SEO scams and red flags: how to vet an SEO company before you sign

Here is the vetting rule that filters out nearly every SEO scam: if you cannot verify it, do not pay for it. Legitimate SEO is checkable at every step, named deliverables, visible changes, leads you can count. Scams sell the unverifiable: guaranteed rankings, insider access, secret methods, and urgency. Google's own guidance for hiring an SEO says the same thing in fewer words: nobody can guarantee a #1 ranking, and if a provider will not explain what they do, find someone else (Google Search Central).

This matters beyond the money you might lose this month. Owners who get burned stop investing in search entirely, which hands the map pack to their competitors for years. Getting scammed costs you twice. So this is the guide I wish every owner read before the phone rings.

Why does the "your site isn't ranking" call keep coming?

Because it keeps working, at industrial scale. Reported fraud losses hit $16 billion in 2025, the highest on record and up about 25% in a year, and impersonation was the most reported category. Business impersonators alone, the bucket where "we're calling from Google about your rankings" lives, took nearly $1 billion (FTC, 2026).

One thing to fix in your head before we go further: Google does not cold call you. Google does not email you from a Gmail address. Google publishes its warnings in documentation, not voicemails. Anyone opening with "we're with Google" or "we're a certified Google partner with insider access" has already told you everything you need to know, and Google's hiring guide now explicitly suggests reporting these operations to the FTC (Search Engine Journal).

What are the red flags, ranked by cost?

The flags below are ordered by how much they tend to cost you, from wasted retainer to actual damage. The first three come straight from Google's own list (Google Search Central):

• Guaranteed rankings. "Page one in 30 days or your money back." Nobody controls Google's results, so the guarantee is either a lie or a trick, page one for a keyword with zero buyers is easy and worthless.
• A special relationship with Google. There is no priority submission, no insider desk, no partner status that moves organic rankings. This claim is disqualifying on its own.
• Secret methods. If they will not explain the work in plain language, the work either does not exist or would get you penalized. Both are your problem, not theirs.
• The $99/month package. Real SEO work costs real hours. At $99, you are buying an automated report and a monthly charge, not effort. The pricing guide covers what the money actually buys at each level.
• Urgency and acronym soup. The 2026 flavor is AI panic: pay now or vanish from ChatGPT. Google's John Mueller put it plainly: the stronger the urgency and the push of new acronyms, the more likely it is spam and scamming (Search Engine Roundtable, 2025).
• They register everything in their name. The most expensive flag of all, because leaving costs you your own domain, profile, or analytics. The ownership article covers how businesses get locked out of their own websites.

Why is the rank-report retainer the expensive one?

Because it is legal, plausible, and can run for years. The rank-report retainer is not a crime; it is a business model: charge monthly, send a PDF of ranking positions, do close to nothing. The report keeps you calm because line items move up and to the right. The trick is which lines: rankings for your own business name, or for keyword phrases so specific nobody has ever typed them. You were always going to rank for those.

The tell is the gap between activity and outcomes. Positions are activity. Calls, form fills, booked jobs, and direction requests are outcomes. If a year of reports cannot answer "how many leads did this produce," you have been paying for the report itself. We wrote a full guide on how to tell if SEO is actually working, and the short version applies here: measure leads by source, not positions on a PDF.

This model is also why the industry's trust numbers are so grim, and why the honest players compete on proof. When RMCM took over E&M Equipment's site, the deliverable was not a report: the SEO health score went from 31 to 90, and the changes are visible on the page, in the code, and eventually in the phone ringing. That is what verifiable looks like.

What do you ask before signing?

Five questions, asked calmly, expose almost every bad provider. A legitimate one will enjoy answering them:

1. "What exactly will you do in the first 90 days, and what will I see?" You want named work: pages, fixes, profile updates. Vague process talk ("we optimize and monitor") is a no.
2. "How will you report results, and in what units?" The only good answer involves leads and revenue-adjacent numbers, with rankings as supporting context. A rank-only report is the trap from the last section.
3. "Whose accounts will everything live in?" Your domain, your hosting, your Google Business Profile, your analytics, with their access as a manager you can revoke. Any other arrangement is a future hostage situation.
4. "Can I speak to a current client my size?" Not a logo wall, a phone call. Scams have testimonials; businesses have references.
5. "What happens when we stop working together?" The honest answer: you keep everything, and the work keeps compounding. If anything gets "turned off" when you leave, it was rented, not built.

Notice none of these require you to understand SEO. They only require the provider to be checkable, which is the one thing a scam cannot survive. The same logic runs through our guide to hiring a web designer, because it is the same con in a different aisle.

What does a legitimate engagement look like?

Boring, specific, and priced like labor. Ahrefs polled hundreds of SEO providers and found agencies averaging $3,209/month, consultancies about the same, and freelancers around $1,350, with the most common retainer band at $501–$1,000 (Ahrefs). A local service business with normal competition does not need the top of that range, but the bottom of it still buys real hours from a real person.

What the money buys each month should be nameable. On a local engagement that means some mix of: technical fixes shipped to the site, pages written or rebuilt around real buyer questions, Google Business Profile work, a review system that produces steady detailed reviews, citations corrected, internal links built. The reporting connects that work to calls and form fills. And everything lives in accounts you own, so the day you leave, you lose a vendor, not your visibility.

One more green flag that costs providers nothing but tells you plenty: plain language. Anyone doing real work can describe it like a contractor describes a job. Jargon density rises as deliverables fall.

What is the 15-minute self-check?

Before you believe any pitch, including ours, run these three checks yourself. They cost nothing and require no expertise:

1. The site: search (3 minutes). Type site:yourdomain.com into Google. If your pages show up, you are indexed, and anyone claiming "your site is invisible to Google" is lying to you. That single check kills the most common cold-call opener.
2. The profile check (5 minutes). Search your business name and look at your Google Business Profile as a customer: correct hours, categories, photos, recent reviews. Most "ranking emergencies" pitched by callers are just an incomplete profile you can fix free. The 15-minute profile audit goes deeper.
3. The audit (30 seconds). Run your site through the free RMCM audit or any reputable scanner. Now you hold an independent list of your real issues. When a pitch names problems that are not on it, you know what you are dealing with.

Fifteen minutes, and you have converted yourself from a mark into an informed buyer. Scammers screen for people who will not check. Be someone who checks.

Frequently asked questions

If the pitch is volume or secrets, walk

Every scam in this article fails the same one-line test: it cannot survive being checked. The guarantee collapses against Google's own documentation. The insider access collapses against reality. The $99 price collapses against arithmetic. The urgency collapses against a calendar. You do not need to out-argue these people. You need fifteen minutes and the willingness to verify.

And do not let the con artists price you out of the channel, because that is the second theft. Search still sends buyers to whoever earns the visibility, and the work that earns it is nameable, ownable, and checkable. If you want to see what that looks like for your business, the SEO service page names the deliverables, and the free audit hands you the evidence first, before anyone asks you to sign anything.