Bill pay impersonator scams: the fake payment site trick. Free Interactive Guide Free: how to keep yourself safe from scammers. 9 chapters. Reporting checklist. 30-second protection checklist. Read on the site. It's 9:52 on a Tuesday night. Your gas bill is due tomorrow, so you Google "pay [your utility] bill," click the first result, and pay it like you always do. Except the site you just handed your card number to isn't your utility company. It never was. It just outbid your utility company for that ad slot. On August 17, 2026, the FTC put out a consumer alert about exactly this - and the same week, it settled with a real bill-payment company, Doxo, for $2.1 million over allegations it ran this playbook at scale. That's the part that makes this worth your attention: this isn't a hypothetical warning about a scam that might exist somewhere. The FTC just put a dollar figure on a company doing it. How this scam actually works. The mechanic is almost insultingly simple, which is exactly why it works. * You search for a company you already owe money to - a utility, a car loan servicer, a phone carrier, a rent-payment portal. Anything you'd normally search "pay [company] bill" for. * A paid search ad shows up above the real company's own site. It's often styled to look official, sometimes using the actual biller's name or logo on the landing page, even though the two have no real relationship. * You click it, because it looks like exactly what you were searching for and it's sitting in the top spot search engines are trained to trust. * You enter your payment info on a page that isn't your biller - it's a third-party middleman (or, in the worst versions, an outright scam site with no intention of ever paying anyone). * Depending on which version you hit, one of two things happens: a legitimate-but-shady processor tacks on an undisclosed fee and quietly enrolls you in a recurring subscription, or a straight-up fraud site takes your card number and disappears. In the FTC's case against Doxo, the allegation was the first version: the company's landing pages "often featured other companies' names and sometimes even their logos," despite Doxo having no relationship with "the overwhelming majority" of the billers its site implied it worked with. On top of that, the FTC alleged Doxo added undisclosed "delivery fees" and enrolled customers in a subscription program without clearly disclosing the price or getting real consent - a violation of the Restore Online Shoppers' Confidence Act, according to a federal court. Not sure if your message is real? Paste it into Cautellus and get a risk score before you reply. Why this one is harder to spot than a phishing text. Every scam text or call you've learned to distrust - the fake toll notice, the fake IRS threat, the "your account is suspended" message - has a tell built in: it comes to you, uninitiated, usually with a manufactured deadline. Your guard is already up before you've read the second sentence. This scam skips all of that. You went looking for it. Nobody pressured you, nothing was urgent beyond your own actual due date, and search engines have spent two decades training you that the top result is the most relevant one. There's no scary voice on the phone and no countdown timer - just a page that looks close enough to right, sitting exactly where you expected your answer to be. The red flags hiding in plain sight. * The URL doesn't match your bill. Pull up a real statement - paper or app - and compare the domain letter for letter. A middleman site will almost never be on your biller's actual domain. * A "Sponsored" or "Ad" tag sits above the result. It's small and gray on purpose. Scroll past every ad before you click for a bill payment. * Vague small print about a "network of billers." Doxo's alleged pitch was that it processed payments for a wide network of companies - a real biller's own site never needs to describe itself that way. * A "delivery," "convenience," or "service" fee appears at checkout that wasn't on your actual bill. Real utilities and lenders rarely tack on a mystery line item at the last second. * A checkbox for "faster processing" or "premium delivery" that's pre-checked, or a subscription opt-in buried in paragraph text instead of a clear checkbox you had to actively select. * The site can't tell you your account balance before you pay - it just asks you to enter an amount, which a real biller's portal never does. * Calling the number on your real bill, the company has never heard of the site you paid. This is the confirmation step that ends the argument every time. If this already happened to you. Don't panic, but don't assume it's fine either. Log into your actual biller's account directly - type the URL yourself, don't search for it again - and check whether the payment actually shows as received. Third-party processors can be slow, or in the worst cases, never forward the money at all, which means you're now also late on the real bill. Pull your card statement and look for anything that looks like a recurring charge you didn't knowingly sign up for. If you find one, dispute it with your card issuer and cancel it directly with the company that billed you, in writing. If you never got a confirmation email from the real company, treat the bill as unpaid and pay it again directly through their verified site or app - better to double-pay and get a refund than to get hit with a late fee on top of everything else. If it turns out you were dealing with an outright fraud site rather than a shady-but-real processor, report it to the FTC at ReportFraud.ftc.gov and to the FBI's IC3. Its general recovery checklist walks through the rest - freezing the card, checking for follow-up scams, and what to expect next. How to not become the next victim. The fix costs you nothing and takes longer to read than to do: never search for a bill-pay page. Use the app you already have installed, a bookmark you saved after logging in directly once, or type the company's domain into the address bar yourself. If you have to search, scroll past every result marked "Sponsored" without exception - the real link is almost always sitting right below them. Before you type a card number into anything that came from a search ad, paste