Fake Insurance Ads That Trick You Into Giving Up Your Login Code

You search for car insurance. An ad at the top of Google looks exactly like the company you already pay every month. You click it, sign in, and a code arrives on your phone the way it always does. You type it in. By the time you finish typing, someone else is already inside your account.

This is not the old kind of password theft where a criminal collects your details and tries them days later. Everything in this scam happens live, in the few seconds while you are still sitting at your screen. And the one-time code you were told would protect you is the very thing the criminal needs most.

I am Nitesh Kumar Gupta, founder and editor of The Scam Exposed. In this guide I walk through how these fake insurance ads work, why the usual advice does not stop them, what the security research says, and the two habits that remove the danger almost completely. If you only remember one sentence, make it this one: a real code on your phone does not prove the page asking for it is real.

In this article (15)

1. How the attack works
2. How big the problem is
3. Why the ad is the weak point
4. Why your one-time code fails here
5. A typical case, step by step
6. Red flags to watch for
7. Real login vs relay page
8. What actually stops it: passkeys
9. How to protect yourself
10. Signs your account was taken over
11. If it already happened
12. Quick quiz: scam or not?
13. FAQ
14. Help us warn others
15. How we researched this article

How the attack works

Security professionals call this technique adversary in the middle. The fake page is not a copy sitting on its own server waiting for you to make a mistake. It is a live relay. Every keystroke you enter is forwarded to the genuine website in real time, and every response the genuine website sends comes back through the relay to you. To you it feels like logging in normally. To the insurer it looks like you logging in normally. The criminal sits quietly in the middle, watching everything pass through.

Step 1: The ad

You search for your insurer, your bank, or a price comparison site. At the very top of the results is a sponsored listing. The name looks right, the description looks right, and sometimes even the displayed address looks close to right. Criminals buy these placements the same way any business does.

Step 2: The lookalike login page

You land on a page built to look identical to the real sign in screen. Same logo, same colors, same layout, same help links. Because the relay is pulling content from the real site, it can look perfect in every detail. The only clue is the web address, which most people never check on a page they reached from a search.

Step 3: Your username and password

You type your details. The relay immediately submits them to the genuine site. There is no delay that would make you suspicious, because the real site is actually processing the login.

Step 4: The genuine code

The real insurer sees a correct password and does exactly what it should. It sends a one-time code to your phone. As far as the insurer can tell, you are the one logging in, and in a sense you are.

Step 5: The handover

The fake page asks for that code. You have just received a real code on your real phone, from your real insurer, so it feels completely legitimate. You type it. The relay uses it within seconds and captures what is called the session, the digital pass that keeps you logged in. The criminal now has that pass. They do not need your password again, and they do not need another code. They are simply in.

Nothing about your behavior in that sequence was careless. You searched for a company you trust, you received a genuine code from that company, and you entered it into a page that looked correct in every visible way. That is exactly why this attack is so effective, and why the answer has to be a change of habit rather than trying harder to spot a fake.

This is not a small or rare problem

For years this kind of relay attack required real technical skill. That has changed. Security researchers at Sekoia have documented commercial phishing as a service kits built for exactly this job. Their research on Tycoon 2FA tracked more than 1,200 domains tied to that one kit, and they have also detailed Sneaky 2FA, which was advertised for about $200 a month. A criminal no longer needs to build anything. They rent a kit, pick a brand to copy, buy some ads, and start collecting sessions.

The scale matches that ease. Between April 14 and 16, 2026, Microsoft's Defender Research team observed a single adversary in the middle campaign aimed at more than 35,000 users across over 13,000 organizations in 26 countries, with 92% of targets in the United States. That campaign was delivered by email, using fake workplace compliance notices rather than search ads, but it relied on the same live relay technique described above and shows how quickly it can scale.

The FBI issued a public warning on May 21, 2026 about a platform called Kali365, which targets Microsoft 365 accounts. The FBI says the kit lowers the barrier of entry, giving less technical criminals access to AI generated lures, automated campaign templates and live tracking dashboards. Kali365 works slightly differently from a relay page: it abuses Microsoft's genuine device code sign in page to capture access tokens. We include it because it shows the same trend, cheap subscription kits that defeat ordinary codes. What once took a skilled team is now a subscription anyone can buy.

Why the advertisement is the weak point

Most advice about phishing says to check the link before you click. That advice assumes the link arrived in an email from a stranger. Here the link arrives at the top of a search results page, in the position people trust most, on a website people trust completely. You were not tricked into visiting a strange site. You searched for your own insurer and clicked the first result.

Insurance is an especially attractive target for three reasons. First, people search for insurers by name all the time, to pay a bill, file a claim, or print an ID card, so there is constant traffic to intercept. Second, insurance accounts hold a gold mine of personal data: full name, home address, date of birth, driver's license number, vehicle details, and often bank information for automatic payments. Third, people rarely log in to their insurer more than a few times a year, so they do not remember exactly what the real page looks like or what address it lives at.

