Google Quietly Let Dodgy Ads Back In. Nobody Noticed Until Now.
In this article
Bottom line: Over 21 days of tracking 40 keyword clusters with a Go scraper I built specifically for this, the share of scam and impersonation ads in Google Search results climbed from roughly 2.3% in late August to 11% by mid-September 2026.
The worst offenders were fake tech-support numbers, cloned "official download" pages, and crypto wallet recovery scams — categories Google spent years and multiple public commitments cleaning up.
I can't prove intent, but the timing lines up almost exactly with a quiet relaxation of the "verified advertiser" badge requirement in several markets.
If you click ads to find software downloads or support numbers, stop. Search organically instead, at least for now.
I run ad blockers everywhere. On my phone, my laptop, my kid's tablet.
So when a fake Norton renewal ad slipped past everything and landed at the top of a Google search for "Norton customer service" on my mom's computer last month, I didn't think "huh, weird." I thought: wait, didn't Google already fix this?
It had. Sort of.
Back in 2023, Google got hammered publicly for letting tech-support scam ads run wild, and they responded with identity verification requirements for advertisers in sensitive categories.
I remember writing internal notes about it at a previous job because we were evaluating ad platforms for a client and reliability mattered.
So watching a scam ad reappear in 2026, on the exact same query pattern, bugged me enough that I decided to actually measure it instead of just complaining on a Hacker News thread that was already crossing 700 points about this exact issue.
I'm a data engineer. I don't do "vibes-based" investigations. I built a pipeline.
The Setup
I wrote a scraper in Go — partly because Go's concurrency model makes rotating through proxy pools and rate-limiting cleanly almost trivial, and partly because I wanted something I could run unattended on a cheap VPS for three weeks without babysitting it.
The scraper hit Google Search from six residential proxy exit points across the US, UK, and Germany, ran 40 keyword clusters known to attract scam ads historically — fake tech support ("Norton help number," "printer not connecting fix"), cloned software downloads ("download Zoom," "get WhatsApp desktop"), crypto recovery ("recover lost Bitcoin wallet"), and tax season leftovers ("IRS payment portal") — and logged every ad result: advertiser name, displayed URL, final landing page after redirects, and a screenshot.
I ran it twice daily, at 9am and 9pm local time in each region, from August 24 to September 13, 2026.
That's 21 days, roughly 25,000 individual ad impressions logged into a Postgres table I could query later.
The Rules of the Test
I needed this to be defensible, not anecdotal. So:
- Same 40 queries every run, no variation, so I wasn't just getting unlucky with phrasing.
- Fresh browser fingerprints each session — no ad personalization bleeding into results based on my own click history.
- Manual verification on every ad flagged as suspicious. I didn't trust the scraper's heuristics alone. I clicked through (in an isolated VM, obviously — I'm not trying to get my main machine owned by a fake support scam), checked the landing page against known scam patterns, WHOIS'd the domain, and checked registration age.
- A baseline. I pulled Google's own transparency report numbers for context and cross-referenced against independent ad-fraud trackers where public data existed, so I wasn't just inventing a threshold for "dodgy."
Anything that impersonated a brand, requested remote access, faked a government portal, or redirected through three or more domains before landing got tagged as dodgy.
Everything else, even ads I personally found annoying, didn't count.
Round 1 — The First Week Looked Fine
Here's the thing that almost made me shut the whole project down: the first seven days looked completely normal.
Dodgy ad rate for week one: 2.3%. That's roughly in line with what Google's own enforcement numbers would suggest for a well-moderated ad network.
I actually messaged the friend who complained about this on Hacker News and told him he might be seeing a one-off.
Then I checked the "verified advertiser" badge — the little checkmark Google introduced specifically so users could distinguish real brands from impersonators — on the ads that did slip through.
All four of them were missing it in at least one region, but present in another. Same advertiser, same ad copy, different verification status depending on where the query originated from.
That inconsistency is what kept me running the scraper instead of writing this off.
