How Fake Websites Hide in Plain Sight on Google Search

When you search for a service online, you expect the first results to be real. But scammers have found a way to slip fake versions of popular websites into search results, and they look so identical that even careful people get fooled.

This is happening right now with Bitrefill, a service that lets you buy and send gift cards and cryptocurrency. Scammers created fake Bitrefill checkout pages, paid to rank them high in search results, and are now collecting money directly into their own accounts. The fake sites look pixel-perfect. The process feels legitimate. By the time someone realizes they've been sent to the wrong place, they've already sent cryptocurrency to a scammer.

Why This Works

Scammers create these fake websites because the barrier to entry is low and the reward is immediate. They register domain names that are slight variations of the real thing (bitrefill-checkout.com instead of bitrefill.com), design pages that mirror the genuine service exactly, and use search advertising to push themselves to the top of results.

When someone is in a hurry, they click the first link without looking closely at the address. Or they assume that because it appeared in Google search results, it must be legitimate. Both assumptions are reasonable. Both are also exploitable.

Google Made This Harder to Spot

Google recently changed how search results display links. It now redirects your click through Google's own servers before taking you to the destination. This was meant to protect you in certain ways. But it had an unintended consequence: it removed a simple safety tool that people were using.

Before this change, you could hover your mouse over a link in search results and see where it actually went, in small text at the bottom of your browser. That one sentence of transparency helped people catch fake websites before clicking. Now that information is hidden. Your only real option is to look at the domain name itself in the search result—and scammers know that most people don't read domain names closely.

How to Protect Yourself

The solution is simple and doesn't require any special skills. Before you click a search result and enter any payment information, do this:

Read the domain name carefully. Look at the text between "https://www." and the first forward slash. For Bitrefill, the real domain is bitrefill.com. Anything else—bitrefill-checkout.com, bitrefills.com, bitrefil.com—is fake. Scammers often use slight misspellings or add extra words. If you're not certain, don't click.

Type the address directly instead. If you know the real service, open a new browser tab and type the domain name yourself. Don't use a search result at all. This takes five more seconds and closes the gap entirely.

Use bookmarks for services you use regularly. If you buy gift cards or cryptocurrency multiple times, bookmark the real site. Next time you need it, open the bookmark instead of searching.

This isn't about being paranoid. It's about understanding that search results are ranked by algorithms and money, not by a person verifying every link. You are the final check. A few seconds of attention makes you nearly impossible to fool.