Phones make the problem worse. On a small screen the sponsored results can fill the entire first view, and the web address bar is often shortened or hidden while you scroll. Someone using a phone may never see a single organic result before tapping. The same trick is used in social media ads, which we covered in our guide on how to check any sponsored post before you buy.

The habit that fixes this is simple. Never use ads to reach a login page. Scroll past the sponsored results to the ordinary listings below, or better, type the address yourself, use a bookmark you saved, or open the official app you already installed. If you never meet a login page through an ad, you never meet the relay.

Why your one-time code no longer protects you

This is the uncomfortable part, and it is worth being precise about it. Text message codes, authenticator app codes and push notification approvals all share one weakness. They prove that you have your phone. They do not prove which website you are typing into. A relay does not need to break any of them. It waits for you to complete them correctly, then takes the result.

That does not make two step login pointless. Far from it. Two step login still blocks the great majority of ordinary account takeovers, the kind where a criminal tries a leaked password from a data breach. Turning it off would be a serious mistake. It simply is not enough against this specific attack, where you are guided to hand over the code yourself, in real time, to a page that looks right.

The Cybersecurity and Infrastructure Security Agency makes the same distinction in its fact sheet on phishing resistant MFA. It describes any form of MFA as better than none, but calls phishing resistant MFA the strongest option and points to FIDO/WebAuthn as the most widely available version. A passkey is the phishing resistant method most ordinary people can turn on today.

A typical case, step by step

The following is a typical case built from the pattern described in the research above. It is not a specific real person, but every step matches how these relay attacks unfold.

A retired teacher in her sixties wants to print a new auto insurance card before a road trip. She searches for her insurer's name on her phone. The first result is a sponsored ad with the insurer's name in bold. She taps it and sees the familiar blue and white login screen. She types her email and password. A text arrives with a six digit code, exactly as it does every time she logs in. She enters it and the page shows a loading circle, then a message that the site is busy and she should try again later.

She shrugs, closes the browser, and opens the official app instead, where the card prints fine. She thinks nothing of it. Two weeks later her insurer emails to confirm that her mailing address and bank account for refunds have been changed. She did not change them. By the time she calls, a fraudulent claim refund has already been routed to an account she has never heard of, and her personal details have been copied for use elsewhere.

Notice what happened. She was never asked for anything unusual. The criminal used her genuine login and genuine code during those few seconds of the loading circle, then quietly made changes in the account days later when she was not looking. The busy message was a cover story to get her to leave.

Red flags to watch for

• You reached the login page through an ad. This alone is enough reason to close the tab and start again from a bookmark or the app.
• The web address is slightly off. Extra words like login, secure, verify or account added to the brand name, a different ending such as .net or .co instead of .com, or swapped letters.
• An error appears right after you enter your code. A message that the site is busy, timed out, or needs you to try later is a common way for a relay to send you away after it has what it needs.
• You are asked to log in twice. Some relays ask for the password again or a second code. A real site rarely does this on a single login.
• Your password manager does not offer to fill in. Password managers match saved logins to exact web addresses. If yours stays silent on a page you have used before, the address is probably wrong.
• The code text mentions something you did not expect. Many code messages say what they authorize. A code for adding a device or changing details when you only meant to view a bill is a warning.
• A sign in alert arrives from an unfamiliar place. If your provider emails about a new device or location minutes after you logged in, take it seriously.
• You feel rushed. Pages with countdown timers, urgent policy lapse warnings, or claim deadlines are designed to stop you thinking.

Real login vs relay page

What actually stops it: passkeys

One thing reliably stops this attack, and the reason is structural rather than a matter of being careful. A passkey is a sign in method that replaces your password with a secure key stored on your phone or computer, unlocked with your fingerprint, face or device PIN. Crucially, a passkey is cryptographically tied to the genuine website address it was created for.

On a fake page, the passkey simply does not appear. Your phone looks at the address, sees it is not the real insurer, and offers nothing. There is no code to relay, because there is no code. The relay's whole design depends on you typing something it can pass along. A passkey gives it nothing to pass.

One caution: this protection is specific to relay pages. A different trick, the device code scam described in the FBI warning above, asks you to type a code from an email into a genuine Microsoft page. Never enter a device code you did not request yourself.

Google, Microsoft, Apple, Amazon and PayPal all support passkeys now, and banks and insurers are steadily adding them. When a site offers one, take it. Look for an option called Create a passkey, Sign in with a passkey, or similar, usually in the security or login settings of your account. Setting one up takes about a minute and you can usually keep your password as a backup.

