Google search page

Consumers at continuing (but preventable) risk of ‘ad spoofing’

Posted on Mon, 23/08/2021

Most of us have received a hoax call asking for money or confidential details. But now, in the age of online advertising, fraudulent claims management companies (CMCs) are hanging up their phones and turning to their laptops. They pose as insurers and buy up Google AdWords, a pay-per-click advertising service, in order to appear at the top of internet search results. Since Google requires neither proof of identification nor proof of a verified business, fraudsters can create convincing ads in just a few hours. Consequentially, when people run a search to find their insurers’ details after an accident, they are often caught out by so-called ‘spoof’ ads. These scams don’t just affect vulnerable people, and the embarrassment about being scammed means people may not report the issue. While there is little hard data available, recent research shows that as much as 20 per cent of all paid links on the internet could be fraudulent.

In recent months, this issue has been gaining traction, with many commentators calling for action and urging the government to act against fraud via advertising, emails or clone websites. Such calls have been echoed in the insurance, financial and legal services sectors. One law firm has proposed a new division in the Competition and Markets Authority (CMA) to combat spoof ads; the Advertising Standards Authority has announced its intention to launch a ‘scam ad alert’ system in partnership with Google; and Keoghs, a defendant law firm, has called for measures to increase public awareness of the issue to ensure consumers are in contact with their insurer and not a fraudster.

While advice to consumers can be beneficial, it does not tackle the issue at its core. Responsibility ultimately lies with the advertising platform itself. Google, however, has largely failed to combat ad spoofing in the UK. In fact, throughout 2020 the Financial Conduct Authority (FCA) paid Google £600,000 to post warnings of fraudulent ads online to unknowing consumers. Furthermore, according to a survey by Which?, one third of victims who reported a fraudulent ad on Google said it was never taken down by the search engine. There is little sign of this issue subsiding as, following the easing of the first Coronavirus lockdown, the Information Commissioner’s Office found that legitimate insurers wanting to advertise were outbid on Google by fraudulent CMCs.

Outside the UK, Google has introduced a verification programme to ensure all advertisers are legitimate. Even then, the measures allow advertisers 21 days to submit documentation, during which time their ads will remain live, providing them with a grace period to continue to carry out fraudulent activity. As Google profits from both the fraudulent ads themselves and the anti-fraud campaigners paying to introduce alert systems, there is not enough financial incentive for them to intervene meaningfully.

In May 2021, the UK government moved to extend the Online Safety Bill (OSB) to include financial fraud and user-generated online scams. The OSB intends to target online companies and make them responsible for tackling fraudulent user-generated content such as posts on social media, romance scams and fake investment opportunities. However, it fails specifically to target fraud via advertising, emails or cloned websites. In response, Stephen Timms MP, Chair of the Work and Pensions Committee, stated “consumer groups, financial regulators and even the Governor of the Bank of England say this [Bill] isn’t enough” and that more should be done to address ad spoofing. Though the UK is considered a global leader in cyber security and tackling cybercrime, the OSB’s failure to protect consumers online could undermine this.

Perhaps there is something else for us to learn from the Covid-19 pandemic. When browsing online now, many will have seen potential misinformation highlighted when looking for guidance on the virus. A similar flagging issue could be used to identify non-FCA accredited firms to try to divert consumers from harm.

Nevertheless, there remains plenty of scope for solutions on ad spoofing, with responsibility falling on Google to ensure it works harder to prevent consumer harm, and the government to ensure it monitors and regulates the actions of Big Tech. As ever, the Association of Consumer Support Organisations (ACSO) wants the safety and interests of consumers put first.