Global fraud losses reached nearly $580 billion in 2025, according to the NASDAQ Global Financial Crime Report, which Google cites in its June scams advisory. Surveys it references suggest about one in five adults fall victim to a scam.
Google’s Trust and Safety analysts used the advisory to describe four patterns they have been watching, each with a tip for users.
Scams hidden in work tools
Scammers are abusing cloud productivity suites to slip past security filters. Google investigated “Calendar Phishing,” where fake renewal notices were added straight into Google Calendar invites. Other scam apps hid malicious instructions and phishing pages on “invisible pages” in cloud documents. The company also tracked campaigns that impersonate known brands to steal session tokens, and a “ClickFix” campaign that spread malware through Google Sites with fake browser update prompts.
The tip: do not scan a QR code from an unexpected email with a personal phone. Go straight to a service’s official website instead of clicking links or calling numbers in surprise notifications.
Crypto and investment fraud
Americans reportedly lost more than $11 billion to cryptocurrency scams in 2025. Google is tracking fake token giveaways, fraudulent “passive income” mining software and misleading bot-building tutorials. In the tutorial scams, a guide walks victims through setting up a crypto node, and the code they run drains their wallets.
The tip: be wary of any crypto offer promising risk-free or “guaranteed” returns, and never paste unknown commands from an online tutorial into a computer’s terminal.
Extortion through finance apps
Mobile extortion has grown, Google said, particularly through malicious loan and banking apps that demand access to contacts, SMS history and photos. Some operators then use the stolen data to extort and publicly shame victims. To get past app store checks, attackers submit a harmless-looking utility app, then update it later with extortion malware. Google says it now prioritizes spotting “dormant” permissions and auditing app behavior after installation.
The tip: install finance apps only from official stores, and grant access to contacts, photos or SMS only when the app truly needs it.
Fake police and ministries
The fourth pattern is impersonation of law enforcement and government. Google says it is active across South Asia, Southeast Asia and Gulf Cooperation Council countries, with targets in Oman, Singapore, India and the United Arab Emirates. Scammers register bulk Google accounts with official-sounding addresses, then reach victims on third-party messaging apps with meeting invites. High-pressure voice or video calls follow, sometimes called “digital arrests,” ending in demands for “legal fees” or banking credentials.
Google says it suspends accounts engaging in government fraud. It also plans to require developers to verify their name, address and ID for apps on certified Android devices, including apps installed outside the Play Store.
The tip: real police forces and government departments will not contact you on messaging apps to demand payment or credentials. In Google Meet, users can set “Only contacts can call me.”
