Google’s new search-link behavior weakens a long-used safety check, raising risks for bank logins and leaving users with a simple workaround

For years, users could hover over a Google result to see the destination before clicking. On some results, that no longer works, and scammers are taking advantage by placing fake bank login pages near the top of search results. Here’s how the scheme works and the simple step that can help protect you.

Hover and out

🤯 WOW! Scammers are building fake bank websites that behave as if they are inactive. Open one directly and it may appear as a blank page. Click it from a Google search, and it can turn into a convincing copy of your bank’s login screen. These fakes have increased sharply in a short period, and Google has made the old hover-to-check habit less useful on many results.

📖 Read time: 2 minutes

For a long time, I’ve pointed people to one reliable way to judge a link: hover the mouse over it and check the destination in the corner of the screen.

That safeguard is not as dependable now.

🕵️ What changed

Some search results now route through a Google redirect first. When you hover over one of them, the status area may show a google.com/goto?url= address followed by unreadable characters instead of the site you expected.

Google says it is responding to “evolving forms of abuse,” though it did not specify which. The practical effect is that users lose a quick way to confirm where a result will take them before clicking.

Google still displays a site name above each result, but the hover check used to provide a second verification step. Now that extra check often shows Google’s own redirect instead.

🦎 Why the timing is bad

Scammers try to push fake pages to the top of search results for terms such as “[bank name] login.” That tactic works because people often search that way when they are in a hurry to pay a bill or sign in.

The deceptive part is that the fake site may look harmless when entered directly, showing only a blank page. Security tools may see that and move on. But when the same address is opened from a search result, it can display a full bank login page. If you enter your password, the attackers can capture it.

The web address may look close to the real one, with the bank’s name followed by an unusual ending such as .ph.com. On a phone, that difference can be easy to miss.

🔒 Lock it down

1. Stop searching for your bank each time. Enter the address once, then bookmark it. In Chrome on a computer, click the star in the address bar. On iPhone Safari, tap Share and then Add Bookmark.
2. Even better, use the bank’s app. Install it only from the App Store or Google Play.
3. Avoid results marked Sponsored when you are trying to reach a login page.
4. Check the address bar before entering a password. Your bank’s name should appear directly before the .com, without anything suspicious attached.
5. Let your password manager do the screening. It should only autofill on the real site. If it does not, stop and verify.

The hover trick had a long run, but a saved bookmark does the job without needing a search engine.

And what does Google like to drink? The search bar.