When people search for your business on Google, they’re usually trying to do something simple: find your phone number, request a quote, log into a portal, or confirm you’re the real deal. The problem is that the very top of the search results page can sometimes be the most misleading part - especially when sponsored ads are involved.
Most people assume the first search result is the safest option. But we’re increasingly seeing Google Search scams where criminals use paid ads to impersonate legitimate businesses. And in a slightly different (but still harmful) category, we’re also seeing competitors run ads using keyword phrasing and in some cases the actual business name of their competitor along with “close enough” messaging that makes it feel like you’ve clicked the business you searched for when you haven’t.
The intent and legality can differ between these two scenarios, but the outcome often looks the same from a customer’s perspective: traffic is diverted, trust is damaged, and genuine enquiries can end up in the wrong hands.
A Google Search scam typically involves a threat actor creating a paid Google Ad that appears when someone searches for a business name, service, or product. The ad may:
- Use the business name (or a very close variation)
- Display a web address that looks legitimate at a glance
- Lead to a “clone” website designed to look like the real one
- Include a phone number that routes to the scammer
- Prompt users to enter details, make a payment, or “log in”
Because the listing is paid, it often appears above the genuine website especially on mobile. And because it’s labelled “Sponsored”, users may assume it has been properly vetted by Google. In reality, these ads can sometimes slip through checks and remain visible long enough to cause real harm.
Competitor “look‑alike” ads and keyword hijacking (unethical, sometimes allowed)
Not all diverted traffic is criminal impersonation. There’s another practice businesses should be aware of: competitors bidding on your brand name or branded keywords and writing ads that are intentionally similar in phrasing.
This can look like:
- Ads triggered when someone searches your business name
- Similar wording to your service offering (and sometimes your tone)
- A landing page that’s clearly a competitor - but only once the user arrives
- Messaging that relies on users clicking quickly without noticing the brand
In many cases this isn’t illegal, and it may sit within the boundaries of what Google allows depending on wording and trademark use. However, it’s widely considered unethical when the ad is designed to create confusion, because it intercepts customers who were trying to find you.
A quick way to summarise the differences is:
- Scam impersonation aims to deceive users into thinking they’re dealing with your business (often to steal money or data).
- Competitor keyword hijacking aims to capture ready‑to‑buy traffic that was searching for your brand (often by exploiting ambiguity rather than outright impersonation).
Either way, the business impact can be significant.
Why this works so well
Sponsored ads are attractive to bad actors and opportunistic competitors for a simple reason: position and attention.
On many searches, ads appear above the organic results. On mobile, that can mean a user sees an ad, taps it, and never scrolls far enough to find your real site. People are busy, and they often click the first thing that looks right.
If the ad copy is convincing and the web address looks plausible, users may not notice they’re not on your legitimate site until it’s too late or they may never realise at all.
What can happen to your business (even if you’re not “hacked”)
Even when the scam is happening outside your systems, the damage can land on your doorstep.
1) Lost enquiries and revenue
If customers click a fake ad (or a competitor ad that captures your brand searches), those leads may never reach you. You can see a drop in enquiries with no obvious cause, because the demand still exists - it’s just being intercepted.
2) Brand and reputation damage
If someone believes they interacted with your business and has a bad experience (or is scammed), they often attribute it to your brand. That can result in angry calls, complaints, and negative reviews - even when you did nothing wrong.
3) Customer data and payment risk
In impersonation scams, the end goal is often information theft or payment capture. Customers may be tricked into entering details into a fake form, calling a number that isn’t yours, or paying an invoice that looks legitimate.
4) Confusion that drains staff time
Teams can spend hours fielding “I already filled out the form” or “I called earlier” conversations, trying to work out what happened. This is frustrating for customers and costly for your business.
How to spot suspicious sponsored results
The trick with these ads is that they’re designed to be skim‑read. A few quick checks can help:
- Look closely at the URL: subtle misspellings, extra words, hyphens, or unusual domains can be a red flag.
- Watch for “official” language: scammers often lean heavily on words like “Official”, “Verified”, or “Authorised” to manufacture trust.
- Compare phone numbers: if the ad shows a number different to your website or Google Business Profile, treat it with caution.
- Be wary of urgent prompts: “Immediate payment required”, “Account locked”, or “Verify now” should trigger a pause.
- Check the actual business name on the landing page: competitor ads can be clearer once you arrive — but not always.
Steps to reduce risk
1) Monitor your own brand searches
Set a recurring reminder (even once a fortnight) to search your business name in an incognito/private window and check:
- Which ads appear above your organic result
- Whether any look similar to your branding or name
- Whether phone numbers and URLs match what you expect
This is also how many businesses first discover competitor keyword hijacking.
2) Lock down your Google accounts
Even if the scam doesn’t involve your accounts directly, it’s still worth ensuring your:
- Google Business Profile
- Google Ads accounts
- email accounts associated with them
…are protected with strong passwords and multi‑factor authentication (MFA). Account takeovers can make impersonation much easier.
3) Report impersonation ads quickly
If you find a sponsored result impersonating your business, document it:
- Take screenshots (including the URL and ad text)
- Note the search term used and the date/time
- Capture the landing page if safe to do so (don’t enter details)
Then report it through Google’s ad reporting pathways. Response times vary, but consistent reporting and clear evidence helps.
4) Consider “defensive” paid search
Some businesses choose to run their own branded search ads so that the top sponsored result is their official listing, especially in high‑risk industries. This isn’t required for everyone - but it can be an effective deterrent when your brand is being targeted.
5) Make it easier for customers to verify you
A few small changes can reduce confusion:
- Ensure your website clearly displays your correct domain and contact details
- Keep your Google Business Profile up to date
-
Consider a short note such as:
“Our official website is [yourdomain.com.au]. If you’re ever unsure, contact us directly via the details on our website.”
This is particularly helpful if you’ve seen a pattern of diverted traffic.
What’s “normal marketing” vs what crosses the line?
Competition is normal. Bidding on generic service keywords is part of digital marketing. Where it becomes problematic is when ads are written to encourage mistaken identity - for example, by mimicking the searched brand’s language, using “close enough” naming, or relying on users not noticing they’ve clicked a different business.
Even if this behaviour sits in a grey area legally, it can still be damaging and deceptive in practice. If you suspect it’s happening, documenting it early gives you options whether that’s reporting, clarifying your brand presence, or adjusting your own search strategy.
Sponsored search results can be used in two ways that hurt legitimate Australian businesses:
- Criminal impersonation scams that aim to steal money or data by pretending to be your brand
- Unethical competitor ads that intercept your branded searches by creating confusion and diverting traffic
You don’t need to panic but you do want to be aware. A small amount of monitoring, strong account security, and a clear “official website” presence can significantly reduce the risk and minimise the impact if it happens.