Scammer bypasses Google search as verified advertiser

Google’s advertiser vetting process has been abused by scammers to achieve ‘verified status’ and target the public with worryingly convincing fake adverts. 

For years, Which? has shared concerns about the pervasiveness of malicious advertisers on search engines and social networks, calling out tech giants for failing to spot repeat offenders and taking ad money from known investment scammers. 

At the end of 2023, we warned about phoney search engine ads for impersonating legitimate parking apps such as JustPark and PayByPhone, which remained live even after we reported them. 

Malicious adverts are usually created by unverified advertisers, but now there is evidence of scammers abusing Google’s platform as verified advertisers. 

Read on to find out what these fake ads look like.

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Sign up for scam alerts

Scam advertiser passes Google's checks 

Google has taken steps to combat fraudulent ads, including launching an advertiser identity verification process. 

When you come across a verified advert, you can click the three dots (known as an ellipsis) to learn about the advertiser behind it. This information is aimed at reassuring the public that they're dealing with a company they can trust. 

But search marketing security firm Marcode – which monitors adverts running on brand keywords across various search engines and social networks – alerted Which? to a rogue advertiser that had been verified by Google as ‘Vodafone Finance Management’, sneakily named as a subsidiary of Vodafone on Companies House, despite having nothing to do with it. 

Scammers have been able to convince Google that they are legitimate, leaving the door open for them to publish persuasive ads appearing at the top of search listings. 

What did the fake ads look like?

Over the course of three days in late January, this verified advertiser was paying Google to appear at the top of results when the public searched for phone network Lyca Mobile. 

You would have had little reason to suspect these adverts at first glance. 

They appeared to link to the genuine web address for Lyca Mobile (lycamobile.co.uk), although the keenest-eyed may have questioned the use of ‘Lyc Mob’ in the blurb. 

Although Vodafone and Lyca Mobile are two separate companies, if you had checked the details of this advertiser, you may have been reassured that it was created by what appeared to be a genuine mobile network.

Clicking these ads would have redirected you to a convincing copycat website (liyciadmophile.eu) set up to steal your card details. 

Vodafone and Lyca Mobile respond

We contacted Vodafone and Lyca Mobile. 

A spokesperson for Vodafone told Which?: ‘Criminals are always looking for new ways to trick companies and consumers, and our ecommerce security teams work hard to stay ahead of them. We take fraud extremely seriously and have reported the issue to Google for immediate resolution and to stop this happening again. We also want to clarify that Vodafone UK has no affiliation with Lyca Mobile.’

A spokesperson for Lyca Mobile said: 'Unfortunately, this type of scam is all too common. We regularly get website impersonations of our brand closed down, and in this case the scam site in question was taken offline almost as quickly as it appeared. But we also have to rely on the platforms we operate on to prevent them occurring in the first place. We welcome moves by Google and others to crack down on this type of activity to protect both consumers and brands from malicious actors.'

• Read more: how to spot and report search engine ads

How did a scammer pass Google's checks?

Google rolled out its advertiser verification system to try to combat abuse of its platform, launching the 'Ads Transparency Center' to help users spot when an advertiser is not the authentic brand. But we think its processes need to be more robust.

It states that advertisers may be asked to provide documentation in order to become verified, yet appears only to confirm that the company details are legitimate, not that the advertiser has a relationship with that company. 

With company details easily found online by opportunistic scammers, we’re concerned that Google’s vetting process could put both consumers and businesses at risk. 

Google didn't confirm to Which? the steps it took to verify this particular advertiser, but a spokesperson told us: 'Protecting users is our top priority and we have strict ads policies that govern the types of ads and advertisers we allow on our platforms. We enforce our policies vigorously, and if we find ads that are in violation we remove them. We continue to invest significant resources to stop bad actors and we are constantly evaluating and updating our policies and improving our technology to keep our users safe.'

• Find out more: how scammers use Google to lure victims