When you search for your bank, an airline or a passport office, the first thing on the screen is often an advert rather than the organisation itself. On 22 October 2026 the Federal Trade Commission, the United States consumer protection agency, went to court over search adverts that it says were made to look like the United States government's passport service. This guide explains how a page of search results is put together and why businesses compete so hard for the top of it. It shows where criminals slip in, and the checks that work on Google, Bing and every other search engine.
A page of results is a marketplace
Search engines are free to use because advertisers pay for them. Alphabet, Google's parent company, reported $224.5 billion in revenue from Google Search and related services in 2025 (Alphabet filings and fourth-quarter results, 4 February 2026). In September 2026 Google handled 89.94% of searches worldwide, Bing 5.29%, Yahoo 1.36% and DuckDuckGo 0.74% (StatCounter). The adverts in Bing also appear on Yahoo, AOL, DuckDuckGo and Ecosia, because Microsoft Advertising supplies them (Microsoft Advertising; Yahoo Help; Ecosia Support). The habits in this guide therefore work in almost every search box.
A page of results now holds three kinds of answer. The first kind is paid adverts, marked "Sponsored" or "Ad", which advertisers bid for in an auction for each search. The second is unpaid results, which the search engine ranks with its own systems. More and more often there is a third kind at the very top: a summary written by artificial intelligence (AI), such as Google's AI Overviews or Copilot in Bing. Alphabet said in July 2025 that AI Overviews had more than 2 billion users a month.
How marketing learned to win the top of the page
The top of the page is valuable because most people never scroll far. A 2024 study by the research firms SparkToro and Datos found that 58.5% of Google searches in the United States ended without a click to any website, and only 360 of every 1,000 searches sent someone on to the open web (SparkToro, 1 July 2024). Banks, airlines, shops, travel firms, charities and public bodies all compete for the few places that are seen, and marketing and advertising agencies have built whole industries around winning them. Each new kind of search has brought a new name for the work.
Search engine optimisation (SEO) is the oldest of these. Google describes it as helping search engines understand your content and helping people find your site. It covers clear page titles, useful writing, fast pages and links from other trusted sites.
Answer engine optimisation (AEO) writes content so that a search engine or a voice assistant lifts it out as the single direct answer to a question.
Generative engine optimisation (GEO) aims at the summaries written by AI. The term comes from a 2023 paper by researchers at Princeton University and the Indian Institute of Technology Delhi, presented at the KDD 2024 data science conference. The paper found that changes to the way content was written could raise how often it appeared in AI answers by up to 40%, and that adding statistics and quotations worked best (Aggarwal and others, arXiv 2311.09735).
Large language model optimisation (LLMO) is the newest name. A large language model is the technology behind chatbots such as ChatGPT, Gemini, Claude and Copilot, and the aim of the work is to shape what those chatbots say about a company or a product.
In February 2024 the research firm Gartner predicted that traditional search engine volume would fall by 25% by 2026 as people turned to AI chatbots. In its results for the end of 2025, Alphabet said Google Search saw more use than ever before. Whichever way that balance moves, the same contest for the first answer people see now runs through lists of links, answer boxes, AI summaries and chatbots.
Where scams slip in
Paid adverts. In December 2022 the Federal Bureau of Investigation warned that criminals buy search adverts in the names of real businesses, which appear at the top of results with little to tell them apart from the real ones, and lead to copied sites that steal log-ins or install harmful software (public service announcement I-122122-PSA). In April 2025 the Federal Trade Commission warned that scammers pay for adverts in the names of companies and government services, and place fake phone numbers next to trusted names.
The Federal Trade Commission's case filed on 22 October 2026 against GovAssist LLC, Entry LLC and the man it names as their owner shows how the method works. The court has not yet ruled, and these are the Commission's allegations. It says the companies bought Google adverts for searches such as "passport renewal online", that the adverts often appeared above the Department of State's own site, and that they advertised prices "from $89" while the lowest real price was $148 on top of the government fee. From about April 2026 some adverts said "Not a government website", in much smaller type than the rest. The Commission says at least $40 million was taken from more than 300,000 people since October 2023. In August 2026 the Commission also described its case against the bill-payment company Doxo, which it alleges used paid search adverts that looked like the payment pages of companies and state toll authorities.