the link into the Cautellus scanner and let it check the domain against known scam infrastructure before you commit. It takes less time than finding your card in the first place, and it catches exactly the kind of lookalike site this scam depends on. It's also worth a five-minute pass through how to check if a website is actually legit - the checks apply just as well to a bill-pay page as they do to an online store. And if what showed up in your search results was styled to look like an outright government or utility shutoff threat rather than a payment portal, that's a close cousin worth reading about too: utility shutoff scams and fake health insurance search ads both run on the same "buy the ad, wear the logo" trick. Got something like this in your inbox? Drop it into the scanner - it takes 5 seconds and could save you thousands. FAQs. Is Doxo itself a scam? No - Doxo is a real bill-payment company, not a fake operation, and it settled with the FTC without admitting wrongdoing. The FTC alleged it used search ads and lookalike branding to make itself look like the actual biller when it wasn't affiliated with most of them, then added undisclosed fees and a subscription without clear consent. The bigger danger is the copycat pattern: less accountable operators run the same search-ad trick with zero intention of ever paying your bill at all. How do I know if a bill-pay site I clicked is the real company? Check the URL in your address bar against the number on your actual paper bill or the back of your card, not the ad you clicked. If it doesn't match your biller's real domain exactly, close the tab. When in doubt, run the link through the Cautellus scanner before you type in a card number. What's a "delivery fee" and is it legal? It's an add-on charge a third-party payment site tacks onto your bill for processing the payment on your behalf. It's not automatically illegal, but the FTC's case against Doxo centered on the fee not being clearly disclosed before checkout, which is the part that gets a company sued. I already paid a bill through one of these sites. What do I do? Log into your real biller's account directly and confirm the payment actually posted. Check your card statement for a recurring subscription charge you didn't knowingly agree to, and dispute it with your card issuer if you find one. If you never got a confirmation from the actual company, treat it as unpaid and pay them directly. Why do search ads for my bill even show up if they're not the real company? Search engines sell ad placement to anyone willing to bid on a search term, including your utility company's name, and don't verify that every advertiser is actually affiliated with the brand people are searching for. That gap is exactly what this scam pattern exploits. You didn't do anything careless by searching for your own bill. The scam here isn't built on panic or a fake deadline - it's built on the top search result looking exactly like what you were already looking for. Think you've been targeted? Paste any text, link, email, or screenshot into Cautellus for instant AI analysis. Want unlimited scans + the Chrome extension? See pricing. Courtney. Founder, Cautellus · 20+ years in financial services Two decades in financial compliance, digital security, and fraud prevention. Built Cautellus because the scam detection tools that exist were made for IT departments, not for real people getting weird texts. Support its mission. Cautellus is built to protect people from online fraud. Your contribution helps Cautellus keep building security tools and resources.

Americas Daily briefing - 17 Aug 2026. The Federal Trade Commission just penalized Doxo 2.1 million dollars for deceptive billing practices. Here's what it means for consumer protection, digital payment services, and new fintech compliance guidelines. 1⃣ Federal Trade Commission - Doxo to Pay $2.1 Million to Settle FTC Allegations It Deceived Consumers and Charged Add-On Fees The FTC finalized a $2.1 million settlement with Doxo over hidden add-on fees and deceptive checkout interfaces. This new regulatory enforcement action directly hits third-party payment platforms, billing processors, and digital consumer finance companies. Firms must now audit their digital payment flows immediately to ensure transparent pricing and prevent all potential user deception. 2⃣ FIU of Trinidad and Tobago - Notice to Freeze Funds and Property of Terrorist Individuals and Entities The FIUTT issued an official notice ordering the immediate freezing of all funds and assets held by designated terrorist entities. This urgent freezing mandate hits local banks, credit unions, listed shops, and registered financial firms. Covered firms must run deep database searches, block matching funds now, and report all results to the unit. 3⃣ Bahamas Securities Commission - Notice Re: International Obligations Act (IOEAMA) Sanctions for ISIL and Al-Qaida The Bahamian commission published a sanctions enforcement notice under the IOEAMA statutory framework. This compliance directive hits Bahamian fund managers, registered securities dealers, and all local investment firms. Operators must screen their client databases against updated lists to block unauthorized transactions now. 4⃣ FSRA of Ontario - Complete your Annual Auto Insurance Attestation Ontario's regulator launched its annual attestation cycle to verify auto insurance coverage data. This compliance filing obligation hits all licensed auto insurance providers operating in Ontario. Covered companies must submit their verified data attestations before the regulatory deadline. 5⃣ U.S. Treasury Department - Treasury Seeks Public Comment on GENIUS Act Proposed Rulemaking Regarding Stablecoins The Treasury issued a proposed rulemaking notice seeking public comments on new stablecoin regulations. This request hits crypto developers, coin issuers, payment providers, and blockchain platforms. Market participants must submit detailed technical comments during this open consultation period. Full analysis in the attached RegNext Daily Americas Radar carousel. - Elena Navarro · Managing Editor, RegNext Daily Americas Radar · Monday 17 Aug 2026 #USRegulation #LATAMRegulation #FinancialRegulation #ComplianceIntelligence August 17, 2026