The top Google or Bing result can be a phishing ad, not the real casino

The scam

You search for a casino or crypto site by name. The very first result looks right: the brand name, a familiar-looking address, maybe even the logo. But it is a paid ad, not a normal search result, and it was bought by a scammer.

The ad takes you to a near-perfect copy of the real site. It then does one of three things:

• asks you to log in, and keeps your email, password and 2FA code;
• shows a deposit address that belongs to the scammer;
• asks you to connect your wallet and sign something that empties it.

The FBI warned about exactly this in December 2022: criminals buy search ads on domains that look like real businesses, and the pages behind them copy the real site, with crypto exchanges a named target. Security firms such as Malwarebytes have kept documenting the same trick against crypto and NFT sites since then. Search engines remove these ads when they are reported, but new ones go up quickly, and a fresh ad can stay live long enough to catch people.

The same method works for any crypto casino login or cashier page. We have not yet verified a case against a specific casino we review, and we will add one here if we do.

How to spot it

1. Look for the “Sponsored” or “Ad” label above the result. On Google and Bing the top results are often ads. An ad is not proof a site is real.
2. Read the address bar after the page opens, not just the address shown in the ad. Watch for extra letters, swapped letters, hyphens, or a different ending (.co instead of .com).
3. Be suspicious of a page that asks you to connect a wallet or log in again straight away, before you’ve clicked anything.

How to protect yourself

1. Don’t click the first result just because it’s first, especially if it’s an ad. Scroll to the normal results, or skip search altogether.
2. Bookmark the real site the first time you find it (for example from its link on our review page) and always use the bookmark.
3. Type the address yourself if you know it.
4. Turn on 2FA with an authenticator app, and check the address again before you enter a code.
5. If you entered your details on a fake page, change your password at once from the real site, and contact the casino’s support through its own website.
6. Report the ad. On Google, open the ad’s menu (three dots) and report it. On Bing, use “Report an ad” from the ad’s menu.