05 Nov 2026 Search

I can’t make this stuff up. Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign on InfoHawk.

Step one is

The victim arrives from a search ad A Google Search ad imitates the restaurant’s listing and shows a look-alike domain.

Some scammer registers a domain, and Google “helpfully” allows them to run ads using a registered trademark of a real restaurant.

One more good example of how the Google Search trademark policy is the greatest criminal scheme of the 21st century. In this case, Google isn’t helping to steal $6 billion in cryptocurrency, but all of these little crimes add up, too.

I really wonder how much the incremental search ad revenue for Google compares to the losses resulting from these, both for individuals and for the legitimate businesses that have to clean up after fraud and lose a real sale. This really looks like “break a plate glass window to steal a $3 cable” level of crime.

The problem with the trademark policy for Google Search ads is—Google doesn’t enforce it, unless someone complains about a specific ad and advertiser.

And the people who know which ads to complain about aren’t the people who get targeted for the ad. Google’s machine learning systems “learn” to match the ads with people likely to click. So a legit trademark holder isn’t going to see the fake—likely victims are.

Combine that with how the ads are designed to be harder and harder to tell from real results, and Google has designed pretty much an ideal system for distributing malware and scams. Even if they did decide to staff up and fund the abuse department, the fundamental qualities of the system are rigged for, not against, abuse.

But number must go up—scam ads don’t just bring in ad revenue, they bid against the legit ads for the same slots, so they drive up ad rates for other advertisers, too.

Election news

Monique Priestley has been elected to the state Senate in Vermont, representing Orange County. Yes, this week was a big election for the Internet, but this particular result is encouraging in another way.

I spent $0 supporting Meta & Google which earns billions of dollars annually off of unchecked fraud and scams, supports child s*xual abuse material (CSAM) websites with ad placements, and seeks to addict and manipulate people of all ages. I spent $0 on targeted ads abusing your sensitive data (your phone number, IQ, education level, annual income, and political leanings, as examples)….My campaign used privacy-protective, non-traditional platforms to fundraise and manage voter information.

It’s possible to win without Google and Meta.

And that’s good. Brazil isn’t the only country that’s going to have to come up with a way to protect people from the various harms that these companies inflict, and their influence on politics. Just having them steal your sandwich is getting off lightly.

Here in the USA, most of the potential for improvement is at the state level, at least for now.

States are going after Meta and Google about a variety of bad behavior, including privacy violations and mental health issues with habit-forming design. But if you grab on to a Big Tech scheme and really follow it backward, every harm perpetrated against a user is the result of some scheme against an advertiser. Google didn’t set out to steal your sandwich—that was a side effect of policy changes made to unfairly drive up the price of search ads, above what legit restaurants would pay.

A solid advertiser protection law would end up mostly helping consumers, by cutting off user harms at the root. (Related: a privacy law shortcut)

In The answer to fighting ad fraud goes further than regulators’ proposals, Rob Leathern from InfoHawk is partly right about ad libraries. But every ad needs to be in a library, and every user of the platform needs to be able to see it. Privacy is about collective safety. A library only for “qualified organizations” is not enough—if Big Tech knows anything about existing qualified organizations, it’s how to subvert or neutralize them. A new trademark enforcer or NGO with a better algorithm, or an investigator on a trial engagement from a legit advertiser needs to be able to sniff around without warning. And platforms have enough bandwidth to make life hell for owners of small business websites, they should be able to host ad libraries with some of it.

More later.