Last updated: October 5, 2026.

The old scam warning—“look for bad spelling”—is no longer enough. A fake business can now use a polished website, a convincing logo, a sponsored search ad, a real-looking invoice, or a phone number that appears familiar.

Why Impersonation Scams Matter in 2026

On September 24, 2026, the FTC said it was considering updates to its Rule on Impersonation of Government and Businesses and asked for public comment on the role of online ad-optimization tools in spreading impersonation scams.

The FTC referenced reported 2025 losses of $3.5 billion to imposter scams. The agency has also warned in 2026 about fake dealership websites, fake health-insurance search results, government impersonators, and scam QR codes placed over legitimate parking-payment codes.

The Check-First Routine

1. Break the contact chain

Do not use the phone number, link, QR code, or reply address in the suspicious message. Open a new browser window or use an official app you already trust.

2. Find the organization independently

For a bank, use the number on your card. For a utility company, use a recent bill or your existing account app. For a government agency, type the official government address yourself rather than following an ad.

3. Verify the exact claim

Ask a simple question: “Is there really a balance, order, appointment, refund, or security problem on my account?” A real organization should be able to confirm the issue through its normal system.

4. Slow down unusual payment requests

Gift cards, cryptocurrency, wire transfers to unfamiliar accounts, payment through a QR code, or instructions to move money “for safety” deserve extra scrutiny. Urgency is often used to prevent you from checking.

5. Treat search ads as ads, not verification

A result appearing at the top of a search page does not prove it is the real company. Check the domain carefully and compare it with statements, product packaging, or a known official account.

A QR Code Can Hide the Destination

QR codes are convenient because they hide a long web address behind a camera scan. That is also the weakness. Before paying for parking or another service, look for signs that a sticker has been placed over the original code. If an official app exists, opening the app directly can be safer than scanning an unknown code.

What If You Already Paid?

Act quickly. Contact the bank, card issuer, payment app, or other payment provider and ask whether the transaction can be stopped or reversed. Change passwords if you entered them on a fake page, and do not reuse the replacement password anywhere else.

If you gave away sensitive identity information, follow the FTC’s identity-theft guidance and consider the steps appropriate to the information exposed.

Related reading: How personalized pricing can affect what you see · What to know about TSA ConfirmID in 2026

The Bottom Line

The strongest scam filter in 2026 is not perfect eyesight or technical expertise. It is a process: stop, leave the message, independently contact the real organization, and verify the claim. A professional-looking ad or page can still be fake, while a legitimate company will not be harmed by you taking a few minutes to confirm who you are dealing with.

Sources: FTC — Impersonation Rule Review; FTC Consumer Alerts — September 2026.