Search Parameter Injection Fake Support Number Scam

Overview

Scammers buy sponsored Google ads that use malicious URL parameters to inject a fake "customer support" phone number directly into the real, legitimate website of brands like Netflix, Apple, Microsoft, and Bank of America. Because the page is 100% authentic and the address bar shows the real domain, victims have no reason to suspect the number is fraudulent.

How It Works

A person searches Google for a company's customer service number and clicks a sponsored ad that actually leads to the genuine brand website. However, the ad's URL contains crafted search-query parameters that exploit a "reflected input vulnerability" — the site's own search function blindly displays whatever text is fed into that parameter without sanitizing it. This lets scammers make their own phone number appear prominently inside what looks like an official search result or support section on the real page. The browser address bar shows the legitimate domain, so there's no obvious red flag. When the victim calls the number believing it's the company's real help line, scammers posing as support agents ask for login credentials, financial account details, or remote access to the victim's device under the guise of resolving an account issue.

Red Flags

• A phone number embedded directly in a long, odd-looking URL with lots of encoded characters
• The support number appears inside a search results box on the page rather than in the company's normal official contact page
• You reached the page by clicking a sponsored/ad link from a search engine rather than typing the company's URL or using its app
• The phone agent immediately asks for passwords, account credentials, or remote-access software installation
• The displayed number differs from the number listed in the company's official app or billing statements

Real Examples

• Malwarebytes identified fake support numbers inserted into real pages for Apple, Bank of America, Facebook, HP, Microsoft, Netflix, and PayPal via sponsored search ads using malicious URL parameters.
• Researchers found Netflix's own search function would blindly reflect whatever text was placed in its query parameter without sanitization, letting scammers display their number as if it were an official result.
• Malwarebytes' Browser Guard displayed a 'Search Hijacking Detected' warning after flagging the unauthorized number insertions on these hijacked but genuine pages.

Where It Spreads

How to Protect Yourself

• Never trust a phone number that appears after clicking a sponsored search ad — navigate to support pages directly through the company's app or by typing the known official URL
• Verify any customer service number against the back of your card, a billing statement, or the company's official app before calling
• Use a browser security extension capable of detecting search/URL hijacking attempts
• Never give remote access to your device or share one-time codes/passwords with anyone who called or whom you reached via a number found in search results
• If you already called a suspicious number, change your passwords and monitor financial accounts immediately

Related Scams