Unpaid results built to rank. Criminals also use search engine optimisation itself. The method is called search engine poisoning: look-alike web addresses, pages stuffed with popular search words, and pages that show search engines one thing and visitors another (United States Department of Health and Human Services, 22 June 2023). In June 2026 Microsoft reported a fake download page for an AI app that ranked above the official page in Bing without any paid advert.
AI answers. In August 2025 The Washington Post reported that a Google AI Overview had shown a fake customer service number for the cruise company Royal Caribbean, and that a caller agreed to pay $768 before cancelling his card (as reported by TechSpot, 19 August 2025). Google said it removed the examples the newspaper raised. In December 2025 the security company Aurascape described fake airline phone numbers planted on hacked websites and video pages so that AI search tools would repeat them. It called this "LLM phone-number poisoning". The tech news site Gizmodo could not repeat the result in its own test.
What the search engines report
Google's 2025 Ads Safety Report, published on 16 April 2026, says the company blocked or removed more than 8.3 billion adverts in 2025, including 602 million linked to scams, and suspended 24.9 million advertiser accounts. Microsoft's latest review, published in June 2025 and covering 2024, says it removed more than 1 billion adverts and suspended more than 475,000 advertiser accounts. Since August 2023 Microsoft has shown adverts only from advertisers who have proved who they are.
Regulators are now asking how much further the search engines should go. In September 2026 the Federal Trade Commission asked for public comment on whether search engines, social media and online marketplaces should have to stop impersonation adverts from reaching people at all. The Commission received more than 1 million reports of impostor scams in 2025, with nearly $3.5 billion reported lost. In the United Kingdom, Ofcom, the communications regulator, published draft codes on fraudulent advertising under the Online Safety Act on 10 July 2026. Under the drafts, the largest search engines would have to check who is behind each advert and remove fraudulent adverts quickly.
What it means for people and for organisations
For people, the cost lands at the moment of need: a cancelled flight, a blocked bank card, a passport deadline. A small "Sponsored" label is easy to miss on a phone screen, with a screen magnifier, or in a hurry, and a phone number in an advert can look exactly like the real one.
For organisations, their own name is the bait. A charity, a council, a bank or a small business can do a great deal with the skills its marketing team already has:
- Publish one official phone number and web address, and repeat them on every bill, letter and receipt.
- Tell customers plainly that the organisation will never ask them to call a number from an advert.
- Report impersonation adverts to Google and Microsoft, and ask an AI chatbot how to contact the organisation to see which number it gives.
- Use the same search engine optimisation and AEO work that wins customers to make sure the real contact page is the first answer people find.
How to check, on any search engine
- Look for "Sponsored" or "Ad". It means someone paid for that place. It does not mean anyone checked the advertiser.
- Read the web address, not the title. A title can say anything. In the United States, government sites end in .gov, a name that only verified government bodies can register, run by the Cybersecurity and Infrastructure Security Agency. In the United Kingdom they end in .gov.uk, and in South Africa in gov.za.
- See who paid. On Google, tap the three dots (or the information icon on a phone) beside an advert to open My Ad Center, which shows the advertiser's name, location and whether Google has verified it. The Google Ads Transparency Center lists every advert a verified advertiser has run. Microsoft shows the name and location of the advertiser who paid for each advert in Bing.
- Never call a number from an advert or an AI summary. Use the number on your card, your bill, your booking confirmation, or the official site you typed in yourself.
- Go straight to the official service. In the United States, the only official place to renew a passport online is opr.travel.state.gov, and an adult renewal costs $130 (Department of State, October 2026). Under the Federal Trade Commission's allegations, the same renewal through GovAssist or Entry cost at least $278.
