New partnership helps banks flag fraud on Google

Google has launched a joint effort with the Financial Services Information Sharing and Analysis Center (FS-ISAC) that will combine the search giant’s threat detection capabilities with FS-ISAC’s network and intelligence sharing to prevent fraud within the financial sector.

The program, announced Tuesday, is dubbed the Financial Services branch of Google’s Priority Flagger Program, according to a press release about the matter.

The collaboration with Google “accelerates the speed with which FS-ISAC members can identify and mitigate evolving fraud threats, increasing the security of institutions and the communities they serve,” said Teresa Walsh, FS-ISAC’s chief intelligence officer, in the announcement.

What is priority flagging?

While anyone can flag content on Google platforms — for example, using the flag icon that appears below all YouTube videos — flags from Priority Flaggers are prioritized for review by content moderators due to their high degree of trust and expertise.

Google’s Priority Flagger program provides tools to eligible organizations like government agencies and non-governmental organizations (NGOs) to quickly resolve with Google any violations of the platform’s policies, such as ads that attempt to defraud bank customers by imitating that customer’s bank and misusing its branding.

Google considers priority flaggers to be particularly effective at reporting content that violates Google’s Community Guidelines or policies. The program gives participants dedicated channels to inform Google of potential violations that will be reviewed at a priority.

Content reported by Priority Flaggers is not automatically removed. The same standards apply for all flags; the difference is the prioritization of the review process.

Why FS-ISAC joined

The goal of the Financial Services Priority Flagger Program is to accelerate fraud prevention and detection specifically for the financial sector, according to Google and FS-ISAC.

Google’s Priority Flagger Program generally streamlines the process of identifying, reporting and mitigating fraud threats related to Google platforms — specifically, Google Workspace and Google Ads.

This collaboration builds on “years of collaboration” between the organizations, according to Amanda Storey, senior director of trust and safety at Google. It is “the kind of concrete cross-sector effort that meaningfully helps financial institutions protect their customers and employees,” she said.

How the program works

As part of this financial services-specific initiative, FS-ISAC will operate a dedicated channel for its members, according to the announcement.

Through this channel, members can report fraud and other malicious activity that leverages Google Workspace or Google Ads.

The program initially launched with a pilot group of FS-ISAC member institutions. In the first 10 days of the pilot, FS-ISAC flagged 21 accounts, which allowed Google to identify and take action on 288 abusive accounts connected to the original ones, according to the press release. The program is now expanding to include all FS-ISAC member firms, providing access to reporting mechanisms, resources and direct support from experts.

Other organizations using priority flagging

Other non-profit organizations use the Google Priority Flagger Program to address specific types of online harm.

For example, the National Advertising Division, which is affiliated with the Better Business Bureau, also joined the Google Priority Flagger Program this year. The National Advertising Division uses a dedicated channel to inform Google of potential Google Ads policy violations.

Organizations with expertise in recognizing and fighting online harm are most suitable for the program, according to Google. Partnering allows them to leverage direct channels and prioritized reviews to support their missions.

One of many collaborations

FS-ISAC’s new program is part of Google’s participation in the consortium’s Critical Providers Program, according to the Tuesday announcement. Google Cloud joined the Critical Providers Program in March 2023 in a partnership focused on bolstering supply chain security and fostering transparency within the financial sector.

The Critical Providers Program is an official conduit for non-financial organizations that provide network infrastructure and services to share timely and industry-specific security information. Google Cloud was the first major cloud provider to join this program, according to an announcement at the time.

More broadly, the partnership is an example of the financial services industry’s efforts to work across sectors to solve fraud. While fraud yields losses for both banks and its customers, the schemes are often executed on platforms that banks do not control, hence the need for dedicated partnerships across industries.

For example, banks have worked with telecommunications companies to fight fraud via text messages and phone calls, with social media platforms to fight fraud on social media and with the U.S. Postal Service to fight mail theft that feeds check fraud.

Ad fraud pervasive on Google

Google’s new partnership with FS-ISAC reflects the significant and persistent challenge of fraudulent advertisements published through the Google Ads platform. The issue not only impacts consumers but also poses a substantial financial threat to legitimate businesses.

Fraudsters employ increasingly sophisticated tactics to exploit Google’s advertising ecosystem. One common method involves creating fake ads that impersonate legitimate brands, then bidding on those brand names as keywords. When a user clicks on such an ad, they are often redirected to a phishing site designed to steal credentials, payment information or identity data.

Allure Security, a firm that offers brands a service for shutting down impersonations, notes that these malicious sites can even be designed to show benign content when accessed directly, but redirect to a scam site only when a Google Click ID is detected, making them harder to spot.

Beyond targeting consumers, criminals are also directly attacking advertisers. Earlier this year,  anti-malware software company Malwarebytes reported on “The great Google Ads heist,” a scheme where fraudsters used fake Google Ads to phish advertisers themselves for their Google account credentials. Once an account is compromised, the criminals can use the legitimate advertiser’s budget to run their own malicious campaigns, effectively using stolen funds to perpetuate more fraud.