6:40 A.m. The daily MCA debit hits in a few hours, and she wants to see if there's enough in the account to cover it. She types her bank's name into Google. The first result carries a tiny ad label, shows the bank's logo, and looks exactly like the bank's ad always does.
Here's a hypothetical. Marisol (made up) runs Fernbrook Tile & Stone (a made-up contractor). She clicks the top result. The login page looks right. She types her username and password. It asks for the six-digit code her bank just texted her. She types that too. Then: "We're performing scheduled maintenance. Please try again later."
She shrugs and makes coffee. By lunch, a $38,600 wire has left the account. The MCA debit bounces the next morning.
She never clicked a sketchy email. She never answered a weird call. She just searched for her bank.
This is account takeover through fake search ads. The FBI calls the ad trick "SEO poisoning": criminals buy ads that imitate a real bank's ads, send you to a lookalike login page, capture what you type, and use it on the real site to move money. In a November 2025 public service announcement, the FBI said it had received more than 5,100 account takeover complaints since January 2025, with losses over $262 million. The FBI also warns that multifactor authentication will not protect you if you land on a fake login page, because you hand the code to them.
It is still very much live. On September 8, 2026, the Justice Department announced that a web developer had been extradited to Atlanta and pleaded not guilty to charges tied to a scheme that, prosecutors allege, bought paid search-engine ads to divert banking customers to fake login pages, then wired money out. Charges are allegations, not convictions. DOJ said in December 2025 that the related fraud ring had at least 19 known victims, including two companies in the Northern District of Georgia, with about $14.6 million in actual losses. And on October 1, 2026, the FTC asked for public comment on whether search engines and social platforms should answer for ad tools that help impersonation scams spread.
Why this hits MCA borrowers hard: you check your balance more often than almost anyone, usually in a hurry, usually on your phone. And business accounts get less backup than you'd think. Federal Regulation E's unauthorized-transfer protections cover consumer accounts, defined as accounts set up mainly for personal, family, or household use (12 CFR 1005.2(b)). For a business account, what you get back usually depends on your bank agreement and how fast you report it.
Red flags
- The result you clicked is labeled as an ad, even if it shows your bank's real name and logo (FBI).
- The web address is a near-miss of your bank's real one: an extra letter, a swapped word, or an odd ending (FBI).
- The page asks for the one-time code your bank just texted you. The FBI says fake sites prompt for that code so criminals can get past multifactor authentication.
- Someone calls right after, claiming to be your bank's fraud team and asking you to read back a code. The FBI says to hang up and call the number you already have.
What to do
Stop logging in through search. Use your bank's official app or a bookmark you saved from the real site. The FBI says to use bookmarks or favorites for login pages and to avoid clicking search results or ads.
The FBI says to monitor your accounts regularly for wires and withdrawals you didn't make. Bank alerts for logins, wires, and ACH over an amount you pick make that automatic.
If you typed your login into a page that felt off, call your bank right away using the number on your card or a statement. Change that password, and change it anywhere else you reused it.
If money already moved, ask your bank for a recall or reversal and for a Hold Harmless Letter or Letter of Indemnity. The FBI says doing this fast may reduce or eliminate your losses. Then file at ic3.gov and include the words "Account Takeover" or "SEO poisoning," as the FBI asks. Also report at ReportFraud.FTC.gov, and tell your state attorney general. If an MCA debit is about to bounce because of the theft, call your funder before it hits and tell them what happened.
Marisol (made up) still has the bookmark she should have used. It was in her browser the whole time.
Sources:
- FBI, "Account Takeover Fraud via Impersonation of Financial Institution Support," PSA I-112525-PSA (Nov. 25, 2025) - https://www.fbi.gov/investigate/cyber/alerts/2025/account-takeover-fraud-via-impersonation-of-financial-institution-support
- FBI, "Cybercriminals Impersonating Employee Self-Service Websites to Steal Victim Information and Funds" (2025) - https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminals-impersonating-employee-self-service-websites-to-steal-victim-information-and-funds
- U.S. Department of Justice, "Russian National Extradited to United States for Bank Account Takeover Fraud Scheme Causing Millions of Dollars in Losses" (Sept. 8, 2026) - https://www.justice.gov/opa/pr/russian-national-extradited-united-states-bank-account-takeover-fraud-scheme-causing
- U.S. Department of Justice, "Justice Department Announces Seizure of Stolen-Password Database Used in Bank Account Takeover Fraud" (Dec. 22, 2025) - https://www.justice.gov/opa/pr/justice-department-announces-seizure-stolen-password-database-used-bank-account-takeover
- FTC, "Rule on Impersonation of Government and Businesses," advance notice of proposed rulemaking, Federal Register (Oct. 1, 2026) - https://www.federalregister.gov/documents/2026/10/01/2026-20143/rule-on-impersonation-of-government-and-businesses
- 12 CFR 1005.2(b), Regulation E definition of "account" - https://www.ecfr.gov/current/title-12/chapter-X/part-1005/subpart-A/section-1005.2