New evidence that fraudulent stores are exploiting the Google Shopping service to appear at the top of their search results has been discovered by the BBC.
It was found that two sites offering handsets that are hard to find at a discount used fake payment facilities that encourage customers to pay via direct bank transfer.
This prevents users from recovering funds if they have questions.
Police investigators expressed frustration at the role of Google.
A police officer who has spent years investigating online crimes told the BBC that the technology company could introduce checks to better deter fraudsters, if that made it a priority.
Google believes that the sites were actually involved in fraudulent behavior and told the BBC that it had removed the ads involved.
He said he will now make unspecified changes to his automated, human-based review processes.
"Our priority is to protect our users, and we continue to update our law enforcement policies and technologies to target fraudulent and bad actors," said a spokeswoman.
"In 2019, our team removed approximately 2.7 billion bad ads."
Bogus payment box
Both Techziox.com and Shopzeal.co.uk went offline after the BBC contacted them. They did not respond to requests for comment.
On Thursday, Techziox was the store with the highest rating in several surveys related to Oculus
The sites have already shown ads for Oculus virtual reality headsets, which are sold or priced high on most other sites.
The two stores claimed to have the products in stock and prices between 15 and 23% below the norm.
In some cases, ads took up most of the screen when viewed on a smartphone, increasing the chance of being clicked.
This reflected the tactics of a site previously suspected of fraud – MyTechDomestic – which also placed ads for Oculus headsets and was flagged to Google earlier this week.
But while MyTechDomestic offered buyers a way to pay by bank transfer only, Techziox and Shopzeal seem to offer an option to use a credit card.
If selected, the tool asks for the card details, including its CVV security code, and displays the "Powered by Stripe" logo – referring to an Internet payment processor in California.
However, Stripe told the BBC that the cashier was not linked to his system and did not handle payments through the websites.
A credit card payment tool did not process details via Stripe, as indicated
An independent security researcher, who tracks fraudulent websites, confirmed that the code on the websites indicated that the card details were sent to store operators.
Anyway, when users tried to use the service, an error message was displayed saying, "Unfortunately, this payment method is not possible for new customers. Choose another payment method".
The only other option was bank transfer, and Techziox and Shopzeal presented details of the same account at a Swindon bank.
This is a common tactic used by scam sites to raise funds.
In previous cases, the police have said that scammers use personal accounts belonging to individuals who are accomplices or have been coerced to share their bank details, and the money is usually withdrawn immediately from the counter or through ATMs.
The two sites were built using WordPress's web publishing software, looked similar and listed the same team members alongside email addresses that didn't work.
Google places Shopping ads at the top of some desktop searches – in this case, Techziox came in second
However, they provided different home addresses as their headquarters – one in Southampton and one in Huddersfield – and used different domain registrars.
They also provided different VAT numbers. In both cases, HM Revenue and Customs said the details were invalid.
"Disturbing and wrong"
Techziox appears to have been in operation for the longest time and has been accused of being "direct scammers" by users from the Trustpilot review site.
A customer, Nicky Jones, told the BBC that his 15-year-old daughter tried to buy an Oculus Quest after saving for a long time and working to earn money.
"My daughter researched online and the company came up, so we bought the item. I sent emails to the company and didn't receive them," she said.
"The most disturbing thing is that we lost £ 329. I would never take that money from my daughter, so I lost the money. [It is] disturbing the way people can do this and get away with it. It is wrong."
Attempts to pay by credit card brought a warning warning directing users to use a bank transfer option
According to Whois records, The Techziox website was created using a Netherlands-based registrar on April 18, While Shopzeal used a US-based registrar on May 7.
AN security blogger who anonymously tracks electronic product scams said, "It's awful. It's the first time I've seen them use Google Shopping. Previously, it was just Adwords."
Google Shopping allows advertisers to use images and words and is generally more prominent, he noted.
Fraud sites can be "difficult to identify," he added. "But perhaps Google should not allow a website registered in the past two months to be one of the results of Shopping, if it wants to provide a reliable customer experience."