Dental Scam Watch

One likely explanation is deceptive lead generation or data harvesting.

When someone responds to an unusually attractive dental offer, the ad or associated webpage may ask for information such as:

• Name
• Telephone number
• Email address
• ZIP code or address
• Age
• Type of dental treatment needed
• Insurance information
• Financing needs
• Other demographic or treatment interest information

That information can itself have commercial value.

The Federal Trade Commission has extensively documented the online lead generation industry. In some lead generation systems, marketers collect consumer information and distribute or sell those consumers as prospective sales leads to other businesses. The FTC has described lead generation markets in which the consumer's personal data is effectively the product being exchanged.

In a 2025 healthcare-related enforcement action involving MediaAlpha, the FTC alleged that misleading social media, paid search, and other ads induced consumers seeking health insurance to provide personal information that was then sold to telemarketers. The FTC alleged that some ads falsely suggested government affiliation and promised low-cost comprehensive health coverage.

That does not prove that every misleading dental ad operates the same way. It does establish that the underlying business model — misleading healthcare advertising used to obtain and monetize consumer data — is real.

At first glance, this seems counterintuitive. If someone is trying to harvest leads, why send the patient to the legitimate dental office?

One possible answer is that the eventual phone call is not the transaction the advertiser cares about.

The important event may have already occurred.

Modern digital advertising and call tracking systems can measure consumer behavior such as:

• Ad clicks
• Landing page visits
• Form submissions
• Treatment interest selections
• Geographic and device information
• Conversion events
• Calls initiated from ads or websites
• Call timing, duration, and other call activity

Meta openly offers advertising products designed to generate telephone leads. Google provides call reporting and website call conversion tracking for legitimate advertisers. Google states that call reporting can include details such as call start time, duration, connection status, and, in qualifying circumstances, the caller's phone number.

These are legitimate advertising tools. Their existence illustrates an important point: a consumer's call-related interaction can be measurable and valuable independently of where the eventual call terminates.

A Possible Sequence

• A consumer sees an ad displaying a legitimate dental practice's name or logo.
• The ad promotes an unusually attractive offer, such as "$100 implants" or a purported government grant.
• The consumer clicks the ad.
• The advertiser or associated technology records information about that interaction.
• The consumer may complete a form, answer treatment questions, provide contact information, or interact with a tracked calling mechanism.
• The consumer is ultimately directed to the real dental practice.
• The dental office receives a confused patient asking about an offer it never made.

By the time the patient reaches the dental office, the third party may already have obtained the information or advertising signal it was seeking.

A legitimate marketing company has almost no rational incentive to deliberately advertise an offer that its own client does not provide.

Imagine a marketing company intentionally advertising "$100 dental implants" for a practice that does not offer $100 implants. The predictable result would be:

• Angry or confused patients
• Extremely poor-quality leads
• Wasted staff time
• Damage to the practice's reputation
• Complaints against the marketing company
• Wasted advertising dollars
• Possible regulatory or legal exposure
• A damaged or terminated client relationship

That would be a remarkably self-defeating marketing strategy.

An unrelated third party may not care about any of those consequences. The dental practice's identity may simply be a credibility device if the advertiser's objective is to collect data, generate a marketable lead, obtain a trackable consumer interaction, or facilitate another form of fraud.

Not necessarily.

A simple click-to-call link does not automatically mean the advertiser receives the consumer's telephone number. The exact data available depends on the platform, call routing system, landing page, tracking technology, and how the campaign is configured.

However, advertising and call tracking systems can associate calls with campaigns and sessions, and some systems can expose additional call information. A malicious or deceptive funnel may also collect other information before a call is placed.

For that reason, the more accurate concern is not that every tap of a call button automatically reveals a phone number. It is that the consumer's interaction may already be trackable or commercially valuable before the call reaches the legitimate dental office.

If you encounter an unusually generous dental ad or a supposed government program:

• Verify the offer directly with the dental practice before providing personal information.
• Find the practice's official website independently rather than relying only on the link or phone number in the ad.
• Ask the office whether the promotion is legitimate.
• Take screenshots or a screen recording before closing the ad.
• Capture the advertiser/account name, offer, practice name/logo, landing page address, forms, and any phone or WhatsApp numbers.
• Do not provide Social Security numbers, banking information, credit card information, passwords, authentication codes, or other highly sensitive information unless you have independently verified who you are communicating with.

FTC consumer guidance similarly recommends contacting an organization through a phone number or website you know is legitimate rather than relying on contact information supplied in a suspicious message.

Take the Patient Seriously

The fact that your office cannot locate the advertisement does not mean the patient did not see it.

Ask for a Screenshot or Screen Recording

If the ad is still visible, ask the patient to preserve it before closing the app or page.

Preserve Everything Available

• Screenshot or recording
• Platform
• Date and approximate time
• Advertiser or page name
• Landing page URL
• Phone number
• WhatsApp number
• Ad language
• Offer being promoted
• Forms the patient completed
• Information the patient submitted

Check Authorized Advertising Accounts

Confirm whether the ad exists in the practice's Meta, Google, TikTok, or other authorized advertising accounts. Ask all authorized marketing providers to do the same.

