by many law-abiding advertisers. But there is widespread concern that it's being routinely exploited by scammers and rogue operators across a range of financial services.

Scammers running riot

Our own research has found extensive evidence of scams being perpetuated through Google PPC.

In July, we revealed how we were able to create and advertise two fake companies - Remedii, a water brand, and Natural Hydration, an online service offering pseudo health and hydration advice.

Our ads for both fake businesses were approved by Google in less than an hour and garnered nearly 100,000 views in a month.

Since then, we've turned our attention to financial services scams and uncovered investment sites that snatch victims' life savings under false pretences.

Perhaps most egregious of all are the impostor adverts that lie in wait for people facing problem debt.

Those searching for leading debt advice charities, such as StepChange, are being routinely misdirected by copycat advertisers with similar names and far less scrupulous business practices.

Google has now been forced to acknowledge the problem, announcing a number of schemes to vet advertisers.

Its debt advert verification scheme, launched with fanfare in October 2019, is designed to ensure that those promoting debt-relief services are either licensed insolvency practitioners, or authorised by the Financial Conduct Authority (FCA).

However, two leading debt charities told us that they were once again seeing problem ads at more or less the same rate as before.

Savers caught out by ads for high-risk products

In October 2019, we reported on the problem of Google searches for simple savings products, such as 'best cash Isa', leading people to firms offering complex, high-risk investment products such as mini-bonds. Many of these results were Google PPC ads.

The FCA temporarily banned mini-bond ads at the start of 2020 - a ban that has since been made permanent.

Despite this, the regulator spent more than £180,000 on its own Google ads between late January and late March, according to figures obtained by The Telegraph.

The purpose of these was to counter-advertise to would-be savers and investors faced with an onslaught of high-risk or scam 'investment opportunities'.

In June, FCA executive director of enforcement Mark Steward told us the regulator was still paying Google to publish its information ads, branding the situation 'ironic'.

• Find out more: how to find the best savings account

Beware the bank impostors

We've found that search results for common savings terms such as 'top Isa', 'best bonds' and 'best fixed rate bonds' continue to be dominated by dubious ads for 'investment finder' services.

After filling in a form on a site called fixedrates4u.com, we got an email purporting to come from SGZ Bank Ireland, part of the German DZ Bank group. The email urged us to click a link to the website sgz-bank.com, which included a link to an entry in the FCA Financial Services Register for SGZ-Bank Ireland PLC, adding a sense of legitimacy.

But, rather oddly for a decades-old international bank, we found the webpage had been registered just a month earlier.

We contacted parent bank DZ in Germany. A spokesperson said the SGZ Bank Ireland part of its operations had been closed for years, and the website was 'clearly a scam'.

Shortly after, the rogue website was taken down and a warning appeared on the FCA's register.

If you're keen to invest in a firm, look it up on the FCA Financial Services Register to see if there are any scam warnings in place. You should then contact the firm using the contact details on the register to check what you've been told by its alleged representatives.

Some schemes are unregulated and may not appear on the register. Unregulated firms aren't necessarily a scam, but are unprotected by the Financial Services Compensation Scheme, so are high risk.

Tricked by an Aviva impersonator

We spoke to one victim, Hannah (not her real name), who lost £160,000 after clicking on a Google ad for an 'Aviva' investment scheme.

Hannah took steps to ensure it was genuine. She checked the FCA's Financial Services Register for Aviva and found no impersonation warnings (although one appeared just days later).

The fraudster she was in contact with had assumed the name of a bona fide Aviva employee, who Hannah looked up on LinkedIn and Aviva's official website.

After we emphasised Hannah's due diligence efforts to her bank, it decided she wasn't to blame and reimbursed her in full under the terms of the authorised push payment scams voluntary code.

• Find out more:how to get your money back after a scam

Car insurance 'click-to-dial' scams

Other examples of dubious Google ads include those from claims management companies (CMCs) taking advantage of stressed-out drivers by making them think they're talking to their genuine insurer.

