5 Search Terms Costing UK Users £1K+: The Google Ad Malvertising Threat

For cybersecurity professionals, the surge in search-based malvertising represents a critical shift in the phishing landscape. Attackers are no longer relying on email but are hijacking the user journey at its most vulnerable moment—when they actively seek help. By exploiting Google’s advertising ecosystem, they evade traditional email security controls and create highly convincing traps that blend seamlessly with legitimate results.

Cybersecurity experts are sounding the alarm about a surge in fraud stemming from some of the most common Google searches. The warning, issued by Protect My Data’s privacy expert Peter Nguyen, highlights how cybercriminals are exploiting the trust users place in search engines, using fake advertisements and cloned websites to intercept people in moments of distress. This shift represents a dangerous evolution from traditional email phishing to 'search phishing' or malvertising, where victims are proactively lured while seeking help for urgent financial or administrative issues. The financial consequences can be severe, with victims potentially losing thousands of pounds in minutes, as scammers trick them into revealing bank details, transferring money to bogus 'safe accounts,' or submitting sensitive personal data like National Insurance numbers.

“

The warning, issued by Protect My Data’s privacy expert Peter Nguyen, highlights how cybercriminals are exploiting the trust users place in search engines, using fake advertisements and cloned websites to intercept people in moments of distress.

The mechanics of the scam are deceptively simple. Fraudsters first identify high-value search terms — typically those associated with immediate, stressful problems. Examples include 'bank customer service number,' 'HMRC tax refund,' 'DVLA fine payment,' and 'ULEZ charge appeal.' By purchasing Google Ads, criminals ensure their fraudulent listings appear at the very top of search results, often above official links. The cloned websites are meticulously crafted to mimic genuine government pages or bank portals, complete with logos and form fields. When a panicked user clicks and enters their details, the data goes straight to the fraudsters. In some cases, victims are then called by impersonators posing as bank security staff, who manipulate them into transferring funds or providing two-factor authentication codes.

This tactic exploits two distinct vulnerabilities: the psychological state of the target, and the advertising platform’s inability to pre-vet every ad. Google does use automated and manual reviews to catch malicious ads, but the sheer volume — millions of ads served daily — means many slip through. And because the ads often appear legitimate at first glance, even cautious users can be fooled. The UK’s National Cyber Security Centre has previously noted a rise in online scams piggybacking on trusted brands, but the direct weaponisation of Google Ads to target transactional searches is a newer wave, amplified by the continued digitisation of public services. With HMRC, DVLA, and local councils moving many interactions online, the attack surface has expanded, making it easier for criminals to inject themselves into the user journey.

The financial impact is significant. Individual victims have reported losing anywhere from a few hundred pounds to over ten thousand pounds when their bank accounts are drained. The emotional toll can be devastating, often leaving victims feeling violated and less trusting of digital services. Moreover, because the transactions are sometimes authorised by the victim under duress, banks may contest reimbursement, leading to protracted disputes.