The FTC is warning that dishonest companies buy paid search ads so their site outranks the real one when you look up a company's bill-payment page, then tack on fees you never agreed to — the same week it renewed its warning that an unordered package on your doorstep can carry a QR code built to phish you, not just fake reviews in your name.

An FTC consumer alert (August 17, 2026) warns that when you search online for a company or agency's bill-payment page, the top result can be a paid search ad for a site with no relationship to that company — and once you try to pay, the site tacks on fees you did not expect. The FTC ties this directly to a live enforcement action: bill-payment firm Doxo agreed to pay $2.1 million to settle FTC allegations that it used misleading search ads to impersonate billers including Labcorp, AT&T, and state toll authorities, then charged consumers undisclosed add-on fees. The FTC's advice: scroll past sponsored results and type the company's web address into your browser directly.

An FTC consumer alert (August 20, 2026) renews its warning on "brushing" scams: an unexpected package — cheap, random contents like baby wipes, toothpaste, or seeds, addressed to you but never ordered — that a seller uses to fake a "verified purchase" review in your name. The FTC flags a newer twist: some packages include a note with a QR code claiming to reveal the sender or process a return, and scanning it can lead to a phishing site built to steal card numbers, usernames, or passwords.