Search engines such as Google and Microsoft's Bing provide an easy hunting ground for criminals who target victims via paid-for adverts, while the spike in investment scams is pushing regulators and law enforcement to the limit, warns Which?.
Action Fraud received more than 17,000 investment scam reports in the year to September 2020, up 28% on the previous year, with total losses reaching £657m - and many more cases go unreported.
The financial uncertainty created by the pandemic has played into scammers' hands: the of firms potentially running investment scams doubled from 573 in 2019 to 1,184 in 2020 - yet three in 10 investors surveyed by Which? had never even heard of it.
Many firms on the warning list initially advertised on either Google or Bing, having paid to appear at the top of search results for terms such as 'best bonds' and 'best fixed-rate bonds'. We've found that such adverts have remained for weeks after the FCA issued warnings to avoid them.
A Which? survey of 206 investment scam victims found that while one in seven were targeted by phone, four in 10 were targeted via online methods.
Online methods included via email (12%), search engines (10%), adverts on Facebook (9%) or other non-social media/search engine online adverts (8%).
Although legitimate investment comparison sites do exist - and may advertise on search engines - we found dozens of investment comparison sites advertising on Google or Bing that were already on the FCA warning list or soon would be.
This suggests that Google and Bing are failing to appropriately verify the promoters of financial products and services.
A Google spokesperson told Which?: 'Protecting consumers and credible businesses operating in the financial sector is a priority for us, which merits careful rules and enforcement. We take dishonest business practices and misleading ads very seriously, and consider them to be a violation of our policies and recently updated our policies to enable verification of businesses promoting financial services in the UK. When ads don't comply with our policies, we take immediate action to remove them.'
A Microsoft spokesperson told Which?: 'As our policies clearly state, advertisers who promote financial products and services must ensure they comply with all applicable local laws and regulatory requirements. We encourage people to report possible deceptive or fraudulent ads they may be seeing so we can review and take action as appropriate. We also encourage anyone looking to make an investment to verify the company against the latest FCA register.'
Just entering your email address and phone number on rogue investment sites could leave you facing a barrage of cold calls and unsolicited emails.
Which? is aware that people who entered their contact details on topukbonds.com, for example, were sent emails from '@mizuho.grouppw.com', which attempted to spoof regulated company Mizuho International and fraudulently used the name of a genuine employee. Mizuho reported the malicious emails to the FCA.
Similarly, those who gave their details on bondcompare.org.uk received emails from 'St James [sic] Place Wealth Management'. The messages linked to clone site sjch.co.uk. The real St James's Place confirmed to us that it didn't send the emails, has nothing to do with sjch.co.uk and has no connection to bondcompare.org.uk.
Consumer finance campaigner, Mark Taber, told Which? that he first reported bondcompare.org.uk to the FCA on 17 November 2020 and the City watchdog then added the site to an existing warning on 10 December 2020. But Google was still hosting adverts for the site on 14 December 2020 and it wasn't shut down until 4 February 2021. Other scam sites can remain in search results indefinitely if the FCA can't get them taken down.
Which? attempted to contact topukbonds.com and bondcompare.org.uk via email for comment, but these messages bounced.
The FCA told Which? it undertakes 'daily proactive monitoring' to identify potential scam websites and provides Google with details of the alerts issued on a weekly basis. It works closely with domain registrars, Google, social media firms and other stakeholders to (i) make it more difficult for such illegal content to appear online, and (ii) identify and remove as quickly as possible such illegal content when it does appear.
But a spokesperson said that 'given the speed and ease with which new sites can be set up it is inevitable [...] that new sites [will be] set up in breach of our financial promotion rules'.
While responsibility continues to fall between the cracks of regulators, authorities and online platforms, victims can lose everything.
Losses to clone scams average £45,000, but Which? has heard from victims who lost six-figure sums.
One couple lost £111,000 to a TD Global Finance clone scam - where fraudsters posed as the regulated company - during lockdown in April 2020. They were devastated and unable to trust anyone, telling Which? that they felt 'sick beyond belief' when the truth came to light.
They were initially targeted by phone having entered their contact details online when an existing investment was due to mature. The elaborate con involved: impersonations of TD Global employees; a cloned website (see below); slick company-branded application forms; and even cleverly faked bond certificates.
Mia, an 83-year-old retired teacher, told Which? how she lost £70,000 to convincing clones of legitimate investment firms - Prudential and Macquarie Bank - after searching online for a better savings rate in April 2020. An FCA warning about the cloned Macquarie Bank website wasn't published until May, several weeks too late, and it was a further four months before the regulator published a warning about the Prudential scam.
Mia said she was left 'totally mortified' by the experience and had to seek help from her GP.
Her experience echoed the victims responding to Which?'s survey who reported a negative impact not only on their finances but on their mental health (47%), stress in general (44%), anxiety regarding their finances (43%) and physical health (29%).
One in five said that they didn't even contact their bank or card provider for a refund, in part because they were 'too embarrassed' or thought they should 'bear the burden'.
Which? believes its latest findings are further evidence that the UK government must give online platforms legal responsibility for preventing fake and fraudulent content that leads to scams appearing on their sites - by including online scams in the proposed Online Safety Bill.
Gareth Shaw, head of money at Which?, said: 'The financial strain of the past year and record-low saving rates are pushing more people than ever to look for investments online, just as fraudsters are looking to exploit the uncertainty and confusion caused by the coronavirus - resulting in a perfect storm for scams.'
'Which? has launched a free scam alert service to help consumers spot the latest tactics used by fraudsters, but tech giants, banks, regulators and government must all step up and do much more to stop victims from facing the devastating consequences of scams.
'Scams must be included in the proposed Online Safety Bill so that online platforms have legal responsibility for preventing fake and fraudulent content posted by scammers from appearing on their sites, and are forced to do more to protect their users.'
You can watch the video below for our tips or scroll down for more.
Magazine subscribers also get access to tailored 1:1 guidance from the Which? Money Helpline.