Google Issues Critical New Threat Advisory — Take Action Now

Forbes

02-06-2025

Google issues new scam threats advisory.
Update, June 1, 2025: This story, originally published May 30, has been updated to include a new strategic method of cutting at least some of the phishing threat off at its source, in response to the latest Google scam warnings.
Whether it's the FBI warning about smartphone attacks leveraging fears of deportation in the U.S. foreign student population, recommendations to use a secret code as AI-powered phishing campaigns evolve, instant takeover attacks targeting Meta and PayPal users, or confirmed threats aimed at compromising your Gmail account, there is no escaping the cyber-scammers. Indeed, the Global Anti-Scam Alliance, whose advisory board includes the head of scam prevention at Amazon, Microsoft's director of fraud and abuse risk, and the vice president of security solutions with Mastercard, found that more than $1 trillion was lost globally to such fraud in 2024. But do not despair, despite the Federal Trade Commission warning of a 25% year-on-year increase in losses, Google is fighting back. Here's what you need to know.
There can be no doubt that online scams, of all flavors, are not only increasing in volume, but they are also evolving. We've seen evidence of this in the increasing availability and cost-effectiveness of employing AI to empower such threat campaigns. No longer the sole stomping ground of solo actors and chancers looking to make a few bucks here and there, the scams threat landscape is now dominated by organized international groups operating at scale. The boundary between online and physical, offline fraud is blurring. Hybrid campaigns are a reality, combining phone calls with internet calls to action.
The Global Anti-Scam Alliance State of Scams Report, published in November 2024, revealed the true cost of such crimes: $1.03 trillion globally in just 12 months. A March 2025 report from the Federal Trade Commission showed that U.S. consumers alone had lost $12.5 billion last year, up 25% from 2023. And that GASA report also found that only 4% of victims worldwide reported being able to recover their losses. Something has to be done, and Google's Trust and Safety teams, responsible for tracking and fighting scams of all kinds, are determined that they are the people to help do it.
'Scammers are more effective and act without fear of punishment when people are uninformed about fraud and scam tactics,' Karen Courington, Google's vice president of consumer trusted experiences, trust & safety, said. In addition to tracking and defending against scams, Google's dedicated teams also aim to inform consumers by analyzing threats and sharing their observations, along with mitigation advice.
The May 27 Google fraud and scams advisory, does just that, describing the most pressing of recent attack trends that have been identified. These are broken down into five separate scams, each complete with mitigating best practice recommendations, as follows:
Customer support scams, often displaying fake phone numbers while pretending to be legitimate help services, are evolving and exploiting victims through a combination of social engineering and web vulnerabilities, Google warned. Along with the protection offered by Gemini Nano on-device to identify dangerous sites and scams, Google advised users should 'seek out official support channels directly, avoid unsolicited contacts or pop-ups and always verify phone numbers for authenticity."
Malicious advertising scams, often employing the use of lures including free or cracked productivity software and games, have also evolved. 'Scammers are setting their sights on more sophisticated users,' Courington said, 'those with valuable assets like crypto wallets or individuals with significant online influence.' Google uses AI and human reviews to combat the threat and block ad accounts involved in such activity. Only download software from official sources, beware of too good to be true offers, and pay particular attention browser warnings when they appear, Google said.
Google's teams have seen an increase in fake travel websites as the summer vacations get closer, usually luring victims with cheap prices and unbelievable experiences. Again, these will likely impersonate well-known brands, hotels, and agencies. Google advised users to use its tools such as 'about this result' to verify website authenticity. 'Avoid payment methods such as wire transfers or direct bank deposits,' Courington said, 'especially if requested via email or phone.'
The old chestnut of package tracking scams has not vanished, more's the pity. 'These scams often trick users into paying additional fees that real delivery services would never request,' Courington explained. Google has seen these scammers employing a tactic whereby the websites and messages used are changed dynamically, based on when the link is sent to the victim. Scam detection in Google Messages has been deployed as one level of protection by Google, but Courington also recommended users should verify the status of any expected package with the shipping company or seller rather than by a link from an unknown source.
And finally, there's also no escaping the road toll scams that continue to appear. 'A toll road scam involves scammers sending fraudulent text messages claiming that you owe unpaid toll fees,' Courington warned. Thankfully, these are not always the most realistic of threats, with Google analysts seeing users spammed by toll road fee claims in states that don't even have any toll roads. The best mitigating advice remains stopping to pause, count to ten, and ask yourself if the claim is a plausible one. If it is, then confirm it directly with the toll operator rather than via a link in a message.
There are some people who just demand to be listened to, not through the loudness of their voice or the position of power they find themselves in, but rather because of the sheer experience they bring to the table. When it comes to the phishing threat, one of these people has to be Paul Walsh. I have been around the online business more than long enough to remember when, in 2004, Walsh was tasked with refining the World Wide Web creator, Tim Berners-Lee's, vision of one web. This was when the W3C Mobile Web Initiative was co-founded by Walsh, who also happened to be head of the New Technologies Team at AOL in the 90s. See, I told you I had been around a long time, and AOL wasn't even my first rodeo on the internet. The point being that Walsh has huge experience when it comes to the phishing threat, having helped launch AOL's Instant Messenger AIM client and becoming one of the first people online to fall victim to impersonation attacks as a result. But, it doesn't need there: 'When I co-founded the W3C standard for URL Classification and Content Labeling in 2004,' Walsh told me, 'I co-invented the very concept of classifying/labeling folders, user accounts, etc., on the web,' Walsh said. Now he's the CEO at MetaCert, a business that seeks to cut off the phishing threat directly at its source with a network-based solution for carriers to shield subscribers from SMS phishing attacks.
Walsh told me that when it comes to phishing protection, threat intelligence is a fundamentally flawed method. 'Relying on historical data is useless—new URLs evade existing intelligence by design,' Walsh advised, adding that it is, in his opinion, the biggest threat in cybersecurity currently. While the advice from Google is certainly not to be ignored by users, in my never humble opinion, Walsh does not agree. Suspicious links and unexpected attachments, as red flags, Walsh claimed, are not only poor warning signs but positively harmful in 2025. With SMS taking over from email as the primary attack vector for phishing campaigns in 2024, Walsh said that 'authenticating URLs before delivery' is the only way to ensure they are safe, 'without relying on outdated historical data or AI.'
I will say this: while I agree with a lot of what Walsh has to say, talking about phishing protections in terms of what needs to happen in the future doesn't help potential victims now. As such, I would not ignore the Google threat advisory. Adopt a zero-trust approach, don't click on any link in an email or text message, instead always go to the source yourself using your web browser. Authenticate everything.