Google is warning users to proceed with caution in a way that’s befitting its Halloween timing, flagging a spate of online scams that tend to peak in clicks around the season as people look for jobs, download new apps, or chase holiday deals. In a new advisory from its Trust and Safety team, the company says organized criminals are relying on sophisticated scams, coordinated impersonations, and AI-generated content to prey on job seekers, small businesses, and shoppers—often with playbooks calibrated to take advantage of reams of data about what works in November.
What Google Is Flagging Now: Current Scam Tactics to Watch
- Job offer imposters: Includes scammers pretending to be employers who require job seekers to pay for “training,” “equipment,” or a way station for routing candidates into fake interviews that are intended to trap bank account numbers and government IDs. Google’s advice is that the most direct path appears to be applying through a company’s verified careers page or an established job board with employer validation, and to exercise caution if a recruiter insists on moving conversations straight away into encrypted messaging.
- Review-bombing extortion: Small businesses are targeted with sudden, coordinated one-star reviews across Maps and other platforms — and then a “ransom note” to make it stop. Merchants receive new reporting paths for suspected extortion campaigns, and Google notes that owners should log patterns (similar wording, timing bursts, overseas IP hints) to make enforcement possible.
- Fake AI tools and copycat apps: At the height of their hype, “free” versions of premium AI services actually install info-stealing malware or credential harvesters on your devices by way of subtle social engineering. The best practice is to download only from official stores or the brand’s primary domain — and compare developer names, permissions, and recent reviews before you tap install.
- Fake VPNs: These are the ones being shared on social sites and third-party platforms under names that sound similar to established brands. Warning signs: requests for device admin privileges, unnecessary Accessibility access, and background processes that drain battery or data. If a VPN requires more permissions than an ordinary browser, close the tab.
- “Recovery” scammers: Often a second wave of scams comes in the wake of a crypto or shopping scam. These fraudsters purport to be affiliated with banks, platforms, or law enforcement and offer to recover stolen funds for an advance payment. “It should not cost anything to open a case and authorities and reputable sites do not charge for this.”
- Holiday phishing and fake stores: As Black Friday and Cyber Monday deals invade everything online, so do fake storefronts and delivery-text phishing attacks. Common lures are impossibly low prices, countdown timers, and “reschedule your package” texts leading to credential theft. If a deal appears to be a pricing error, consider it a trap until it shows itself to be otherwise.
Why November Is High-Risk for Online Scams and Fraud Attempts
Scammers follow the calendar. Each November, shoppers are making new accounts, searching for discount codes, and clicking on ads at higher rates — ideal conditions for mimicry. The U.S. Federal Trade Commission said consumers lost almost $10 billion to fraud, a 14% rise from 2022, while the F.B.I.’s Internet Crime Complaint Center recorded a record-breaking $12.5 billion in reported losses. They were a reminder of an old truth: phishing emails, fake merchants, and investment pitches all ramp up during peak shopping periods.
AI has also made it easier for them. Polished résumés for nonexistent recruiters, photorealistic brand logos, and nearly perfect English grammar can make scam pages harder to detect. Old tricks, like fake shipping alerts, are even arriving with logos and order numbers so that they look real at a glance.
The Red Flags to Look Out For When Evaluating Online Offers
- For job seekers: No legitimate company will ask you to pay for your onboarding, training, or equipment in gift cards or crypto. Be suspicious of interviews held through nothing but chat apps, requests for ID scans early in the process, or offers that come out of nowhere and are suddenly extremely urgent.
- For merchants: Sudden clusters of one-star reviews with fuzzy complaints, identical grammar, or general photos can suggest an attack. Record, act professional, and report potential blackmail using platform tools — do not negotiate with the attacker.
- For app downloads: Verify the developer name spelling, the number of installs, and when reviews were last added. Permissions must correspond to an app’s function; a calculator does not need SMS access. Don’t sideload unless you’re really sure about the source.
- For shopping: Check the domain spelling, physical address, and checkout procedures some professionals recommend. Make sure it doesn’t accept only wire transfer or crypto, and definitely avoid any site that does. If a “carrier” text tells you to pay a modest fee to release a package, go directly to the carrier’s official website or app instead of clicking on the link.
How Platforms Are Responding to the Latest Online Scam Waves
Google says it is clamping down on review moderation and releasing dedicated flows for merchants to report cases of coordinated review abuse. For mobile security, the company is also expanding its real-time scanning and warnings of potential unwanted apps on Google Play Protect. Gmail already uses banner warnings for risky senders and unusual attachment activity, and the company urges users to use two-factor authentication or passkeys wherever available.
While Google is by far the most important clearinghouse for complaints, other reporting channels include the FTC, state attorneys general, and the FBI’s Internet Crime Complaint Center. Those reports are used by law enforcement and consumer protection agencies to break up networks and quickly warn others.
What To Do If You’re Struck by a Scam or Fraud Attempt
If you did pay a scammer, call your bank or card issuer and ask if the payment can be reversed as a chargeback. For crypto, alert the exchange right away. Change any passwords you’ve recycled elsewhere and enable multifactor authentication. If you shared information like your ID, consider freezing your credit and looking out for new-account fraud.
Report the incident to the platform and the FTC and IC3. For review extortion, keep screenshots and timestamps — then escalate via Google’s merchant reporting. If job-related, alert the HR or security team of the employer that was impersonated; they frequently send advisories that can save others from falling into the same trap.
The most concise tidbit from Google’s advisory is: slow down, fact-check, and stay on official channels. Scammers are stepping it up as November approaches, and a few extra checks can mean the difference between a good deal and a long recovery.
