The human side of the numbers is hard to shake: nearly $580 billion lost to fraud worldwide in a single year, and roughly one in five adults taken in — estimates drawn from the NASDAQ Global Financial Crime Report and cited by Google itself. On 8 June 2026, the company’s Trust & Safety teams published a fraud-and-scams advisory through its Safety & Security blog, mapping the scam families now reaching users across its ecosystem. “Our teams use the latest in AI capabilities to prevent, detect and respond against evolving scam tactics,” said Laurie Richardson, Google’s Vice President for Trust & Safety, in the advisory.
What the document names is a sobering catalogue. Four families, by its own grouping:
Advanced phishing that gets around two-factor login. The adversary-in-the-middle kits here — Tycoon 2FA is the one Google names — capture not just the password but the session cookie minted after a second factor checks out, sidestepping the protection entirely. Around it orbit “calendar phishing”, which plants scam links inside automatic calendar invites, and “ClickFix” pages, fake browser-fix screens that talk a user into pasting a malicious command into their own machine. QR-code “quishing” rides the same wave.
AI-assisted cryptocurrency investment fraud. Fake token giveaways and bogus “passive income” mining software that empties a wallet the moment its code executes. Google ties cryptocurrency scams to US losses of more than $11 billion in 2025.
The third family is malicious mobile finance apps. Programs demanding permissions they have no reason to need, or carrying dormant malware that wakes after install — sometimes gaining extortion features only once a store review is behind them.
And police impersonation, the so-called “digital arrest”: video calls from fake officers demanding upfront fees, complete with official-sounding email addresses. Google flags these as running hottest through South and Southeast Asia and the Gulf states.
Behind the breakthrough in candour sits an awkward detail. A calendar phish lands in Google Calendar; the ClickFix lure borrows a Chrome update’s face; the malicious finance app ships from the Play Store. None of these are the web’s shady corners but its trusted default surfaces — platforms whose promise is precisely that a user ought never to double as the safety net. Even so, the advisory’s consumer advice is sound, and its honesty unusual; it is also, read closely, a quiet admission that for now the final responsibility lands on the user’s own vigilance.
The company is not standing still, and the advisory details the countermeasures. Google, it says, is deploying Device Bound Session Credentials, which render a stolen session cookie useless on any other machine — a direct answer to the adversary-in-the-middle kits. It details litigation against phishing-kit operators, and an Android Developer Verification Program aimed at fake government apps, alongside advertising-policy enforcement against impersonation.
A brand-protection firm’s later reading of the advisory made the deeper point. Strip away the technology and every technique in the catalogue — the lure page, the calendar invitation, the malware hosted on a google.com site in what the advisory calls “reputation bypass”, the crypto ad wearing an exchange’s logo, the fake police sender — works the same way: it hijacks a name the victim already trusts. Google can secure its own surfaces, that analysis argued, but the impersonated names and the domains wearing them mostly live outside its reach, which is where much of the damage concentrates.
What this means for families is a short list, and none of it requires a security degree. Never scan a QR code that shows up unannounced, in a message or on a poster; go to the real site yourself. Never paste a command into a terminal because a web page told you to — a real browser update never asks. Treat every guaranteed-return or passive-income crypto pitch as fraud, especially one that arrives via a stranger or a romance. Finance apps: the official store only, and refuse anything demanding needless permissions. And never act on an unsolicited contact claiming to be a bank, a government agency, or a platform’s security team — verify on a number or site you found yourself. One warning deserves underlining: a public advisory like this reliably becomes bait, with impostors posing as “Google security” or a recovery service. Ordinary users do not get phone calls from Google to fix an account or take money. The cure being sold is the next scam.
Sources
- Google's June 2026 Scams Advisory: What It Flags | Tutela Digitalis
- What Google's Fraud Advisory Reveals About Impersonation – Allure Security
