Google’s Trust & Safety teams warn of new twists in phishing, crypto scams, mobile extortion, and police impersonation

Google’s Trust & Safety teams on Monday published a new fraud and scams advisory, outlining four scam trends the company says it has recently observed, along with what it recommends users do to reduce risk. The June 8 post, led by Laurie Richardson, frames online scams as a persistent global challenge driven by transnational crime groups that exploit people for financial gain, and it cites estimates that total global fraud losses were nearly 580 billion dollars in 2025. Google also references broader survey findings that roughly one in five adults fall victim to scams at some point.

A first theme is “Adversary-in-the-Middle” (AITM) phishing, where attackers position themselves between a user and a legitimate login flow to capture credentials and session data. Google says traditional email phishing has evolved into AITM and “quishing,” which uses QR codes to route victims to malicious destinations. The company added that phishing volumes remain high despite industry actions targeting major “Phishing-as-a-Service” kits. In Google’s account, attackers can mirror legitimate login flows to collect a user’s password and session cookie and, in some cases, bypass multi-factor authentication. The post also says scammers host malicious payloads on reputable cloud properties to evade security scanners.

Google describes how scammers are increasingly abusing trusted cloud productivity and file-sharing environments to bypass defenses. It points to “calendar phishing” in which fake renewal notices are added directly to Google Calendar invites, and it says scam apps can use “invisible pages” in cloud documents to embed malicious instructions and phishing landing pages that avoid standard web filtering, a tactic Google also refers to as “reputation bypass.” The advisory also mentions campaigns that impersonate recognized brands to steal session tokens and a “ClickFix” approach that uses fake browser update lures distributed via Google Sites. Google says it responds not only with technical mitigations, including protections for active session credentials, but also with litigation aimed at disrupting the infrastructure used to run these scams.

The advisory then turns to investment fraud, with Google singling out cryptocurrency scams that it says often rely on the complexity of blockchain technology to sell “too good to be true” opportunities. Google cites FBI reporting that Americans lost more than 11 billion dollars to cryptocurrency-related scams in 2025. It says scammers promote schemes such as fake token giveaways, fraudulent “passive income” mining software, and tutorials that guide users through building “nodes” or other infrastructure. In Google’s description, victims follow step-by-step instructions, then run code that ultimately drains their wallets. The post also says scammers use on-screen QR codes or description links to push victims toward phishing forms or malicious downloads.

Next, Google highlights mobile scams, particularly “mobile extortion” delivered through malicious banking and finance applications. Google says these apps disguise themselves as personal finance tools while requesting excessive system permissions such as contacts, SMS history, and photo access, then using stolen data to extort victims or publicly shame them. The company also argues that attack methods keep changing, including an approach where scammers submit a legitimate-looking utility app during review and later update it into an extortion application that abuses accessibility services after installation. Google says its Trust & Safety work prioritizes the detection of dormant permissions and a monitoring layer to audit app behaviors after installation, and it reiterates existing scam warnings inside Google Messages and Phone on Android.

Finally, Google warns of a surge in police impersonation schemes in which scammers exploit trust in law enforcement and government institutions to carry out financial extortion. It says these operations are active across South Asia, Southeast Asia, and countries in the Gulf Cooperation Council, and it describes a workflow in which scammers create bulk accounts and register email addresses that resemble official authorities. Google says the scams often move victims to third-party messaging apps using deceptive meeting or calendar invitations, then escalate with high-pressure voice or video calls it labels “digital arrests.” The post says scammers may demand upfront legal fees or seek sensitive banking credentials. Google also says it uses policy enforcement, including Gmail and impersonation-related controls, to suspend accounts it identifies as participating in governmental fraud.

Google’s advisory is presented as a set of observations and safety guidance rather than a disclosure of internal performance metrics. It does not provide, in the post itself, specific numbers on how many accounts were suspended for each scam category, how quickly enforcement actions were taken, or the measurable effectiveness of each defense at the user level. It also does not specify the geographic rollout details or timelines for a newly described app developer identity verification requirement for certified Android devices, including how it will be enforced outside the Play Store. What to watch next is whether Google continues to expand its layered defenses against AITM and cloud-based phishing, deepens mobile-app behavioral monitoring, and pushes policy and identity requirements further into the Android ecosystem as scam infrastructure evolves.