Why is the top result in a search sometimes a scam?
Anyone can pay to sit above the real result, and criminals do. Why the top of a search page is the least trustworthy part of it, the four things they impersonate most, and the two habits that make it a non-issue.
- Difficulty
- beginner
- Time
- 20 min
- Read
- 7 min
- Safety
- caution
Short answer
Sponsored results are adverts, and buying one requires money rather than legitimacy. Criminals use them to place look-alike sites for banks, government services, software downloads and travel above the genuine result — and, worst of all, to place fake customer service phone numbers where you will find them. Scroll past the sponsored block to the ordinary results, and get phone numbers from your card, your paperwork or the organisation's app rather than from a search.
Everyone has been taught to distrust links in emails and messages. Almost nobody has been taught to distrust the top of a search page, and it is now one of the more reliable ways to reach a victim, because searching for something is an act of intent — the person has decided they want a bank's website or a piece of software, and is looking for it, which is a far better position for a criminal than an unsolicited message. The mechanism is not a hack. It is the advertising system working exactly as designed, sold to someone whose ad copy and landing page are convincing enough to pass review, and the review is imperfect and operates at enormous scale. Consumer organisations in the UK have reported on this repeatedly and platforms remove such adverts continuously, which tells you both that it is taken seriously and that it keeps happening.
Safety
Step by step
- Learn to see the sponsored block as a distinct part of the page.Search engines label paid placements — the word is usually sponsored or ad, in small type near the top of each result. Everything in that block is there because someone paid, and nothing about it indicates that the advertiser is who they claim. The ordinary results below are ranked by the search engine's own judgement of relevance, which is not a guarantee either but is not for sale in the same way.
- Know the four categories that are targeted hardest.Customer service telephone numbers, which is the most damaging. Financial services, where a look-alike login page harvests your credentials. Software downloads, where the file carries something extra. And travel, tickets and government services, where a fee is charged for something that is free or cheaper direct. If your search falls into one of those, treat the sponsored block as hostile by default.
- Never take a phone number from a search.This is the single most important habit here. A fake support line puts a person on the phone with a criminal who then talks them through granting remote access or moving money, and the victim rang them, which removes every instinct that would normally apply. Bank numbers come from the back of the card. Utility and council numbers come from a bill. Airline numbers come from the booking confirmation. Anything else comes from the organisation's own app.
- Reach important sites without searching at all.Bookmark your bank, your energy supplier, HMRC and anything else that matters, and use the bookmark every time. It takes ten seconds to create and it removes the entire category of risk for the sites where the risk is highest. Typing the address you know is the second-best option.
- Check the address before you type anything, not after.Look at the domain — the part immediately before the first single slash — and read it right to left. UK government services end in gov.uk. A bank's site is the domain printed on your statements. Small changes, extra words, unusual endings and hyphenated versions are the whole technique, and the catalogue's guide on reading a web address covers how to do this properly.
- Be suspicious of a fee for something official.A great many of these adverts are not outright fraud but paid-for form-filling services sitting above the official page, charging for a passport renewal, a licence application or an entry authorisation you could do yourself for less. They are often technically legal and always poor value. Reaching gov.uk directly avoids all of them.
- Download software from the maker, and only from the maker.Search for the product and go to the developer's own site through the ordinary results, or better, use the operating system's own store. The catalogue has a guide on downloading software safely, and this is the single most common way an ordinary person acquires something malicious.
- Consider a reputable ad blocker as a structural fix.It removes the sponsored block from the page entirely, which removes the decision. A well-established blocker from a publisher you can identify is a reasonable defensive measure — and the catalogue's guide on browser extensions explains how to choose one without introducing a different problem.
- Report what you find.Search engines have a route to report a misleading or fraudulent advert, and in the UK scam adverts can be reported to Action Fraud and, for financial promotions, to the FCA. Reporting is what gets an advert pulled for everyone else, and the catalogue's guide on reporting a scam covers where to send what.
Common mistakes
- Trusting the first result because it is first — Position at the top of a search page can be bought. It measures spending, not legitimacy, and criminals have budgets.
- Ringing a number found by searching for a company's helpline — It is the most costly version of this and it inverts every warning people have absorbed, because they made the call. Numbers come from your card, your bill or the official app.
- Checking the site looks right rather than checking the address — The appearance is copied wholesale and costs nothing to reproduce. The domain is the only part that cannot be faked, and it is the part people do not read.
- Assuming a padlock means the site is genuine — It means the connection is encrypted, which criminals arrange as easily as anyone else. It has never meant the site is honest, and the catalogue's guide on certificate warnings explains what it does mean.
If it doesn't work
You clicked a sponsored link and are unsure what it was
Cause: A convincing look-alike — Fix: Do not enter anything. Close the tab, then reach the real site through a bookmark and check your account there. The catalogue's guide on what to do after clicking a suspicious link covers the rest.
You entered a password on a site you now doubt
Cause: A credential-harvesting page — Fix: Change that password immediately from a device you trust, starting with your email if the same password was used there, and turn on two-factor authentication. Then check the account for changes to contact details and payees.
You rang a number from a search and they asked to connect to your computer
Cause: A fake support line — Fix: Hang up. Do not install anything and do not read out any code. The catalogue's guides on tech support scams and on having given someone remote access set out exactly what to do next, in order.
You paid a fee for a government service that turned out to be free
Cause: A copycat service above the official page — Fix: Contact your card provider about a chargeback and read the terms you agreed to. Then go to gov.uk directly and complete the real application. Many of these services are legal, so a refund is not guaranteed.
You downloaded software and your browser now behaves oddly
Cause: A bundled or malicious installer — Fix: Follow the catalogue's malware removal and browser hijack guides, and audit your extensions. Then reinstall the software from the developer's own site if you still want it.
The genuine site is nowhere near the top of the results
Cause: Sponsored placements above it, or a common brand name — Fix: Add a distinguishing word to the search, or go to the address you know directly. Being unable to find the real one quickly is itself a reason to slow down.
Questions people ask
Why do the search engines allow this?
They do not allow it deliberately; adverts are reviewed and fraudulent ones are removed continuously, at a scale where some get through and where advertisers actively work to evade the checks. The practical conclusion for you is the same either way: the sponsored block cannot be relied on, whoever is responsible.
Is this the same as a phishing email?
The end goal is the same and the delivery is different in a way that matters. A phishing email arrives uninvited, which puts people on guard. A search advert is found by someone actively looking, which removes that guard entirely — which is why it works on people who would never click a link in a message.
Does it happen on other platforms too?
Yes. Sponsored posts on social media are used the same way, particularly for investment scams, fake shops and ticket fraud. The catalogue has guides on each of those, and the same principle applies: verify the destination independently of the advert.
Is an ad blocker a security tool?
Partly. Blocking adverts removes both the fraudulent ones and the malicious advert scripts that have historically been used to attack browsers. It is a reasonable layer, provided you choose a well-known one — the extension itself has extensive access, which is the trade covered in the extensions guide.
What should I do if I think an advert is fraudulent?
Report it through the search engine's own reporting link on the advert, and report the scam to Action Fraud. Financial promotions can also be reported to the FCA. The catalogue's guide on reporting a scam sets out which body handles what.