Fake government website login scam

What the message looks like

How this scam works

According to the GSA inspector general, the criminals copy a legitimate government website and buy search engine ads so the fake appears as the first clickable link. The fake has a login portal that matches the real one. Once you enter your username and password, they are captured, you aren't taken anywhere, and you often see an error page.

Then the criminals sign in to the real site with your details, often very quickly. The GSA inspector general says they use the account for their own gain, for example by changing the bank account where payments are sent so the money goes to them. It also warns they have shown they can capture multi-factor codes sent to your phone or email in real time, or get around them in some cases, so a code alone doesn't make you safe if you typed it into a fake page.

The fake addresses are designed to pass a quick look. The inspector general's example: the real site is gsa.gov, while a fake might be gsa-gov.org. Fakes may even contain the real name with extra characters added. U.S. government websites use the .gov ending, and the FTC has said scammers pay to place impostor ads for government agencies and well-known businesses in search results and social media feeds.

Red flags

• A government login page whose address doesn't end in .gov, or that has extra words or hyphens, like agency-gov.org.
• A sponsored result or ad at the top of search results leading to a login page.
• An error page right after you sign in, with no way forward.
• A login page that asks for more than usual, such as your full Social Security number and bank details at once.
• Soon after signing in, unexpected alerts that your direct deposit, email or phone number on the account changed. That is a strong sign someone else is in the account.

How to tell it’s fake

1. Type the address yourself or use a bookmark you saved from the real site, instead of clicking search results, as the GSA inspector general advises.
2. Read the whole domain in the address bar from right to left. The part just before the first single slash should end in .gov for a U.S. federal site.
3. Skip results labeled 'Sponsored' or 'Ad' when you are about to sign in to anything financial or government-related.
4. If you are unsure, stop and check with someone you trust or a scam expert, or call the agency's help desk using a number from a site you reached yourself.

What to do if you clicked, paid or shared info

Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.

If you clicked a link or called back

• If you visited the page but didn't type anything, close it and go to the real site by typing its address. Report the fake page to the agency's Office of Inspector General, which you can find through the directory at ignet.gov, and to ic3.gov.

If you paid

• If a payment was redirected or you see money moved, call your bank right away and the real agency's help desk to flag the account, and file a report at ic3.gov.

If you shared personal info, a password or a code

• If you entered a password, change it on the real site right away, plus anywhere else you used it. Check the account's direct deposit, mailing address, email and phone settings for changes. If you entered a Social Security number, visit IdentityTheft.gov and consider a credit freeze.

How Gmork Scam Guard would warn you

Scam Guard runs in Chrome and Edge on your computer. It checks the sites you open, including ones you reach from search ads, and can warn when a page uses a government agency's name or look on a domain that isn't the real .gov address, before you type a password. It can't stop someone from calling you on a spoofed number, so hang up and look the number up yourself.

Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.

הוספה ל-Chromeהוספה ל-Edgeהוספה ל-Firefoxהוספה ל-Opera

Questions people ask

Is every .gov website safe?

The GSA inspector general says U.S. government websites exclusively use the .gov ending, so a missing .gov is a major warning sign for a federal login. Still, read the full address carefully and type it yourself rather than trusting a link in an ad or message.

I use two-factor codes. Am I protected?

It helps, but the GSA inspector general warns these criminals have captured codes in real time or gotten around them in some cases. A code typed into a fake page can be used immediately on the real one.

Are all search ads for government sites fake?

No. But ads are paid placements, and the FTC has said scammers buy impostor ads for government agencies. For logins, use a bookmark or type the address instead.

Sources

• GSA Office of Inspector General (Nov 5, 2026): Beware of fake websites that mimic legitimate official U.S. government websites
• GSA Office of Inspector General (Nov 5, 2026): Beware of scammers spoofing real government numbers
• FTC (Nov 2026): Tell the FTC about imposter ads online
• Inspectors General directory (to report a fake federal website)