Safe browsing and search practices
Is your browsing secure?
SPONSORED BY
By Sydni Silverstone on August 18, 2026
Commercial fraud playbook lesson 3:
One morning in May 2026, an ABC Company employee Googled Frost Treasury Connect and, unbeknownst to him, received a fraudulent site in the results. After clicking the bad link, he was taken to a login page with username and password prompts. Designed to be a lookalike of the real Frost Connect login page, the employee didn’t notice anything amiss. So, like always, he entered his credentials.
This small ask allowed the imposter to capture login information to access ABC Company's Frost Connect profile. Once Frost Connect was accessed, the imposter initiated two wire transfers totaling $486,015.25 from the customer’s Frost Bank account.
That same day, Frost Bank’s Fraud department flagged suspicious activity on ABC Company’s account and reached out to a representative of the company who confirmed that the two wire transfers were indeed fraudulent. How did this happen? The employee wondered. Frost Bank advised the ABC employee that what he’d assumed was the valid Frost Connect website was, in fact, a fraudulent site. Because the Fraud department identified the suspicious activity, no funds left Frost Bank. But it was a close call.
Many of us do what the ABC Company employee did every day. It’s become commonplace to search for a website rather than typing the URL in directly, even ones we use frequently. This habit has opened a vulnerability that scammers can exploit, and they are doing so on a large scale.
In 2025, the FBI’s Internet Crime Complaint Center logged more than one million complaints, with reported losses approaching $21 billion. Phishing and spoofing were the most-reported crime category of all, in part powered by a rise in SEO poisoning, lookalike sites, and other security weaknesses.
SEO poisoning refers to a scammer engineering fraudulent pages to rank at the top of search results (or simply buying the top ad slot). Once a niche scam — creating a fake search result, then using it to steal information — SEO poisoning has gone mainstream, with the FBI issuing public warnings about this type of scam.
The good news is there are plenty of defenses against these new scams. Here’s what to look out for and what to do about it.
1. Poisoned search results, ads and AI
What it is: Fraudulent websites engineered to appear at or near the top of search results for banking platforms, login pages, or other secure sites.
How it works: Criminals either manipulate search rankings or simply purchase the top sponsored slot, logo and all. Fraudulent sites are unconsciously given credence by both their placement, and their inclusion with other, legitimate sites. Criminals have even begun tailoring pages specifically to be picked up by AI. Asking an AI assistant for a login page feels like the careful move. It isn't.
Red flags: "Sponsored" or "AI" label above a result for a financial institution. Any login page you arrived at by searching, clicking an ad, or asking an AI assistant.
What to do about it: Stop using search engines for secure websites. Bookmark your most important sites instead. If you do use a search engine, be skeptical of the top result — it’s often an ad. Lastly, don’t rely on AI to find the right result.
3. On your device: pop-ups, updates, and connections
What it is: Everything that happens after you land on a page: the prompts asking you to act, the network you're on, and how recently you've updated your device. Each one is potentially a separate entry point for fraud.
How it works: Pop-ups impersonate system warnings, virus alerts, and session errors, often with a phone number attached that routes to a criminal call center rather than the company named on the screen.
A fast-growing variant impersonates the "verify you're human" box you have cleared a thousand times. Rather than asking you to identify crosswalks or type wavy characters, it instructs you to press a sequence of keys — commonly Windows + R, then Ctrl + V, then Enter. Those keystrokes paste and run a hidden command that installs credential-stealing software on your own machine. Because you ran it yourself, no download warning ever appears.
Whether a moment like that becomes an incident often depends on the device it happens on. Software updates exist largely to close security holes criminals already know about, so every deferred update leaves a published weakness sitting open. The same is true of the network: public Wi-Fi at an airport, hotel, or coffee shop is easy to impersonate, and a device left open on one is a device left open to anyone.
Red flags: Any verification step that asks you to leave your browser, open a system window, or run a command. A pop-up displaying a support phone number, or one that reappears after you close it. Update reminders you've dismissed more than once. Banking or approving payments over a public network.
What to do about it: Real verification happens inside the page. Nothing legitimate will ever ask you to run something on your device. Close pop-ups with the X in the corner but never by clicking inside the window, and if one won't close, close the browser entirely. When you need to reach your bank or other sensitive sites, use the number on your statement or the back of your card, never one displayed on a screen. Install operating system, browser, and application updates promptly; they are security patches far more often than they are new features. And use a trusted VPN whenever you access financial accounts away from your office network.
2. Lookalike sites and the problem of the padlock
What it is: A near-perfect replica of a legitimate login page, hosted at a web address built to survive a quick glance.
How it works: Fraudsters register domains that differ from legitimate ones by a single character, hyphen, or a different top level domain (.com, .gov). From there, they copy the real page’s layout, colors, and logo. If you’re under deadline pressure, on a laptop screen, or just not paying attention, the difference can be tough to spot.
Red flags: URLs that are slightly different or hard to identify at a quick glance. Think "Forstbank.com" instead of "Frostbank.com" or "Frostsecureconnect.com" instead of "Frosttreasuryconnect.com."
The https and padlock problem: Seeing "https" in a URL or a little padlock in the browser bar used to connote secure connections. Not anymore. All they signify is that the site and your connection are encrypted. It doesn’t mean it knows who is on the other end. Today’s fraudsters can easily obtain encryption for their scam sites.
What to do about it: Lookalike sites do have tells. Check your URL for small misspellings, a stray hyphen, or a bogus top level domain.
Remember, Frost will never ask for a one-time passcode, PIN, or password by phone, text or email, and will never send links during unsolicited phone calls. As the ABC Company case shows, a fraudulent website and an impersonation call are often two halves of the same attack.
The extent of these scams may sound intimidating, but one simple rule will help you avoid being scammed through a bad search, pop-up, or lookalike site. Never navigate to something important from a place an attacker can influence. Search results, ads, email links, AI summaries, public Wi-Fi, and pop-ups are all vulnerable. Bookmarks, statements, and the back of your bank card are not.
1. https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
2. https://www.ic3.gov/PSA/2025/PSA250424
3. https://www.malwarebytes.com/blog/news/2026/02/criminals-are-using-ai-website-builders-to-clone-major-brands
Back to hub
1
2
3