How to Avoid Getting Scammed by an SEO Agency (8 Red Flags)

You can spot most SEO agency scams before you sign anything, because they repeat the same few patterns. The agency guarantees a ranking, refuses to explain its methods, builds the plan on bought backlinks, and sends monthly reports full of keyword positions that never connect to sales.

Google's own advice on hiring an SEO states that no one can guarantee a number one ranking. It also reminds site owners that they are responsible for what any company they hire does to their website. A bad agency costs you more than its fees, because spam tactics can push your site down or remove it from Google entirely.

The patterns have also grown since AI assistants started answering buying questions. A newer group of sellers now promises guaranteed mentions in ChatGPT or Google's AI Overviews. That offer is the old ranking guarantee under a new label, and it deserves the same suspicion.

The agency guarantees a ranking position

A promise like "page one in 90 days or your money back" is the oldest warning sign in the industry. Google decides rankings with systems that no outside company controls or can see into. Google's guidance tells you to be wary of any SEO that guarantees rankings, claims a special relationship with Google, or offers priority submission to the search engine.

Agencies that make this promise usually protect themselves in one of two ways. Some pick obscure, long phrases that nobody searches for, rank you for those, and call the job done. Others hit the target with tactics that work for a few months and then collapse when Google catches up. That collapse tends to arrive after the contract has ended and the money has been paid.

An honest agency will still give you expectations. It can explain which keyword groups it thinks are realistic, how long similar sites have taken to move, and what has to happen first on your website. You should hear ranges, assumptions, and risks instead of a promise.

The agency will not explain its methods

Some agencies describe their work as a proprietary formula they cannot share. Real SEO work is not secret. It is made of technical fixes, content, internal links, structured data, and earning mentions from other sites, and every competent practitioner can explain each of those in plain language. Google's guidance says anyone with access to your server should explain every change they make.

Secrecy usually hides one of two things. Either little work is happening, or the work breaks Google's spam policies and the agency knows you would object if you saw it. In both cases you lose the ability to judge whether your money is producing anything.

Ask for a written list of changes each month, with the page, what was changed, and why. A good agency already keeps this record for its own team, so sharing it costs them nothing. If you want to see what a documented process looks like, our methodology page lays out how we sequence the work.

The plan depends on buying backlinks

Links from other websites still matter, but a plan built mainly on buying them is the most common way businesses end up with a penalty. Google's link spam policy covers buying or selling links for ranking, including paying with money, goods, services, or free products. Paid links are allowed only when they carry a sponsored or nofollow attribute. That attribute removes the ranking benefit the agency is selling you.

The warning signs show up in the proposal. Look for packages priced by the number of links per month, promises of links from sites with a high authority score, private networks of blogs that the agency owns, and contests or challenges where people race to rank a made-up keyword. Google also lists expired domain abuse and site reputation abuse as spam, and both are common inside cheap link packages.

A safer plan starts on your own website. Content that answers the questions your buyers ask earns links and citations over time, and a site with clear topic coverage needs fewer links to compete. Our post on building topical authority goes deeper on that approach, and our guide on getting cited by AI search engines covers why links alone no longer decide visibility.

Rankings are the only number in the report

A report that shows only keyword positions makes it easy to hide a campaign that is not working. An agency can choose keywords nobody searches for, show them climbing, and call the month a success. Ranking for a phrase only matters if people search for it and some of them become customers.

The numbers that tell you whether SEO is paying for itself are further down the funnel. Ask to see organic sessions to the pages that sell, leads or sales from organic search, conversion rate from those visits, and the cost of those customers compared with your paid channels. For a business that sells offline, enquiries, WhatsApp clicks, and store visits from Google Business Profile serve the same role.

Agree on these measures in the contract before work begins, so nobody can change the definition of success later. Our post on turning SEO goals into business growth explains how to pick KPIs that match the stage your company is in.

The agency controls your accounts and data

Your domain, Google Search Console, Google Analytics, Google Business Profile, and website hosting should be registered to your company. Some agencies set these up under their own accounts and keep them there. When you try to leave, you discover that you do not own your traffic history or your business listing. In the worst cases, the agency holds the domain name itself.

Search Console makes the right setup simple. It has three permission levels, owner, full user, and restricted user, and only an owner can add or remove other people. Your company should be the owner, and the agency should be added as a user. Google's guidance also suggests giving read only access during an audit, before any contract is signed.

