Fake renewal notices slipped into Google Calendar invites. Malicious instructions tucked inside “invisible pages” of cloud documents. Those are two of the tricks Google’s analysts describe in the company’s latest Scams Advisory, published on June 8, 2026.
The advisory opens with the scale of the problem. The NASDAQ Global Financial Crime Report puts total global fraud losses at nearly $580 billion for 2025, and global surveys suggest roughly one in five adults fall victim to scams. Google says its teams use AI tools to prevent, detect and respond to new tactics, and publish their findings regularly.
Trusted tools turned against users
Scammers are borrowing the credibility of cloud productivity suites to get past security filters. Google investigated “Calendar Phishing,” in which fake renewal notices were added straight to calendar invites. It also found scam apps hiding instructions and phishing landing pages in invisible pages of cloud documents, a method known as “reputation bypass.” Two further cases: campaigns aimed at email users that impersonated recognised brands to steal session tokens, and a “ClickFix” campaign that used fake browser update lures to spread malware on Google Sites.
Google’s advice is simple. Do not scan a QR code from an unexpected email with your personal phone. Go to a service’s official website yourself rather than clicking links or calling numbers in a surprise notification.
Crypto and finance apps
Americans reportedly lost more than $11 billion to cryptocurrency-related scams in 2025. Google is tracking fake token giveaways, bogus “passive income” mining software and bot-building tutorials. In the tutorial scheme, someone walks viewers through setting up a crypto node to earn rewards, but running the supplied code drains their wallet. On-screen QR codes or links in video descriptions send victims to phishing forms or malicious downloads.
The advisory says to be wary of any investment offering risk-free or “guaranteed” returns, and never to paste unknown code into a computer’s terminal.
Mobile extortion, which Google flagged in its November 2025 advisory, has also grown, particularly through malicious banking and finance apps (McAfee research). Many pose as personal finance tools and demand access to contacts, SMS history and photos. Some operators use the stolen data to extort victims and shame them in public.
Attackers now rely on versioning. They submit a harmless-looking utility app for store review, then push an update carrying extortion malware that exploits accessibility services once users have installed it. Google says its Trust & Safety teams prioritise detecting “dormant” permissions and are building monitoring to audit app behaviour after installation. Its tips: install loan and finance apps only from official stores, and withhold access to contacts, photos or SMS logs unless the app truly needs it. Android users should heed the scam warnings in Google Messages and Phone by Google.
Impersonating police and ministries
The third trend centres on South Asia, Southeast Asia and the Gulf Cooperation Council countries. Scammers, often based abroad, pose as municipal police or labor ministries and target people in countries such as Oman, Singapore, India and the United Arab Emirates.
They register Google accounts in bulk with official-sounding addresses, contact victims on third-party messaging apps and send a meeting or calendar invite. High-pressure voice or video calls follow, sometimes called “digital arrests.” Victims are told they are under investigation for financial crimes and asked for upfront “legal fees” or banking credentials.
Google says it enforces its Gmail Program and impersonation policies to suspend such accounts. Two years ago it introduced a Government verified apps programme against fake official apps. It is now requiring developers to verify their name, address and ID for apps installed on certified Android devices, including those installed outside the Play Store.
Real police forces and government departments will never use third-party messaging apps to demand payment or threaten legal action, the advisory says. Google Meet users can also choose the “Only contacts can call me” setting. If a call or message feels off, talk to someone you trust before you act.
