You type your electric company’s name into a search engine, click the first result, and pay your bill. This month, the Federal Trade Commission warned that the first result is sometimes an ad - and the “company” you just paid is a stranger in a very good costume.
I know how natural that feels, because I have done it myself. The bill is due, you are short on time, and the search box is how we find everything these days. Why would paying a bill be any different?
It is different, and the FTC just proved it. On August 17, the agency announced a $2.1 million settlement with a bill-payment company called Doxo, and warned that search ads can wear any biller’s name. The FTC says Doxo bought search ads that made it look like the biller itself - AT&T, Labcorp, state agencies - using the real company’s name and logo. People clicked, paid their bill through Doxo, and later found the fees nobody mentioned, or the “membership” they had been signed up for without asking. Some payments never reached the company they owed at all.
This is the newest costume in the scam series we have been tracking. The first article covered the fake bank call, the second covered the recovery call that comes after a scam, and the third covered the gold-bar swindle. This one is different: it does not need a phone call, a text, or a knock on the door. It happens on the search results page - the exact place you go to do the right thing.
Here is how the script runs, the two tells that give it away, and the habit that ends it.
The Script, Step by Step
Step one: the search
You type the company’s name into a search engine. Maybe you add “pay my bill” to land in the right place. This feels safe. It is the same way you find the weather, the news, the dentist.
Step two: the ad
Look at the top of the results page. The first few results are usually ads. There is a small label - “Sponsored” or “Ad” - tucked in a corner, easy to miss on a phone screen. One of those ads uses the name and logo of the company you owe. It looks exactly like the company’s own listing, because it was designed to.
That ad is where the impersonation starts. The company you owe did not buy it. A stranger did.
Step three: the lookalike page
You click the ad and land on a page that looks right. The logo is there. The colors are right. It asks for what you expect: your account number, your email, your payment. Nothing announces it as a third party - that is the whole point.
Step four: the payment
You enter your card or bank details and pay. It feels done. The bill is handled.
Step five: the surprise
This is where it turns. A “delivery fee” appears at the end, or a “processing fee” you were never told about. Or the page signs you up for a subscription with the payment - a “membership” that saves you money, with a free trial that starts charging. The FTC’s case against Doxo was built on exactly those two things: undisclosed fees and subscriptions people did not ask for.
Step six: the real bill
Days later, the real company sends its usual reminder. Your payment did not reach them - or it arrived late, after the due date. Now you owe the bill again, plus a late fee, plus whatever the middleman charged you. You did everything right, except for one click.
Why It Works So Well
The scam hides inside a good habit. Searching for a company before you do business with it is normally the careful thing to do. The people running this are not fighting that habit. They are renting space in it.
We trust the top result. When we search, we assume the first thing we see is the best answer - search engines taught us that for twenty years. But the top spots are for sale. Anyone can buy them, and when an ad uses another company’s name, the search engine does not check who is behind the costume.
This is not a secret. The FTC warned about the same company back in 2024, and this month it made the company pay $2.1 million to settle. The warning is standing. The ads did not stop because one company got caught. They stop when the people clicking them learn to look.
The other thing that makes it work: paying a bill feels like a chore, not a risk. Nobody gets a thrill from paying the electric bill, so nobody expects the search box to be the attack. The scammer is betting that you will be in a hurry, on a small screen, and done thinking as soon as the money leaves.
The Two Tells That Give It Away
That is the whole test, in two sentences.
Tell one: how you got there. Did you type the address yourself, or did you click a result? The address bar is the truth. The real company’s web address is on your paper bill, in your app, on your statement. If the address in the bar does not match the one you already know, you are not on the company’s site - no matter how official the logo looks.
This is the same rule from the first article in this series, moved from the phone to the web. With the fake bank call, you hang up and call the number on the back of your card. With a bill, you close the tab and type the address from your paper bill. The number on the card is the only one that is real. The address on the bill is the only one that is real.
