How 602 Million Scam Ads Still Reached People in 2025

Google scam ads are supposed to be a solved problem. In its most recent Ads Safety Report, covering 2025, the company says its Gemini systems caught more than 99 percent of policy violating ads before they ever served. It blocked or removed 8.3 billion ads and suspended 24.9 million advertiser accounts.

Read further and a second number appears. Of those, 602 million ads and 4 million accounts were tied to scams. That is what was caught. It is also an admission of scale. When the failure rate is under one percent of a number that large, the remainder is still enormous, and every survivor is an advertisement a real person saw at the exact moment they were looking for help.

That report is the last full year of disclosed enforcement data available as this is published in September 2026. The figures below are therefore the 2025 record, read against what regulators and our own reader reports have seen since.

Why the auction rewards the scammer

Most people assume Google ranks ads by who pays most. It does not. It ranks by Ad Rank, which combines the bid with expected click through rate, ad relevance and landing page experience. A legitimate business optimises all four slowly and within a budget.

A scam advertiser has an advantage a real business cannot match. It has no customer acquisition cost to justify, no margin to protect and no brand to damage. It can bid far above what the keyword is worth, because the value of one answered phone call is measured in thousands of dollars rather than in a sale. It writes copy engineered purely for clicks, because it never has to deliver a product. Its quality signals look excellent to the system precisely because it is being dishonest.

This is why the highest risk queries are not the obvious ones. They are the queries people type when something has already gone wrong. A support number. A refund. A cancellation. A login problem. Those searches carry urgency, and urgency is what the scheme harvests.

How Google scam ads clear review

Advertiser verification is a genuine barrier and Google is right to call it one. It also has a known weakness. Verification confirms an identity at the moment of signup. It does not confirm that the identity still controls the account, and it does not confirm what the landing page will show next week.

The gap between those two moments is where cloaking in Google search ads lives. The advertiser submits a clean page. Review approves it. Once the ad is live, the server begins deciding what to show based on who is asking. Traffic that looks like a reviewer, a data centre address or an automated crawler sees the approved page. Traffic that looks like a person on a phone in a residential area sees something else.

Nothing about the ad changes. The copy in the account stays compliant. Only the destination behaves differently, and only for the people the operator wants to reach.

The simplest way to picture cloaking is a shop with two shutters. When the inspector walks in, the shelves hold exactly what the licence says they hold. The inspector signs off and leaves. The second the door closes, the back shelf comes out and the real business starts. Google's reviewer and Google's crawler are the inspector. They are shown a clean software page. The person who clicks the ad ten minutes later is shown the version with the phone number on it. Same URL, two different shutters, and the approval on file still says the shop was clean.

The same split screen technique appears outside search. Our guide on how social media ads hide scams covers the version that runs inside feeds, where the review surface and the delivered page diverge in exactly the same way.

The landing page is not the product

Here is the part that surprises people outside this industry. On most of these campaigns the landing page is not trying to sell anything or steal a password. It has one job. It has to make a phone number feel official for about eight seconds.

So it borrows the visual grammar of a real support page. A logo in the top left. A colour palette lifted from the brand. A bar across the top saying wait times are currently low. Sometimes a chat widget that never connects. The design does the persuading, and the number sits in the largest text on the screen.

Once the call connects, the advertising has done its work and the fraud becomes a conversation. That conversation is a script, and it runs the same way whether the entry point was a search ad, a pop up or a social media ad. The caller is told their account is compromised, asked to install remote access software, and walked toward a payment that cannot be reversed.

We have documented where that ends in our breakdown of the tech support scam that targets bank accounts, and in the Microsoft impersonation version that remains the most reported single variant we see.

What the enforcement record shows

The advertising numbers only make sense next to the loss numbers. Put them in one place and the shape of the problem becomes visible.

For the same year, the Federal Trade Commission reported that people lost 3.5 billion dollars to imposter scams, and that nearly one in three fraud reports it received were imposter reports. Business impersonators accounted for close to 1 billion dollars of that, and government impersonators for about 920 million, up from 789 million the year before.

Those two categories describe exactly what a fake support ad is. Someone pretending to be a company you already trust, or an agency you already fear.

Enforcement does happen, and it is worth knowing what it looks like when it lands. In August 2026, in the FTC settlement that forced Doxo to pay 2.1 million dollars, the conduct at issue included deceptive search advertising and fees that were not disclosed until after people had committed. That case matters because it establishes that buying a brand's name in search and then intercepting that brand's customers is treated as a deceptive practice, not as aggressive marketing.

The FTC's Government and Business Impersonation Rule, in force since April 2024, lets the agency pursue impersonators directly and seek money back for the people they targeted. That is a meaningful change. It is also slower than an ad auction that refreshes thousands of times per second.

Why the losses concentrate among older adults

The pattern in our reader reports is consistent, and it is not about technical ability. It is about which query someone types.

A younger user who needs help with an account usually opens the app, or a bookmark, or a help centre they have used before. Someone less familiar with a service tends to start at the search box and type the brand name plus the word phone or support. That single habit puts them in front of the exact inventory Google scam ads compete hardest for.

The financial damage follows the same logic. Retirement savings and home equity are concentrated in older households, so when a call succeeds the amount lost is larger. We set out the wider pattern in our review of the financial scams that target older adults, and the courier variant, where someone is sent to collect cash in person, is covered in our report on fake bank callers sending couriers to the door.

What actually reduces your risk

Advice that tells people to be careful is useless, because everyone already believes they are being careful. These are the habits that change the outcome.

Never take a support number from an advertisement, and treat the first search results with more suspicion than the ones below them. Get the number from the back of your card, from your statement, from inside an app you already logged into, or by typing the company's own address into the address bar yourself.

Pay attention to who started the contact. A software company may genuinely ask to view your screen, but only in a session you began, on a number you looked up yourself, for a problem you reported. Nobody legitimate arrives at your screen the other way round. If the request for remote access followed an incoming call, a pop up warning or a number you found in an ad, the conversation is the attack and the safest move is to hang up.

If you are unsure about a number that called you or that you found online, you can check that phone number against complaint records before you dial it. Our methodology page explains what that check does and does not prove, because a clean result is not a guarantee of safety.

If you already made the call

Speed matters more than anything else now, and embarrassment is what costs people the most money, because it delays the call to the bank.

Contact your bank or card issuer immediately and ask about reversing the transfer. Disconnect the device from the internet if remote access software was installed, and have it checked before logging into anything again.

File a report at reportfraud.ftc.gov so the pattern is recorded, and at ic3.gov if the loss involved a wire transfer or cryptocurrency.

Our step by step guide on what to do right now if you have been scammed sets out the order to work through. If the number that reached you is not already in our records, you can add it to our reports so the next person searching for it finds a warning instead of an advertisement.

The honest conclusion

Google is not indifferent to this. Blocking 8.3 billion ads is not the behaviour of a company that does not care, and stopping 99 percent before they serve is a real engineering achievement.

But an enforcement system that runs after the auction will always trail an operator who needs one approved impression to reach one worried person. Google scam ads survive in that narrow gap. Until the incentive changes, your last line of defence is the habit of never trusting a phone number you found in an ad.

Sources

• Google, Ads Safety Report covering 2025
• FTC, Bill Payment Firm Doxo to Pay 2.1 Million Dollars, August 2026
• FTC, Government and Business Impersonation Rule