Scammers are hiding behind Google's ‘click-to-call’ ads

Scammers are abusing Google's advertising platform to target customers of telecoms and utility brands and trick them into giving away sensitive information. 

The click-to-call feature instantly starts a phone call with a business when you click an advert on your mobile device. It's theoretically a convenient way to get hold of a company, but scammers continue to create fake adverts that appear at the top of search results. Our advice is to steer clear. 

We've previously warned about a similar scam targeting British Airways customers using the Bing search engine to search for contact details. 

Read on to find out how these scams work and what you can do to avoid them.

Scammers impersonating Three Mobile 

A series of bogus adverts targeting Three UK customers appeared in Google searches such as 'call Three' or 'Three mobile help' in late September 2025. 

Despite these advertisers being verified by Google – meaning they passed at least basic identity checks – they promoted websites that were clearly intended to deceive, as they claimed to offer '24/7 support from Three' and had domain names that referred to 'threemobilephones' and 'threemobiledeals', but had nothing to do with the real company. 

When we tested the phone numbers listed, some were disconnected, but others were answered by call handlers who pretended we had reached the Three customer services call centre. During one phone call, I was asked to share an email address and my Three password, potentially enough information for fraudsters to take over my mobile phone number, known as Sim-swap fraud. 

Online security firm Marcode spotted many of these fakes as part of its work monitoring adverts for impersonation scams across various search engines and social networks. 

Marcode co-founder Andy Cooney explained: ‘We’ve detected a large number of advertising accounts running fake click-to-call ads, specifically to target customers looking for support from telecoms and utility brands. They use domain names that look like the brand they are targeting, use the trademark of the brand and are free to pay to appear next to brand keywords. 

'Google’s verification only proves the account buying the ads is a real company. It doesn’t prove they are associated with the brand they are pretending to be. We track them operating across multiple brands, often for weeks.’

What is Google doing to stop this scam?

Which? reported nine advertisers to Google and we expressed our concerns that it had sold ad space to obvious impersonation scammers. 

Google told us: ‘We have removed the ads shared with us and suspended the associated accounts for violating our policies. We expressly prohibit ads that scam people by misrepresenting information about products or services.’

Improving the vetting processes of advertising giants like Google is only part of the story – scammers are also finding it far too easy to register clearly malicious domain names. 

Brands such as Three UK also rely on registrars (the businesses hosting the domain names) to shut down copycat websites quickly. Most of the dodgy websites we reported were removed, but one is still live months later, despite Three UK reporting it to the registrar for malicious activity.

Three UK told us that it blocks confirmed fraudulent URLs at a network level. It also said it actively monitors for suspicious domains and works with registrars and industry bodies to remove them quickly.