How fraudsters abuse Google Forms to spread scams

This report outlines how threat actors misuse Google Forms as a low-cost, trusted vector for phishing, credential and financial data harvesting, and potential malware delivery, exploiting TLS, dynamic URLs, and brand impersonation to bypass email defenses. It details common techniques including spoofed login/payment forms, callback (vishing) forms, and quiz spam, and highlights observed campaigns such as BazarCall and phishing targeting US universities. Recommended mitigations include multi-layered security, cautious verification of unsolicited messages and links, strong unique passwords stored in a manager, enabling MFA, and heeding Google’s warning to never submit passwords through Forms.