How to set up a passkey in plain steps

1. Log in to the account the normal safe way, through the app or a bookmark.
2. Open Settings, then Security or Login and security.
3. Choose Create a passkey or Add a passkey.
4. Confirm with your fingerprint, face or phone PIN when asked.
5. Next time you log in, choose the passkey option instead of typing a password.

If your insurer does not offer passkeys yet, it is worth asking their customer service when they will. Companies add features customers ask for.

How to protect yourself

1. Bookmark the sites that hold your money and identity. Insurer, bank, retirement account, email. Use the bookmark every time and you never meet a fake login page.
2. Use the official app when there is one. Apps go straight to the real service and cannot be redirected by a search ad.
3. Scroll past sponsored results. If you must search, use the ordinary listings underneath, and still check the address before signing in.
4. Use a password manager. It acts as an address checker. If it will not fill in, stop and look closely.
5. Read the code message before you type it. If it mentions a login you did not start, a new device, or a payment, stop.
6. Turn on login alerts. Many providers email you when a new device signs in. It will not prevent the attack, but it tells you within minutes rather than weeks.
7. Turn on passkeys wherever offered. This is the one step that removes the relay attack entirely.
8. Keep two step login on. It is not enough against relays, but it still blocks most other account takeovers.
9. Talk to older relatives. One sentence works: use the app or the bookmark, never the ad.

For a wider look at how phishing tricks people in 2026, see our guide to spotting fake bank, Amazon and IRS emails, and our report on phishing pages hosted on trusted cloud services. We also covered how misleading search ads cost consumers money in the Doxo settlement story.

Signs your account has been taken over

Because the criminal logs in as you with a valid session, there is no broken password to alert you. You can still type your old password and get in, which makes people assume everything is fine. Watch for these signs instead:

• An email saying your contact details, address or password were changed when you did not change them.
• A sign in alert from an unfamiliar location or device.
• Emails disappearing from your inbox, which happens when a criminal sets up a rule to hide alerts.
• A claim, policy change, refund request or payment you did not make.
• New bank details for refunds or payouts on your insurance account.
• Calls from your insurer asking to confirm a change you know nothing about.

If it has already happened

First, deal with the account itself. These steps cut off the criminal's access:

Then, if money or personal data is involved, take these steps:

1. Call your bank or card issuer right now using the number on the back of your card. Ask them to block the card, stop or reverse any pending payment, and flag the account for fraud. Speed matters more than anything else.
2. Report it to the FTC at ReportFraud.ftc.gov. Your report goes into the Consumer Sentinel database used by law enforcement across the country.
3. Report it to the FBI at IC3.gov, especially if money was taken. Include dates, amounts, phone numbers, links and screenshots.
4. If personal details were exposed, create a recovery plan at IdentityTheft.gov and consider a free credit freeze with Equifax, Experian and TransUnion.
5. If you are 60 or older, or helping someone who is, call the National Elder Fraud Hotline free at 1-833-372-8311. A case manager can walk you through every report.
6. Keep a written log of every call, text, website and payment. Banks and investigators move faster when the facts are in one place.

Our guide to the first 48 hours after a scam covers what to say when you call your bank and how dispute deadlines work.

Quick quiz: scam or not?

You search your insurer's name, tap the top sponsored result, and the login page looks perfect. Is it safe to sign in?

Treat it as unsafe. Relay pages can look perfect because they copy the real site live. Close the tab and use your bookmark or the official app instead. If the page was real, nothing is lost.

You open your insurer's app, sign in, and get a text code. Should you enter it in the app?

Yes, this is normal. You reached the login by yourself through the official app, so the code is going to the real service. The danger is entering codes on pages you reached through ads or links.

Right after you enter a code, the page says the site is busy and to try again later. What now?

Act as if it was a scam. This is a common relay trick. Open the real app or bookmark, sign out of all devices, change your password, and check for changes on the account.

Frequently asked questions

Help us warn others

Got this call or message? Search the number on The Scam Exposed and leave a comment on its page to warn others. Every comment helps the next person who looks that number up before calling back.

Share this with a parent or grandparent. A two minute read today can save a family thousands of dollars tomorrow. Scammers count on people not talking about this, so talking about it is one of the best defenses we have.

How we researched this article

This article draws on public warnings and guidance from the FBI IC3 public service announcement on Kali365, the FTC's consumer advice on how to recognize and avoid phishing scams, and CISA's fact sheet on phishing resistant MFA. Campaign figures come from Microsoft Defender Research, as reported by Help Net Security, and kit details come from Sekoia research, as reported by Infosecurity Magazine and The Hacker News. The typical case is a composite that shows the common pattern, not a specific person. We update this guide when new warnings appear.

This article is for general information and awareness only. It is not legal, financial or security advice for your specific situation. If you think an account has been compromised, contact the company directly using contact details you already trust, and report losses to the FTC and IC3.