If the ad is absent from those systems and nobody approved the offer, that strongly supports the conclusion that the ad originated with an unauthorized third party.

Report the Ad or Impersonation

Depending on the platform and facts, reports may be appropriate for scam activity, business impersonation, trademark infringement, or other unauthorized use of the practice's identity.

Report Repeated or Serious Fraud

Potential fraud can be reported to the Federal Trade Commission at ReportFraud.ftc.gov. Internet-enabled fraud and impersonation can also be reported to the FBI Internet Crime Complaint Center at IC3.gov.

Digital ads can be targeted based on geography, demographics, online behavior, language, device type, audience characteristics, and other factors.

That means the staff of the dental practice being impersonated may never receive the advertisement themselves. A patient can see the ad, call the office, and the practice may have no practical way to reproduce what the patient saw.

Ads, accounts, and landing pages can also disappear or change quickly.

A screenshot or screen recording from the patient is therefore extremely valuable.

If your practice did not approve the offer and cannot locate the ad in your authorized advertising accounts, it is highly unlikely that your marketing company created it. A legitimate marketing provider normally has records showing what it actually ran, including the advertising account, campaign, creative, copy, landing page, targeting, budget, billing, and conversion activity.

A third party does not need access to any of those systems to copy a practice's:

• Practice name and logo
• Phone number and address
• Doctors' names and photographs
• Website photographs and copy
• Reviews and services
• Other publicly available business information

Dental practices should also regularly verify the contact information displayed on their Google Business Profile.

Google allows claimed and verified Business Profiles in eligible regions to add WhatsApp or text messaging contact options. Google's documentation states that a business can add a WhatsApp click-to-chat URL or a phone number capable of receiving text messages.

If an unauthorized WhatsApp number or other messaging channel appears on a legitimate practice's profile, the risk can be more serious than a misleading ad.

How the Attack Could Work

• A patient searches Google for the dental office.
• The patient finds the legitimate dental practice's Business Profile.
• The patient clicks a WhatsApp or messaging option displayed on that profile.
• The messaging account is controlled by someone other than the practice.
• The third party impersonates the dental office.

A patient in that situation may reasonably believe they are speaking with the real practice because the communication originated from what appeared to be the practice's legitimate Google listing.

An attacker could potentially request:

• Personal information
• Insurance information
• Payment information or deposits
• Account credentials
• Authentication codes
• Other sensitive information

Unauthorized phone, WhatsApp, messaging, website, or appointment information on a Google Business Profile should be treated as a potential security and business impersonation incident — not merely an SEO or marketing problem.

Practices should regularly review phone numbers, WhatsApp information, text/SMS information, website URLs, appointment URLs, Business Profile owners, and Business Profile managers.

The underlying trust mechanism is similar.

The FTC explains that phishing scams often impersonate a company or organization the victim knows and trusts. Scammers may even use the real company's logo while attempting to obtain passwords, account numbers, Social Security numbers, or other personal and financial information.

Traditional phishing might look like:

Fake bank communication → real bank branding → fake login or request → victim provides information

A deceptive dental-data scheme could theoretically look like:

Fake dental advertisement → real practice branding → unusually attractive offer → consumer interacts or provides information

The exact objective may differ, but the psychological mechanism is similar: borrow the credibility of a legitimate organization to persuade someone to interact with something they would otherwise distrust.

Possibly — but the operators behind these specific dental ads have not been conclusively identified.

Internet fraud routinely crosses national borders. U.S. government agencies have documented sophisticated phishing, impersonation, credential harvesting, and social engineering operations conducted by foreign actors.

In one 2023 joint cybersecurity advisory, U.S. agencies described North Korean Kimsuky actors directing victims to phishing sites that mimicked legitimate web portals and harvested usernames and passwords. In 2024, the FBI described North Korean actors conducting sophisticated social engineering campaigns and impersonating recruiters, technology companies, and known individuals.

These examples demonstrate that offshore phishing, impersonation, and data harvesting operations are real. They do not establish that Russia, North Korea, or any other particular country is responsible for misleading dental ads.

Why Offshore Involvement Remains a Reasonable Possibility

Characteristics frequently seen in these incidents can be consistent with operations that are easy to run remotely from anywhere in the world, including:

• Disposable social media accounts
• Rapidly changing ads
• Multiple languages
• WhatsApp-based communication
• Fake or altered business contact information
• Copied branding
• Difficulty identifying the actual advertiser
• Little apparent concern about the reputation of the business being impersonated

None of those characteristics proves that an operator is overseas.

A deceptive ad could be operated by domestic scammers, offshore scammers, freelance digital marketers, affiliate marketers, lead generators, data brokers, organized fraud groups, or multiple unrelated actors using similar tactics.

The advertiser, hosting provider, lead aggregator, data broker, telemarketer, and ultimate purchaser of a lead may also be located in different countries.

For that reason, offshore involvement should be described as a credible possibility and not an established attribution.

Possibly, but there is not enough public evidence to say.

Both schemes can rely on borrowing the credibility of a legitimate dental practice. However, misleading dental ads, deceptive lead generation, Google Business Profile manipulation, phishing, and direct business impersonation may involve different operators or different layers of a broader fraud ecosystem.

Until the operators are identified, these should be treated as potentially related but separately documented threats.