- Save bookmarks for the sites you use most, so that you never need to search for them.
- Paste the advert into a free check. Advert Check reads an advert's words for warning signs, including a phone number offered for support, bookings or refunds. The check runs on your own phone.
- If you have already paid, call your bank on the number on your card straight away, and use the first-hour guide. Report the advert to the search engine with the three dots beside it. In the United States, report at ReportFraud.ftc.gov. In the United Kingdom, report scam adverts to the Advertising Standards Authority and money lost to Report Fraud at reportfraud.police.uk.
Free UtilForge tools for this
- Advert Check: reads the words of a search, social media or messaging advert for warning signs.
- Is this the official government site?: reads a web address and shows whether it ends in a government address, and where a look-alike is hiding.
- Before You Pay: checks a payment page or a message that asks for money.
- Shop check: looks for the signs of a copied or fake shop.
- First-hour guide: the steps in order for anyone who has already paid, by country and by how they paid.
Staying informed is part of staying safe
Search is how most people find help, and the marketing and advertising industries have spent decades learning how to win the first place people see. Criminals study the same methods. Understanding how the page is made protects you, and passing that understanding on protects the neighbour, colleague or relative who searches for help next. Each person who knows to read the address before the name makes the online world safer for everyone.
The first result is the one someone paid for or worked hardest to win. The right result is the one whose address you can check.
Sources: Federal Trade Commission, press release on GovAssist LLC and Entry LLC, 22 October 2026 (https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-sues-perpetrators-government-impersonation-scheme-over-deceptive-ads-misleading-promises-fake); Federal Trade Commission, consumer alert, 3 April 2025 (https://consumer.ftc.gov/consumer-alerts/2025/04/online-search-results-good-bad-scammy); Federal Trade Commission, consumer alert on bill pay impersonators, August 2026 (https://consumer.ftc.gov/consumer-alerts/2026/08/searching-online-bill-pay-impersonators); Federal Trade Commission, request for comment, 24 September 2026 (https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-seeks-public-comment-whether-update-rule-impersonation-government-businesses-address-platforms); Federal Bureau of Investigation, I-122122-PSA, 21 December 2022 (https://www.ic3.gov/PSA/2022/PSA221221); Google, 2025 Ads Safety Report, 16 April 2026 (https://blog.google/products/ads-commerce/2025-ads-safety-report/); Microsoft Advertising, trust and safety review of 2024, 26 June 2025 (https://about.ads.microsoft.com/en/blog/post/june-2025/ads-trust-and-safety-year-review-2024); Microsoft Security, 8 June 2026 (https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/); Ofcom, fraudulent advertising consultation, 10 July 2026 (https://www.ofcom.org.uk/online-safety/online-fraud/consultation-fraudulent-advertising-code-of-practice); National Cyber Security Centre, report a scam advert (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-advert); Aggarwal and others, generative engine optimisation, 2023 (https://arxiv.org/abs/2311.09735); SparkToro, zero-click search study, 1 July 2024 (https://sparktoro.com/blog/2024-zero-click-search-study-for-every-1000-us-google-searches-only-374-clicks-go-to-the-open-web-in-the-eu-its-360/); Google, search engine optimisation starter guide (https://developers.google.com/search/docs/fundamentals/seo-starter-guide); Google, ads transparency help (https://support.google.com/adspolicy/answer/13733850); TechSpot, 19 August 2025 (https://www.techspot.com/news/109110-new-scam-uses-google-ai-search-results-trick.html); Aurascape via Business Wire, 8 December 2025 (https://www.businesswire.com/news/home/20251208251854/en); United States Department of State, passport fees (https://travel.state.gov/en/passports/renew-replace/online.html); StatCounter, search engine market share, September 2026 (https://gs.statcounter.com/search-engine-market-share).
Related guides
Free
If you doubt it,
UtilForge it.
Free checks that run on your own phone or computer. What you type stays on your phone or computer.