In reality, their details are passed onto numerous third-party companies and drivers can find themselves owing thousands of pounds for services that would have been covered and paid for by their genuine insurer.

One victim, Alastair, unwittingly fell into the hands of crooks after clicking on the first ad when searching for the phone number of his insurer's claims department. After being passed through three or four people on the call, he became suspicious and refused to co-operate.

Since then, Alastair has received hundreds of calls from firms urging him to make bogus personal injury claims.

In 2019, the Insurance Fraud Bureau received more than 300 reports of this type of scam operating on search engines, but it believes this figure 'only begins to scratch the surface, as many people may not realise their claim was misdirected'.

In July, Which? Money searched for terms including 'Admiral claims number', 'NFU phone number' and 'Aviva claims department'. Many results were topped by adverts for third-party websites referring to themselves as the 'official claims line' and 'claims department'.

Thankfully, it's easy to avoid this type of scam. Find your insurer's claims number on your policy documents and save it into your phone, so you have it handy at the roadside if the worst happens.

Dubious debt advice ads

Debt charities are bracing themselves for a surge of inquiries this autumn from those struggling with problem debt.

This makes it even more worrying that those turning to Google to find trustworthy, unbiased debt help are being routinely misdirected by 'lead generator' ads imitating leading debt charities.

They encourage them to submit personal details that are then sold to Insolvency Practitioners (IPs). Victims are then contacted and pushed to take often-unsuitable Individual Voluntary Agreements (IVAs) - legally binding debt repayment plans.

While they can be an appropriate solution in some circumstances, they are a very serious step. IPs can charge large fees for arranging IVAs, which are added to your overall debt, and entering an IVA could bar you from certain jobs.

We found suspicious lead generator ads when searching for 'StepChange' that appeared to mimic genuine ads from the debt charity and its official URL.

Google has since removed ads for stepchanging.org.uk, but StepChange told us that ads from stepchanging.co.uk had cropped up in its place.

The charity explained: 'It's just like the good old days of cat and mouse before Google's u201cpolicy changeu201d last November around debt services advertising. This improved things for a while, but recently we've seen a resurgence in bad practice.'

If the worst happens and you find yourself in problem debt, you can seek comprehensive and trustworthy advice by going direct to Citizens Advice, StepChangeor National Debtline. You can also speak to the free and impartial Money Advice Service.

Adverts for organisations with similar names are best avoided.

Advertiser verification

Google has announced plans to verify all advertisers on its platform to help tackle fraudulent activity, and says that 'protecting users from scam ads is a key priority.'

Working with the FCA, it introduced a verification programme for advertisers promoting financial services and products in July, which it says 'will allow us to gain more information about the advertisers' identity, business model and relationships with third parties, so users can trust the ads they're seeing.'

However the wider programme to verify all advertisers is currently only applied to advertisers registered in Canada, India, Russia, Ukraine and the United States.

Under the new rules, advertisers promoting financial services or products now have to submit documentation to verify their legal identities. However, these advertisers have 21 days to submit documentation, during which time their ads will remain live. Which? is concerned this grace period will be exploited by scammers.

Google told Which? this grace period will be removed for some users from September, but did not explain how these users will be identified.

Stronger measures needed to tackle rogue ads

Which? believes all advertisers should be verified before their ads are published and is calling for Google to prioritise removing this grace period for advertisers promoting financial services or products.

The wider verification programme for all advertisers, which will give them a 30-day grace period, will be rolled out in phases, but in the interim Which? is calling for Google to introduce clear and transparent labels for ads listed by unverified advertisers, so consumers can consider the risk and trustworthiness of an ad before clicking on it.

Which? is also calling for fraudulent content that leads to scams to be included in the scope of the government's Online Harms legislation to give online platforms more responsibility for harmful content and activity on their sites.

This would require tech companies such as Google to have in place better controls to prevent fake adverts from appearing and take them down swiftly when identified or reported.