{"success":true,"data":{"id":"fake-google-adsense-publisher-payment-hold-phish","label":"Fake Google AdSense publisher payment hold or account suspended phishing — fraudulent email impersonating Google AdSense claiming the recipient's AdSense payment has been placed on hold, their publisher account has been suspended for invalid click activity or a policy violation, or publisher identity verification is required to release pending earnings — directing them to sign in to their AdSense account, submit tax forms, or verify identity through a credential-harvesting portal — targeting website publishers and bloggers whose passive income depends on AdSense earnings; legitimate AdSense payment holds and publisher verifications are common events, making fake versions highly believable","description":"Phishing emails impersonating Google AdSense claiming the recipient's AdSense earnings have been placed on hold, their publisher account has been suspended for invalid click activity or a policy violation, or publisher identity verification or a tax form is required to release pending earnings — directing them to sign in to AdSense, submit tax information, or verify identity. Key facts: (1) AdSense serves website publishers and bloggers (not to be confused with Google Ads, which serves advertisers); for content creators with high-traffic websites, AdSense payments can represent $500–$10,000+ per month of passive income, making a \"payment hold\" notification extremely urgent — attackers know publishers will click immediately to protect their earnings pipeline; (2) The attack is unusually believable because legitimate AdSense payment holds are genuinely common: Google holds payments for identity verification when accounts reach certain revenue thresholds, tax form requirements (W-9, W-8BEN for international publishers), address verification, and first-payment holds — recipients are pre-conditioned to expect these notices and respond to them; (3) The \"invalid click activity suspension\" variant exploits real publisher anxiety: Google does genuinely suspend AdSense accounts for invalid traffic, and publishers live in fear of this because it can happen through no fault of their own (bots crawling their site, a competitor click-bombing them); a fake suspension notice with \"submit an appeal\" CTA triggers immediate action; (4) Credential capture gives attackers full Google account access — plus the ability to redirect AdSense payments to the attacker's bank account by changing the payment profile. Warning signs: sender domain not google.com; no specific AdSense publisher ID or payment amount in the email; link to non-Google domain; generic \"verify your identity\" rather than a specific Google-authenticated flow.","tier":"danger","category":"phishing","isThin":false}}