SEO agency red flags: the scams, the tells, and how to leave

SEO has a scam problem, and it isn’t a few bad apples. The conditions are perfect for it: the customer can’t see the work, results take months either way, and failure always has a plausible excuse. A dishonest agency and an honest one send the same invoice, and for the first six months they can look identical from the outside.

They aren’t identical, though. Scams leave tells at every stage: in the pitch, in the contract, and in the work itself. This is the list. If you’re mid-contract and already suspicious, our guide on how to tell if your SEO agency is actually doing anything covers the twenty-minute check; this page covers the patterns that should stop you before you sign, and the ones that mean you should leave.

Red flags in the pitch

“We guarantee first-page rankings.” Nobody controls Google. Not partners, not insiders, nobody. Google’s own documentation says outright that no one can guarantee a ranking. Every guarantee is one of three things: a lie, a plan to rank you for terms nobody searches, or a refund policy dressed up as confidence. All three cost you time you don’t get back.

“We have a special relationship with Google.” There is no priority lane for organic rankings, no inside contact, no way to pay Google for them. Google’s partner and certification programs cover products like ads and analytics, not organic search. Anyone implying that a Google relationship gets you rankings is telling you, in their first conversation, that they’ll say untrue things when it helps them. Believe them.

The scary unsolicited audit. An email or call announcing that your site has “critical errors” and is “being penalized,” usually with a PDF full of red gauges. Nearly always these are automated reports generated in bulk against any site a scraper can reach, and the alarming scores are the product: fear converts. A real audit names specific pages and specific fixes on your specific site. A scare audit names categories and a price.

The fake Google call. Robocalls and voicemails claiming to be Google, warning that your listing will be removed unless you act. Google says it doesn’t make unsolicited calls threatening to remove your listing; its legitimate automated calls are things like a verification code you asked for. The people who do make them are selling either panic-priced listing management or nothing at all.

“We’ll submit your site to hundreds of search engines and directories.” A sales pitch from 2005 preserved in amber. There are only a few search engines that matter, submission to them is free, and mass directory submissions range from worthless to actively harmful under Google’s link spam policies. If the deliverable list sounds like volume, someone is selling you volume instead of results.

Secrecy as a feature. “Our methods are proprietary, we can’t reveal them.” Real SEO is not a secret: it’s content, technical health, and reputation, executed well. The details of a good strategy are specific to you, but the shape of it can be explained in plain English. A vendor who can’t explain the plan either doesn’t have one or has one you’d object to.

Pressure to sign today. Legitimate SEO results do not depend on whether you sign this week. Urgency in the pitch is mostly there to beat your due diligence.

Red flags in the contract

This is where the expensive traps live, because the damage surfaces only when you try to leave.

They own your accounts. The Search Console property, the analytics, the Business Profile, sometimes the domain registration itself, all created under the agency’s accounts. Everything works fine while you pay. Cancel, and you discover your business’s entire search history and infrastructure belongs to someone you just fired. Before signing anything: your domain in your registrar account, your Search Console and analytics with you as owner, the agency added as a user. That one check prevents the worst version of this.

The site is theirs too. Some agencies build your website on their platform, and the contract says the site does not transfer if you leave. You paid monthly for years, and leaving means starting from a blank page while your old site, your content, and sometimes your phone number stay behind as their property. Read the ownership clause before you admire the design mockups.

Long lock-ins with auto-renewal. Twelve-month minimums that quietly renew into another twelve unless cancelled inside a narrow window. SEO genuinely needs months to work, so honest agencies do ask for patience, but patience and imprisonment are different products. A fair deal earns renewal instead of engineering it.

Deliverables in categories, not items. “Ongoing optimization, technical maintenance, authority building.” A contract that never commits to anything countable can never be breached by doing nothing. Look for numbers: pages, posts, fixes, reports, and what happens if they don’t arrive.

Red flags in the work itself

Some agencies do deliver something. The question is whether the something helps you or endangers you, because the riskiest schemes are performed in your name, on your domain, and you hold the penalty when they’re caught.

Bought links and link networks. Hundreds of links from private blog networks, link farms, or bulk gig marketplaces. Google’s spam policies explicitly target link spam. Its systems discount those links, and sites that reach manual review can be penalized outright. The agency’s other clients are usually running the same scheme; when the network burns, everyone attached to it burns together, and the agency is free to start over under a new name while your domain keeps the history.

Content flooding. Dozens or hundreds of thin, near-identical pages published monthly, lately machine-generated at scale with no human review. Google’s policies call this scaled content abuse. Beyond the policy risk, there’s the brand cost: those pages are your company speaking. If you wouldn’t put your name on the page, someone else just did it for you.

Invisible tricks. Hidden text, pages that show Google one thing and visitors another, doorway pages targeting every town within a hundred miles with the same swapped-in city name. These are the oldest entries in Google’s spam policies, and modern detection catches them well. You’ll find out it happened when your traffic disappears, not when it’s done.

Reports about motion instead of change. Every month: rankings monitored, algorithms watched, competitors analyzed. Nothing on your actual site changes for months. Real SEO leaves fingerprints you can point at: pages, titles, fixes, content. Surveillance is not a service.

How to leave without losing your accounts

If you’ve recognized your vendor above, sequence your exit before you announce it:

1. Read the contract first. The notice window and the auto-renewal date set the deadline for everything below. Miss them while chasing account transfers and you buy another term of the thing you’re escaping. No written contract? Verbal deals can still carry obligations, so get your cancellation terms confirmed in writing before you act, then start at step two.
2. Confirm what you own. Domain registration, hosting, Search Console, analytics, Business Profile, the site files themselves. Log into each one independently, today, while relations are calm.
3. Export everything, quietly. Search Console data, analytics history, any content they wrote for you, invoices, and, if they host your site, a full backup of its files and database. Exporting is silent; the next step is not.
4. Take ownership of what you can. Get owner-level access transferred to accounts you control before the cancellation email goes out. Access requests from a paying client get answered; access requests from a departing one get slow-walked. Budget real time here too: Business Profile ownership transfers run on a waiting period, and domain moves can hit a sixty-day transfer lock.
5. Then cancel, in writing, and keep paying through the notice period, so the breach is never yours.
6. After the notice period ends, close the door. Remove their user access everywhere and change the passwords. And if the hosting or platform account is theirs, stand the site up on hosting you control before the notice period runs out; on their servers there’s no access to revoke, only a plug that can be pulled.

If it turns out they hold your domain hostage, the road depends on whose name is on the registration. If it’s yours, start with your registrar’s dispute process, and ICANN’s complaint form covers a registrar that won’t follow its own transfer rules (country domains like .co.uk have their own registry channels). If they registered it in their own name, that’s an ownership dispute, and a lawyer’s letter moves faster than any support ticket. It’s an ugly fight that diligence before signing would have prevented, which is the real lesson of this entire page.

What the honest version looks like

The honest version is checkable, and that’s the whole difference. You hold your own accounts. The plan is explained in plain English. The monthly report lists what changed, why, and what it did, specific enough to verify. Results are framed in months, with the reasoning shown while you wait. Nothing above survives contact with a client who can see their own data, which is why so many of the scams on this page start by making sure you can’t.

That checkability standard is how we think SEO should be run, and it’s the standard worth holding any vendor to, ours included. The industry earned your suspicion. Make every agency, including us, show you the receipts.