Make a list of every account the agency touches and check who owns each one. Ask for content, reports, and keyword research to be delivered in files you keep, so the work stays with you after the relationship ends.

The price and contract do not add up

A quote written before anyone has looked at your website is a guess. Cheap guesses tend to turn into thin work or surprise charges later. Two agencies can quote Rp 5 million and Rp 25 million a month for the same site because of differences in scope, seniority, and how much repair the site needs. Our breakdown of what sets the cost of SEO walks through the factors behind those gaps.

Contract terms carry their own warning signs. Watch for long lock-in periods with no exit clause, full payment up front for a year of work, deliverables described in vague words like "optimization" without a count of pages or tasks, and penalty fees for leaving. SEO takes months to show results, so a minimum term can be fair, but you should be able to exit if the agreed work is not delivered.

Ask for a scope that lists what will be done each month and which results each phase is meant to produce. Our pricing page shows how we structure engagements, and a free audit gives you a written view of your site before you decide anything.

The first contact was a cold email about problems on your site

Emails that say your website has "critical SEO errors" or "dropped out of Google" are often generated by the thousands from automated tools. Google advises treating unsolicited emails about search problems with the same suspicion you give to obvious phishing messages. The sender usually has not looked at your site in any depth.

The tells are easy to find once you look. The email names your domain but no specific page, lists generic problems that apply to almost any site, comes from a free email address, and pushes you toward a quick call or a discounted package that expires soon. Some include a screenshot from a third party tool that Google does not endorse and that has no access to Google's own ranking data.

You can check most of these claims yourself for free. Google Search Console shows real indexing problems and any manual actions against your site. If Search Console shows nothing alarming, the email is a sales pitch.

The agency promises guaranteed placement in AI answers

The newest version of the ranking guarantee is a promise to put your brand inside ChatGPT, Gemini, Perplexity, or Google's AI Overviews by a set date. AI assistants build answers from sources that change from one query to the next, and no agency controls which brands they mention. A guarantee here is as empty as a guarantee of the number one spot on Google.

Watch for sellers who treat a single file or tag as the answer. Google's documentation on AI features in Search says there are no extra requirements to appear in AI Overviews or AI Mode, and that you do not need new machine readable files, AI text files, or special schema. Packages built around llms.txt are a good example, because llms.txt is a proposal that no major AI engine has confirmed it uses.

Real work on AI search visibility looks a lot like good SEO with more attention to how your brand is described across the web. It covers crawlable content, consistent facts about your company on trusted third party sites, and pages that answer the specific questions buyers ask assistants. Our explainer on generative engine optimization describes what that work involves, and our post on what your business needs in AI search helps you decide whether you need it yet.

Questions to ask before you sign

A pitch meeting is the best moment to test an agency, because the right questions expose weak answers quickly. Google publishes its own list of questions for hiring an SEO, and these ten adapt it for businesses in Indonesia.

Can you show results for past clients, and can we speak to one of them?
Do you follow Google Search Essentials, and how do you get links to client sites?
What results do you expect, over what timeframe, and how will you measure them?
Which metrics beyond rankings will you report each month?
Who will own our Search Console, Analytics, and Business Profile accounts?
Will you share every change you make to the site and the reason for it?
Who will work on our account, and how senior are they?
What is your experience in our industry and in the Indonesian market?
What happens to our content and data if we end the contract?
What do you need from our team to make the plan work?

Pay attention to the questions the agency asks you in return. A good agency wants to know what makes your business different, who your competitors are, how customers find you today, and what a new customer is worth. An agency that skips all of that and moves straight to packages is selling a product, and your business will not shape the work.

What to do if you think your agency is scamming you

Start by checking that you own your accounts. Log in to Search Console, Google Analytics, Google Business Profile, your domain registrar, and your hosting, and confirm that your company is the owner of each one. Transfer ownership before you raise any concerns with the agency, so you are not negotiating while they hold your data.

Next, look for damage. The Manual actions report in Search Console tells you whether Google has penalized the site. The Links report shows which sites link to you, so you can spot a sudden wave of links from irrelevant or foreign sites. Ask the agency in writing for a full list of the links it built and the changes it made, and keep a copy of every report it has sent you.

Then get an independent view before you hire a replacement. A second agency or consultant can audit the site, separate the useful work from the harmful work, and tell you what needs cleaning up. If you would like that view from us, you can request an audit or book a call, and we will walk you through what we find in plain language. If you are planning a longer campaign afterwards, our post on running an SEO campaign that compounds shows how a well run engagement is paced.