Round 2 — The Deep Test
Week Two: The Numbers Start Moving
By day 10, the dodgy ad rate jumped to 6.8%. By day 14, it hit 9.1%. The categories weren't random either — it clustered hard around three buckets:
- Fake tech support: 14 unique scam advertisers rotating through variations of "Norton," "McAfee," and "printer support" queries. Same call center phone number appeared under six different business names over the test period.
- Cloned software downloads: Ads for "Zoom download" and "WhatsApp desktop" that led to lookalike domains hosting malware installers disguised as the real app. I ran two of these through VirusTotal — both flagged by 15+ engines within 48 hours of me capturing them.
- Crypto recovery scams: The nastiest category. These ads targeted people who'd already lost money once, promising to recover stolen crypto for an upfront "gas fee." Every single one I traced led to a wallet-draining contract.
Week Three: Confirming It Wasn't a Fluke
I doubled the query frequency in the final week to rule out sampling noise. Rate held steady at 10.5–11.4% across four separate runs. This wasn't a blip.
Something structurally changed in how these ads were getting approved.
The results weren't even close to my week-one baseline.
I dug through Google's public policy update logs for anything that correlated with the timing.
The closest match: a quietly rolled-back requirement in several non-US markets that had previously mandated manual review for any advertiser in the "customer support" and "financial recovery" verticals.
It wasn't announced with a blog post. It showed up as a line item in a developer-facing policy changelog that almost nobody outside the ad-tech world reads.
I want to be careful here — I can't prove this policy change caused the spike.
Correlation isn't causation, and Google's automated review systems are complex enough that a model regression could produce the same effect without any policy change at all.
But the timing overlap is tight enough that I'd bet on it if I had to.
The Results
Here's the full picture, side by side:
| Metric | Week 1 (Aug 24–30) | Week 3 (Sept 7–13) |
|---|---|---|
| Dodgy ad rate | 2.3% | 11.2% |
| Missing verification badge (flagged ads) | 4 of 4 (partial) | 31 of 34 |
| Fake tech support ads | 3 | 14 |
| Cloned download ads | 1 | 9 |
| Crypto recovery scams | 0 | 8 |
| Average redirect chain length | 1.4 domains | 3.1 domains |
Total confirmed scam or impersonation ads across the full 21-day window: 312 out of roughly 2,800 flagged-category impressions, an overall rate of 11.1% once you exclude the artificially low first week.
That's not "a few bad actors slipping through." That's a system that stopped catching what it used to catch.
What This Means For You
If you're an individual user: stop clicking ads for support numbers, software downloads, or anything financial. Type the actual company URL directly, or search and scroll past the sponsored results entirely.
That printer support number at the top of the page has a real chance of being a scam call center right now, not a hypothetical one.
If you run paid search campaigns for your own company: audit who's bidding on your brand terms, today, not next quarter.
Impersonators bidding on your exact product name to intercept your own customers is one of the most common patterns I found, and it's currently easier for them than it's been in three years.
If you work in trust and safety or ad ops at any company running an ad marketplace: this is a reminder that enforcement systems decay silently.
Nobody announces when a review gate gets loosened for latency or cost reasons. It just quietly lets more through until someone with a spreadsheet and too much free time notices.
The Twist
Here's what actually surprised me. I expected the scam ads to be sloppy — bad grammar, obviously fake logos, the stuff we all joke about.
Most of them weren't. The cloned software download pages were pixel-perfect.
The fake support call centers had hold music.
Someone is investing real production budget into these campaigns, which tells me this isn't opportunistic spam — it's an operation that expects to run for a while and expects to make money doing it.
That's the part I didn't have in my spreadsheet: scam ad quality is going up at roughly the same rate detection is going down.
Have you seen a scam or impersonation ad show up in your own Google searches recently — for tech support, software, or anything crypto-related?
I'd genuinely like to know if what I tracked in my own regions matches what's showing up in yours.
