You need to check your bank account, so you open Google, type in your bank's name and click the first result that looks right.
asserted
that → need → result
Most of us have done some version of that without thinking twice.
asserted
Most → do → that
Now federal investigators say criminals turned that everyday habit into a way to steal bank logins and drain accounts.
asserted
criminals → say → accounts
The Justice Department announced on Sept. 8 that a Russian web developer accused of helping run a large bank account takeover operation had been extradited to the United States.
asserted
developer → announce → States
Prosecutors say the group bought sponsored search engine links that sent banking customers to fake login pages.
asserted
that → say → pages
Victims then entered their credentials, believing they had reached their bank.
asserted
they → enter → bank
That should get the attention of anyone who banks online.
asserted
who → get → anyone
Here's how the scam works, why those sponsored results can look so convincing and what you can do to avoid handing your bank login to a criminal.
asserted
you → work → criminal
Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor.
asserted
you → get → doctor
No technical experience is needed.
asserted
experience → need → ?
Save your free spot at CyberGuyLive.com
How the fake bank ad scam worked
According to federal prosecutors, the alleged operation used spoofed domains that mimicked websites belonging to federally insured financial institutions.
uncertain
that → save → institutions
The conspirators then bought sponsored search engine links.
asserted
conspirators → buy → links
Those links could appear when someone searched for their bank.
uncertain
someone → appear → bank
A click sent the customer to a fraudulent login page.
asserted
click → send → page
Once victims entered their credentials, the attackers could capture that information.
uncertain
attackers → enter → information
Prosecutors say the group then used the stolen credentials to access real bank accounts, check balances and initiate unauthorized wire transfers.
asserted
group → say → transfers
The indictment also alleges that Sergei Anatolyevich Filimonov developed and maintained infrastructure supporting the operation.
asserted
Filimonov → allege → operation
That included databases storing more than 5,000 stolen login credentials and software designed to capture sensitive authentication data.
asserted
That → include → data
Where Google and Bing come into the story
asserted
Google → come → story
The newest Sept. 8 Justice Department announcement says the conspirators purchased sponsored search-engine links.
asserted
conspirators → say → links
It does not name a particular search engine.
asserted
It → name → engine
However, the DOJ previously described the same bank account takeover operation when it seized the group's backend domain in December 2025.
asserted
it → describe → December
In that announcement, investigators specifically said the criminal group delivered fraudulent advertisements through search engines including Google and Bing.
asserted
group → say → Google
The ads imitated sponsored search ads used by legitimate banks.
asserted
ads → imitate → banks
Victims who clicked those ads were redirected to fake banking websites controlled by the criminals, according to the DOJ.
uncertain
who → click → DOJ
That earlier investigation had identified at least 19 victims across the United States by December 2025.
asserted
investigation → identify → December
The DOJ reported approximately $28 million in attempted losses and about $14.6 million in actual losses tied to those victims.
asserted
DOJ → report → victims
Microsoft told CyberGuy that it has policies and detection mechanisms designed to help prevent misleading advertising.
asserted
it → tell → advertising
The company said that when it becomes aware of ads that violate its policies, it takes action to remove them and uses what it learns to strengthen its detection capabilities.
asserted
it → say → capabilities
Microsoft also encourages users to report suspicious ads through its "Report a Concern" form.
asserted
Microsoft → encourage → form
We also reached out to Google for comment but did not hear back before our deadline.
asserted
We → reach → deadline
Why a sponsored Google result can fool you
The trap works because a paid search result can appear in a place many of us naturally look first.
asserted
many → fool → us
You search for your bank.
asserted
You → search → bank
A result appears near the top.
asserted
result → appear → top
The wording looks familiar, so you click before studying the address.
asserted
you → look → address
Still, the FBI warns that criminals can buy ads that imitate real businesses and direct users to convincing phishing sites.
asserted
that → warn → sites
The FBI refers to this tactic as SEO poisoning in its account takeover guidance.
asserted
FBI → refer → guidance
That changes how I would approach something as sensitive as online banking.
asserted
I → change → banking
In fact, the FBI specifically recommends using bookmarks or favorites to reach login pages rather than clicking search results or advertisements.
asserted
FBI → recommend → results
Bank account takeover losses have topped $262 million
This problem stretches far beyond one alleged criminal operation.
asserted
problem → top → operation
…and 56 more, not listed.
The Aporia
