Fake Locksmiths Are Buying Their Way to the Top of Google, Then Charging Thousands

Fraudulent locksmiths operating across the UK exploited paid Google search listings and an unregulated industry to extort thousands of pounds from vulnerable victims during the first quarter of 2024, with reported scams rising 147 percent year-on-year.

A Staged Emergency at the Front Door

Sarah, 30, had gone for a walk and left her keys inside her flat. She had her three-month-old baby with her. The solution seemed simple: search Google for a local locksmith, call the first credible-looking result, wait ten minutes.

The company she found was a paid listing, a sponsored result that sat above the organic search entries because its operator had bought that position. Its website advertised a starting price of £45. It claimed more than 4,500 five-star reviews. Both figures appeared designed to disarm suspicion.

The locksmith who arrived told Sarah the lock had to be drilled. He drilled it. He replaced it. Then he announced that an internal component had been damaged in the process and needed replacing too. By the time Sarah was inside her own home with her baby on a changing mat, the bill had reached £2,209. The card machine was pointed at her face before she fully understood what had happened.

Trading standards officers describe what Sarah experienced as part of a pattern they are now calling an epidemic.

The Structural Problem: No Licence, No Regulator, No Floor

The United Kingdom imposes no licensing requirement on locksmiths. Any individual can legally describe themselves as a locksmith, construct a website, purchase a Google Ads placement, and begin operating the same day. There is no governing body with authority to revoke credentials, because no credentials are required.

This regulatory vacuum is the core failure. Paid search advertising amplifies it by wrapping these operations in a layer of false legitimacy. A sponsored listing at the top of a search page looks authoritative to someone who is cold, rushed, or frightened. A manufactured star rating reinforces that impression. The scam is engineered around the moment when a person is least able to evaluate their options.

Once the locksmith is at the door, the power dynamic shifts decisively in their favour. The victim is at home, in distress, and facing a stranger who either has already opened the door or who is the only person on the scene who can. Refusing to pay means arguing at your own open doorway. Multiple victims report being intimidated into paying rather than escalating to police.

Why Paid Search Is the Attack Vector Here

The mechanism is worth understanding precisely, because it mirrors tactics seen in other fraud categories. Criminals do not need to hack Google. They buy visibility the same way any legitimate business does. The cost of a Google Ads campaign is small relative to a single £2,209 payout. The return on investment for a fraudulent operator is high.

Google's advertising policies prohibit misleading representations, but enforcement depends on complaints and detection after the fact. By the time a fake locksmith accumulates enough reports to trigger a review, the operator can close the account, open a new one under a different business name, and resume. Fake review profiles, another purchased commodity, reset the credibility clock each time.

This is a social-engineering attack at scale. The technical sophistication required is minimal. The psychological sophistication is not.

What the Failure Pattern Tells Defenders

Organisations that study fraud patterns consistently find that the most effective attacks do not require technical skill. They require the ability to appear trustworthy at exactly the moment a target is under stress. The Verizon 2024 Data Breach Investigations Report found that 68 percent of breaches involved a non-malicious human element, including people being deceived or making errors under pressure. Sarah's experience is a civilian version of exactly that pattern.

The control that failed here is not technical. It is the absence of verified identity at the point of contact. A licensed, vetted locksmith with a confirmed trade association membership is the equivalent of multi-factor authentication for a service call. The Master Locksmiths Association (MLA) vets members and maintains a searchable directory. Using it before calling a number from a search result is a simple, high-value verification step that most people in distress skip.

Organisations running security-awareness programmes know that stress and time pressure are the conditions attackers choose deliberately. Training that builds the habit of pausing to verify identity before granting access, whether digital or physical, directly addresses the root cause of scams like this one. The same mental model that teaches an employee to verify an email sender before clicking a link applies when choosing a tradesperson from a search result. Train2Secure's awareness training covers exactly this category of social engineering: attacks that bypass technical controls by targeting people in high-pressure moments.

What You Should Do If You Are Locked Out

Before calling any number from a search result, take two minutes to check the following.

• Look up locksmiths on the Master Locksmiths Association directory at locksmiths.co.uk. MLA members are vetted and follow a code of conduct.
• Ask for a written or clearly stated quote before any work begins. Confirm explicitly that the price covers all labour and parts.
• If the final bill is dramatically higher than the quoted figure, do not pay by cash. Pay by credit card if possible, then contact your card issuer to dispute the charge as a misrepresentation.
• Report the trader to your local trading standards office via the Citizens Advice consumer helpline on 0808 223 1133.

If you feel physically intimidated into paying, call 999. That is not an overreaction. A stranger who has access to your home and is demanding money is a situation the police treat seriously.

The Regulatory Gap Remains Open

As of mid-2025, no UK legislation requires locksmiths to hold a licence. Several industry bodies have called for mandatory registration for years. The argument against it typically centres on the burden imposed on legitimate sole traders. That argument has so far prevailed, and the cost has been borne by people like Sarah.

Until licensing exists, the burden falls on the consumer to do the verification that a regulator would otherwise perform. That is an unfair situation. Knowing it exists is the first step toward not becoming a statistic in next year's trading standards report.

For organisations building physical-security awareness into their training programmes, this incident is worth including. The same employees who can spot a phishing email may not apply the same scepticism to a phone number at the top of a search result. Broadening the definition of "social engineering" in your security standards curriculum to include in-person and telephone fraud closes that gap.