The top search result for “pay my bill” isn’t always your biller

How do you pay a bill when you can’t find the login? You type the company’s name and “pay my bill” into a search box, and you click the first thing that appears. Most people do. Unfortunately that habit is the whole problem, because the first thing on the page is often an ad, and ad slots are bought, not earned.

What just happened at the FTC

On August 17, 2026 the FTC announced that online bill payment firm Doxo will pay $2.1 million to settle allegations that the company and two co-founders, Steve Shivers and Roger Parks, used misleading search ads to impersonate consumers’ billers and misled consumers about fees added to their bills. The money is to be used for consumer redress.

According to the FTC, Doxo’s landing page often featured other companies’ names and sometimes their logos, while Doxo had no relationship with the overwhelming majority of the companies it claimed were in its payment network. The proposed order would bar misrepresenting an affiliation with billers, using a biller’s website address in any search advertisement, and using a biller’s branded name or logo in a way that misrepresents affiliation. Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, described misleading search text ads as getting in the way of consumers trying to find information.

The chronology is worth getting right, because the headline number is new but the case isn’t. The FTC’s case page for FTC v. Doxo, Inc., Steve Shivers, Roger Parks shows the original complaint filed on April 25, 2024, and the stipulated order filed on August 17, 2026. Two years apart. The 2026 news is the settlement of a 2024 action.

Why is the ad slot the weak point?

Search results and search ads sit on the same page, in the same font, in the same shape. The label that separates them is small, and it is usually the one thing your eye skips on the way to the blue link.

The FTC’s own consumer alert, “Searching online: bill pay impersonators”, published the same day as the press release, walks through exactly this. In its Doxo example, the top result looked like it belonged to a well-known lab company but was a paid search text ad that led to another company’s site. The FTC notes the payer may then be charged unexpected extra fees. The alert names the kinds of billers the complaint says Doxo misrepresented itself as an official payment channel for: Labcorp, AT&T, and state toll authorities.

Notice what that list has in common. A lab bill, a phone bill, a toll notice. Bills you get occasionally, from an account you don’t log into every week, for an amount you can’t verify from memory. That is precisely the moment you reach for a search box instead of a bookmark.

The page can look perfect and still not be your biller

This is the part people underestimate. A payment page carrying a company’s name and logo is not evidence of anything. Names and logos are images and text; anyone can put them on a page. The only part of a web page that is genuinely hard to fake is the domain in the address bar, because a domain has to be registered and it can only point where its owner says.

Reading it is a two-second habit. Find the last two pieces before the first single slash. That’s the owner.

Both addresses contain the word “yourutility.” Only the first one belongs to the utility. Everything to the left of the owner domain is a subdomain, and subdomains are free text chosen by whoever owns the domain, so a brand name sitting there means nothing at all.

What does the FTC say to do?

The consumer alert’s advice is short enough to memorize, and it’s two steps:

1. Scroll past the paid search results to make sure you have the right website or contact information.
2. Type the company’s website address directly into your browser rather than following an ad.

To which I’d add the boring practical bit: where do you get that address from? Not from the search box. From your paper bill, your emailed statement, the back of your card, or a bookmark you made the last time you were definitely in the right place. Once you’re there, bookmark it, and the next bill takes ten seconds instead of a decision.

And if a payment page ever asks for something a biller wouldn’t need (a gift card, a wire transfer, a crypto payment, your full Social Security number to “verify” a routine bill), stop there regardless of what the domain says.

Where a domain check fits

IP Tracker is a free Chrome extension. Paste a domain or a full email address into the popup and it checks that one value: 50 checks a day, no account, no tracking.

For a payment page, it surfaces a handful of things you’d otherwise have to look up in four places:

• Lookalike spelling. It compares the domain against the official domains of roughly 125 widely impersonated brands, after normalizing look-alike characters, and flags a near-miss spelling as a possible lookalike.
• Google Safe Browsing. Whether Google’s list of reported dangerous sites has flagged the address.
• Reputation signals. How many security vendors flag the domain on VirusTotal, plus community abuse reports on the address behind it.
• Age and ownership. When the domain was registered and who registered it. A payment page for a decades-old utility sitting on a domain registered six weeks ago is worth a pause, as a supporting clue, never a verdict by itself.
• Hosting. The addresses the domain resolves to and the platform serving it, which sometimes shows a “bank” payment page running on a free site builder.

What can’t it do?

This case is a good illustration of the limits, so let me be blunt about them:

• It can’t tell you whether a real company will do right by you. This is the big one. The FTC’s Doxo case is not about a fake site with a misspelled domain. It’s about a registered, operating company that the FTC alleges advertised itself as your biller. A domain check would show you a real domain with a real registration history. It would not tell you the payment gets passed on, or what fees get added.
• It can’t see fees. Add-on charges live in the checkout flow and the fine print, not in DNS records.
• It can’t see the ad you clicked. The extension checks the domain you paste. It doesn’t watch your search results or judge which link was sponsored.
• The brand list is about 125 brands. The most impersonated ones, not your regional water authority, and not most local billers.
• Blocklists lag. Google Safe Browsing is strong on known bad sites, but a brand-new page takes time to get reported and listed.

The uncomfortable takeaway from this settlement is that “is this a scam site?” is the wrong question at a payment page. The better question is narrower and answerable: is this my biller’s own site? The domain answers that one. Everything else on the page (the logo, the layout, the reassuring copy) is decoration that anyone can arrange.

To summarize:

• ✓ Scroll past the paid results; the top slot is bought, not earned.
• ✓ Get the address from your bill or statement, then type it in directly.
• ✓ Read the last two pieces before the first slash. That’s the owner.
• ✓ Bookmark the real payment page so next month isn’t a search.
• ✓ Paste the domain into IP Tracker if you want a second opinion on the address itself.

Your biller’s address is printed on the bill, not ranked in the search results. Happy boring bill-paying! 😉

Sources

• Bill Payment Firm Doxo to Pay $2.1 Million to Settle FTC Allegations It Deceived Consumers and Charged Them Add-On Fees, Federal Trade Commission press release, August 17, 2026.
• FTC v. Doxo, Inc., Steve Shivers, Roger Parks, FTC case page, last updated August 17, 2026.
• Searching online: bill pay impersonators, FTC consumer alert, BCP Staff, August 17, 2026.