Tell two: the page asks for more than the bill. The company you owe money to does not need to charge you a surprise fee to collect its own bill. A delivery fee. A processing fee. A “membership” to make payments easier. None of that is the bill. The FTC’s own words for what Doxo added: fees people were not told about, and subscriptions they did not ask for. When a page asks for more than the bill, it is not the company’s page. Close it.
The confirmation check. One more three-second check, for after you pay: a real payment produces a confirmation from the real company. Not a receipt from the payment service - from the company you owe. Keep it. If you cannot find one from them, the payment did not reach them, and that is the moment to act.
What to Do at Each Step
If you are about to search for a company to pay: do not. Use the app you already have, a saved bookmark, or the address printed on your paper bill. That address is the only one that is definitely the company’s. If you must search, scroll past the ads. The real listing is below them - and it is not labeled “Sponsored.”
If you already paid through a page you do not recognize: check whether the payment reached the company. Log in to your account the normal way - the app or the address on your bill - and look. If the bill is still unpaid, call the company using the number on your statement, not the number on the page you paid. Tell them what happened. They have heard it before.
If you see a “membership” or subscription charge you did not ask for: cancel it, and dispute the charge with your card issuer. A charge you were not told about is the kind of thing card companies handle every day.
If the page asks for more than the bill, at any point: close it. That is the tell, in bright letters. No legitimate biller adds a surprise fee at the end of a payment.
If It Has Already Happened
If the fees are already taken, here is what actually helps.
Dispute the charge with your card issuer. This is one of the few scams in this series where the money can actually come back. You paid by card, the fee was not disclosed, and the payment went somewhere you did not choose. Card companies have a process for this. Call the number on the back of your card and start it today.
Call the company you owe. Use the number on your bill. Confirm whether your payment reached them. If it did not, make the payment the normal way - the app or the address on your paper bill - and ask about the late fee. Some companies will remove a late fee when you explain that a third party intercepted your payment.
Check your statements for the subscription. The quietest part of this scam is the charge that keeps coming. A “membership” you did not ask for can bill for months before anyone notices. Go through the last three months of card statements and look for charges you do not recognize. Cancel the subscription, then dispute the charges.
Report it at ReportFraud.ftc.gov. Ten minutes. It will not get the fee back, and I am not going to pretend it will. But the FTC’s case against Doxo started with consumer reports like yours. Your report is how the next pattern gets caught.
Here is the honest part: the amounts in this scam are usually smaller than the ones in the earlier articles in this series. A fifteen-dollar fee here, a late fee there, a subscription you never noticed for a few months. That is exactly why it is dangerous. It does not need to empty your savings to hurt you - it just needs to happen every month, to enough people, quietly.
The One Conversation
If this is your parent or grandparent, have the same short conversation from the last article, with the new version added:
“If you are paying a bill, type the address yourself - the one on the paper bill. If the page asks for more than the bill, close it and call me first.”
That is the whole conversation. The bill-pay impersonator, like every costume in this series, cannot survive one check-in with a person who loves you.
What to Do Now
Take the next step today, whichever one fits:
- If you pay bills online: find the address on your next paper bill and bookmark it. That bookmark is now the only address you use for that company.
- If an older relative pays bills online: have the one conversation today. “Type the address yourself. If the page asks for more than the bill, close it.”
- If you already paid a page you do not recognize: check your account today, and dispute any fee or subscription you did not ask for.
Remember the two tells. The real company’s address is the one on your paper bill. And a page that charges you more than the bill is not the company’s page.
The first result is not the answer. It is an ad - and ads can be lies. Now you know the difference.
This is the fourth article in the Scam Awareness series. More coming - if there is a scam you keep hearing about and want explained, let me know and I will write it up.
If this helped, there is more where it came from. The Basic Hub sends one practical guide a week - no spam, no jargon. Sign up below so the next one finds you.