This phone number is a scam, yet it appears on legitimate sites: how is this possible?

Scammers have found a new way to trick people into calling a fake phone number. The ruse is particularly vicious because it displays real websites.

Connecting to the Internet unfortunately exposes you to all the scams set up by malicious people to extract personal information and, ultimately, money from us. A sad reality that pushes us to remain constantly vigilant. Among the most well-known methods is the creation of fake websites that imitate real ones to distribute malware. It's quite easy to spot this by looking closely at the address bar. It displays a URL that isn't that of the real site.

But now imagine that you click on a link and land on a real page like that of Microsoft, Apple, Netflix, or HP. The address displayed proves that you're in the right place. However, one element has no place there since it's a phone number that you should definitely not call. This is what cybersecurity experts at Malwarebytes discovered. How did the hackers manage to do this?

Hackers are making a fake phone number appear on real websites, here's how

First, the scammers buy Google ads, the ones that appear at the top of search results. They link them to legitimate sites like the ones mentioned above. The user will only see the name of the latter in the destination address, for example https://www.microsoft.com.

But the scammer can add parameters directly afterward. Google allows this and will not display them on the client side. When the person clicks on the sponsored link, they arrive at the indicated site, the real one, while the hidden parameters display the fake number. The problem is that the targeted website is not able to tell whether the request it is supposed to execute is legitimate or not. When in doubt, he does it, which leads to this kind of scam.

You can see it in the screenshots above: the number appears in the website's search bar and appears as the support number. This is suspicious for the most attentive, much less so for people who are not used to the Internet or are simply distracted at the time.

If you call the number, a person picks up and introduces themselves as an advisor. Their goal is to get you to give them private data: usernames, passwords, bank details, etc. It's the good old telephone support scam that resurfaces from time to time.

How to protect yourself from telephone support scams

There are simple reflexes to adopt to avoid falling into the trap. It's good to remember them, if only so that you can share them with those around you if you know people who might be fooled. Here are the signs that something is fishy, whether on a real or fake site:

• The phone number to call is listed in the site's search bar or in your browser's address bar.
• The address bar contains words that don't belong there, such as “Call now”, “Emergency support”, or others.
• The numbers in the phone number are interspersed with encoded characters, for example %20 (a space) or %2B (the “+” sign).
• The phrases displayed on the website use a lexical field that seeks to scare you: “Your account has been hacked/blocked”, “Urgent”, “Don't wait”, etc.

In addition to this, of course, there are the warnings that your browser itself, or your antivirus software, should display. Pay attention to them; it's rare that they're a false alarm. Generally speaking, we advise you not to click on sponsored links. And if you've called anyway, it's not too late: as soon as the person on the other end of the line asks you for personal information that has nothing to do with the problem you're calling about (your credit card details, for example), hang up and block the number.