When using online search engines, it can be difficult to tell if website results are legitimate. Cybercriminals know we trust search engines, so they ‘poison’ the results to make malicious sites credible.

These threats often appear through routine tasks and can lead you to fraudulent or harmful websites designed to steal your information:

• Spoofed websites and login pages may mimic banking, retail, utility or package tracking services.
• Be cautious when completing familiar tasks such as checking balances, shopping or downloading. Watch for red flags like misspelled URL’s, poor design or unusual prompts or actions.
• Search results can be manipulated to direct you to malicious sites. 
   

Before you click:

• Stay alert: Use bookmarked or official sites. Don’t rush routine tasks.
• Verify AI chatbot results: Don’t trust chatbot links alone; navigate to the page independently.
• Confirm account requests: Use official contact information, not inbound messages, to verify the source.
• Skip search ads: Type URLs directly to avoid spoofed sites that may contain malware or phishing attempts.
• Be wary of shipping asks: Payment requests may be a red flag and indicate a scam.
   

If you may have been targeted:

• Act fast. Don’t wait. Quick action can limit damage.
• Tell your employer if a work device or network may be affected.
• Report it. If a suspicious site is using Bank of America’s name, forward it to abuse@bofa.com
• Review your accounts and enable alerts. Regularly monitor for unusual activity.
• Keep devices and apps up to date, including your bank and retail apps. Turn on automatic updates or regularly check your device settings for software updates.
• Change passwords and use strong passphrases of at least 12 characters.
• Run antivirus software to scan for and remove malware.