Australian cryptocurrency exchange Coinstash has accused Google of failing to protect consumers after the tech giant initially declined to remove sponsored Search adverts impersonating the exchange, claiming they did not breach its advertising policies.
The Brisbane-headquartered crypto platform, founded in 2017 by childhood friends Ting Wang and Mena Theodorou, said it was left “livid” after discovering fake Google Search ads directing users to fraudulent login pages designed to steal customer credentials.
Scammers targeting Coinstash’s prospective and existing customers had circumvented the rules by slightly misspelled domains. For instance, an extra “t” or “s” in “Coinstash” would be added or unusual domains such as “.site” or “.ubpages.com”.
Coinstash said that these fraudulent adverts would appear above their legitimate search results.
Speaking to B&T, Coinstash co-founder Mena Theodorou said the company first became aware of the scam after customers began reporting suspicious search results.
“People were reaching out saying they’d seen what looked like Coinstash links and ads on Google, but something felt off,” he said.
“That triggered us to then go looking, and sure enough, there were impersonation ads running from Brazilian-based accounts that had somehow made it through Google’s verification process.”
Coinstash told B&T that it reported the ads to Google multiple times, explaining they were impersonating the business and directing users to fraudulent websites.
“After about four days the response came back that the ads didn’t violate their policies,” Theodorou said.
The co-founder said he requested the removal of ads on 11 July, and Google declined the request on 13 July. Theodorou then complained again and said he received no reply from Google. B&T has seen correspondence between Coinstash and Google’s support team.
When approached by B&T, a Google spokesperson said: “We have strict policies against phishing and impersonation. If we find ads that violate these policies, we remove them. We continue to invest significant resources to evaluate and update our policies and improve our technology to keep our users safe.”
B&T understands that enforcement action was later taken by Google to remove the ads, however according to Theodorou there was no communication to the team.
Under Google’s Misrepresentation policy, ads that scam users by concealing or misstating information about the advertiser’s business, product, or service, or use ad destinations that use phishing techniques to gather user information are not allowed. In 2025 alone 421.5 million ads were removed for violating the Misrepresentation policy.
Google uses a range of systems to identify evolving patterns of abuse and enable swift enforcement when it comes to detecting scam ads.
When Google declined to take down the ads initially, Theodorou aired his frustrations publicly on LinkedIn, accusing Google of having “seriously dropped the ball”.
“We recently had impersonation ads coming through from Brazilian-based ad accounts. Ads that somehow sailed straight through Google’s supposedly rigorous verification process,” he wrote.
“Then, after a three-day wait, Google told us they wouldn’t take them down because they ‘don’t violate their terms’. Which terms would those be? The ones that say payment received is all that matters?
“The website led to a fake sign-in page designed to phish our customers’ details. How is that acceptable? I am livid!”
Theodorou said the incident has had a “profound impact on the business”, particularly given Coinstash operates as a regulated financial services company.
“Our customers trust us with their money and their data,” he said. “When someone sees a fake ad pretending to be us, clicks through to a phishing page, and potentially hands over their credentials, that’s not just a brand issue, it’s a real harm issue.”
He said one of the most frustrating aspects of the incident is the lack of control brands have once impersonation ads appear on major platforms.
“We can’t control Google’s decisions, and we certainly can’t control their ability to keep up with how fast this space is evolving.”
Theodorou warned that allowing fraudulent advertising to remain online risks undermining trust in the wider digital advertising ecosystem.
“Fake advertising, fake anything, is terrible. The whole premise of digital advertising is built on trust,” he said.
“If consumers can’t trust that the ad they’re clicking is actually from the brand it claims to be, the whole system starts to unravel.
“We’re big believers in keeping things natural and authentic. If you’re running a legitimate business, you shouldn’t have to compete with scammers who can just buy their way onto the same platform you’re using.”
