Редакція dev.uaздолай шахрая
30 September 2026, 15:38
2026-09-30
The trap in the search engine window. How fake "utilities", "traffic fines" and Google Ads hacking turned into a cyberfraud pipeline
Six o’clock in the evening, the working day is coming to an end, and you decide to quickly close out small household affairs. You open a browser, type in "pay utility bills" or "check traffic fines", click on the very first link in the output and get to a familiar site. You enter your card details, wait for confirmation, and a minute later you see an error message and a request to enter an SMS code to cancel the transaction. You enter this code, and at that very moment your savings disappear.
Six o’clock in the evening, the working day is coming to an end, and you decide to quickly close out small household affairs. You open a browser, type in "pay utility bills" or "check traffic fines", click on the very first link in the output and get to a familiar site. You enter your card details, wait for confirmation, and a minute later you see an error message and a request to enter an SMS code to cancel the transaction. You enter this code, and at that very moment your savings disappear.
This is not a cyber detective scenario, but an everyday reality that thousands of Ukrainians face every day. Together with experts from the EMA Association, we figured out how a regular payment window and the first position in Google turned into an ideal tool for robbery.
Hunting for a monthly routine
At the heart of most fraudulent schemes is one simple thing — human habit and haste. Fraudsters know very well that at the end of the month or after another trip around the city, people are en masse looking for convenient ways to pay for services or check for fines.
Criminals create almost perfect copies of popular payment services such as iPay, Portmone or HERTS, as well as sites for checking traffic violations. But simply creating a clone site is not enough — the victim needs to visit it. To do this, criminals buy paid advertising in Google Ads for the most popular search queries. As a result, the fake page appears at the very top of the results with an inconspicuous "Sponsored" sign.
When a person gets to such a site, he sees a familiar interface and without hesitation enters the card details. At this moment, a special script intercepts the number, expiration date and CVV2 code. But the most insidious thing happens next. A message about a “transaction error” appears on the screen and a suggestion to enter an SMS code to cancel it. In fact, the code from the bank, which the person enters himself, confirms not a cancellation at all, but a debiting of funds or linking the victim’s card to the Apple Pay or Google Pay wallet on the fraudster’s smartphone.
The Cyber Police once again emphasizes that official state bodies operate according to completely different rules. For example, the Patrol Police Department never sends notifications about fines via SMS. If a violation was recorded automatically and the fine is not paid within ten days, the car owner is sent an official paper notification by mail. To check fines, you should use only state services with the .gov.ua domain suffix — the “Diya” portal and application, “Driver’s Cabinet”, the “Street Traffic Fines” application, or the Ministry of Internal Affairs portal.
The Great Robbery Within Google
While ordinary users are losing money on payments, businesses are facing an equally large-scale threat, which researchers have already dubbed “ The Great Google Ads Heist .” The paradox of this scheme is that attackers buy advertising on Google in order to steal the accounts of people who… themselves buy advertising on Google.
The scheme works surprisingly defiantly. A marketer or business owner searches Google for the Google Ads authorization account. Among the first results, he sees an ad that visually does not differ from the official one. According to strict Google rules, the address in the ad must completely match the domain of the landing page. Attackers circumvent this restriction very cunningly — they create intermediate pages on the free Google Sites platform. Since this service belongs to Google itself, the moderation algorithms calmly skip such links.
By clicking on the ad, the user is taken to an intermediary site on Google Sites, from where he is instantly redirected to a phishing portal. There, digital fingerprints of the browser, tokens and passwords are read invisibly. Having gained access to the account, the hackers add a new administrator and begin to massively burn through the company’s budget, launching their own advertising campaigns to spread viruses or phishing around the world. According to analysts, organized groups from Brazil and East Asia are behind this global network, which then resell the hacked accounts on shadow forums.
How not to get caught
It is quite possible to protect yourself from such attacks if you develop a few simple digital habits. First of all, you should stop clicking on the first links marked "Sponsored" when it comes to financial transactions or logging into work offices. It is better to scroll down the page a little to the organic results.
It is also important to carefully examine the browser address bar. No official government service or bank will be located on free website builders (by the way, try your hand at it — can you spot a phishing site?). Cybersecurity experts also advise using ad blockers, enabling two-factor authentication via special authenticator applications instead of SMS, and regularly checking the list of administrators in your advertising and corporate accounts.
If disaster has already struck and you entered your card details on a suspicious website, you need to act immediately: instantly block the card through the banking app and report the fraud to the Cyber Police. You can register a report online .
