Everyone touched it. Nobody owns it.
A scam advert is not one decision by one company. It passes through six sets of hands between the person who wrote it and the moment your money leaves. Ofcom has just proposed roughly forty rules aimed at that chain, and the consultation is open until 2 October 2026.
So we walked the chain and asked the same question at every stop. Not who is to blame. Who owes the victim anything?
The answer is the point of this piece, and it is not the answer the debate assumes.
Six parties handle a scam advert before it reaches your money, and five of them owe you nothing. The advertiser account is often a hijacked or purchased business. The affiliate network is a web of separate companies. The cloaking layer exists so that everyone upstream can truthfully say they never saw what you saw. The platform that was paid has, in the UK, no legal liability for scam adverts today, and Ofcom's draft code would make it answerable to the regulator, not to you. The only hand in the chain that can currently owe you money is your bank, which is the one that never saw the advert at all.
The chain, one hand at a time
Each stop below carries the same verdict line, and the verdict is deliberately narrow. Not is this party behaving well. Not could they do more. Only this: if you lost money, does this party owe you any of it?
The account that bought the advert
This is the hand Ofcom proposes to verify. The draft code would require platforms to check advertiser identities, and for banking and investment advertisers, to confirm they are legally authorised.
The difficulty is that the account which passes that check is frequently not the operator. The Tech Transparency Project documented more than 110 Facebook groups with over 531,000 members openly trading verified advertising accounts. Malwarebytes documented a campaign in January 2025 that phished legitimate advertisers out of their own Google Ads accounts and then ran further scam adverts from them, with the hacked business paying for the spend until it noticed.
Run an identity check against that account and it comes back clean, because it belongs to a real company. It is just not the company running the scam.
The network that placed it
Between the operator and the platform sits an advertising network, and the largest of them are not small. Infoblox, Menlo Security and Dark Reading have described VexTrio as possibly the largest malicious traffic broker on the web. It has been running since 2015, and it controls both the publishing and the advertising sides through a web of intertwined companies: Teknology, Los Pollos, Taco Loco and Adtrafico.
That structure is not incidental. It is the point. Four names, four sets of paperwork, four sets of counterparties, and no single one of them is the thing you would name in a claim.
The layer that decided what you saw
Cloaking software shows one page to a reviewer and a different page to a member of the public. IMKLO, a cloaker built by IM GROUP and used by VexTrio, is one named example among several, and the same operation has produced software specifically to disguise malicious adverts from security researchers. Smartlinks go further and cloak the final landing page itself, precisely to defeat analysis.
It is worth being exact about what this buys, because it is usually described as deceiving the victim. That is the smaller half of it.
The platform that was paid to show it
This is where Ofcom's roughly forty measures land, and it is the only hand in the chain that took money from the operator and delivered the advert to you personally.
In November 2025 Reuters published an investigation by Jeff Horwitz based on internal Meta documents spanning 2021 to 2025. The figures below are Reuters' wording, and Meta's responses run with them because they are contested.
Meta spokesman Andy Stone said the documents "present a selective view that distorts Meta's approach to fraud and scams", and that the internal 10.1% estimate was "rough and overly-inclusive" because it captured many legitimate advertisements. He declined to provide a corrected figure.
Two further passages matter more than the headline number, and neither is reported as disputed.
The first is the threshold. Reuters reported that Meta "only bans advertisers if its automated systems predict the marketers are at least 95% certain to be committing fraud", and that where the company is less certain but still believes the advertiser is a likely scammer, "Meta charges higher ad rates as a penalty".
The second is what happens to you afterwards. Reuters reported that users who click on scam adverts are "likely to see more of them", because the same personalisation system that serves any other interest serves this one. That is the advertising layer independently reproducing something we have written about before: once you respond, you become a better prospect. It is the sucker list, rebuilt automatically and without anyone having to sell it.
Google, for its part, has been moving in a different direction: TechCrunch reported in April 2026 that it blocked more adverts while banning fewer advertisers, as AI reshapes enforcement. Whether that helps or hurts is genuinely arguable. What it does mean is that the measure Ofcom leans on most heavily, banning known scammers, is being deprioritised by the largest advertising business in the world.
The bank that moved the money
This hand never saw the advert. It has no relationship with the network, the cloaker or the platform. It processed a payment you instructed it to make.
It is also the only hand in the entire chain that can be made to pay you back. Since October 2024, UK banks have been required to reimburse victims of authorised push payment fraud, split evenly between the sending and receiving firm, subject to a cap and to exclusions that include international and cryptocurrency payments.
That is a real duty, and it is close to unique. Our Scam Refund Index records reimbursement rights across 27 countries. One of the 27 legally mandates reimbursement for authorised fraud. Everywhere else the law refunds the hack and not the con.
You
You are the only party in the chain who did not choose to be in it, and the only one carrying the loss by default. Everything the previous five hands did not absorb ends here.
What the chain adds up to
Read the six verdicts in order and the shape is unmistakable. Responsibility thins as you move toward the money and disappears entirely at the point where the advert was actually sold. The one enforceable duty sits with the party that had no involvement in the advertising at all.
This is not an accident of drafting. Hand 3 exists to produce exactly this result, and hand 2 is structured to make the question of who unanswerable before the question of whether can be reached.
Why a fine is not the same as a remedy
Ofcom's draft code would create duties enforced by penalties. Penalties are paid to the regulator. Nothing in the roughly forty measures creates a path from a person who lost money to a person who gets it back.
It is fair to say a large enough penalty changes behaviour even if it never reaches a victim. Reuters reported what Meta's own documents say about that calculation, and it is the most useful passage in the whole investigation:
Reuters also reported that the team vetting questionable advertisers was not permitted to take actions costing more than 0.15% of total revenue, about $135 million against the $90 billion Meta generated in the first half of 2025. Andy Stone said that figure came from a revenue projection document and was not a hard limit, and disputed the documents' assertion that the company acts only when forced: "That isn't the company's policy."
Take only the two figures Meta is not reported as disputing. Anticipated penalties of up to $1 billion, against $7 billion a year from the higher-legal-risk category alone. That is roughly seven to one in favour of continuing, calculated internally, before any regulator arrived.
A former Meta safety investigator, fraud examiner Sandeep Abraham, put the comparison to Reuters more sharply than we would have dared to:
"If regulators wouldn't tolerate banks profiting from fraud, they shouldn't tolerate it in tech."Sandeep Abraham, fraud examiner and former Meta safety investigator, to Reuters
That is precisely the asymmetry the chain produces. Hand 5 was made to pay. Hand 4 was not.
Five countries, one partial route
The UK is not unusual here, and the comparison is worth having because it is often assumed that somewhere has solved this.
One partial route, in one country, arriving in September 2026. That is the current state of the entire English-speaking world on this question.
The most consequential movement is not coming from regulators at all. It is coming from courts testing Section 230 in the United States: the Ninth Circuit has allowed contract claims to proceed on the basis that immunity does not shield a platform from breaking its own terms of service, and a separate ruling has found no Section 230 immunity for advertisements produced by a platform's own generative-AI tools, on the reasoning that a platform which made the advert may be its author rather than its host. If that reasoning holds, it reaches hand 4 in a way no advertising code currently does.
A note on what we could not find
Before writing this we sized the question as a search term, the way we size any topic, using Google's Keyword Planner across five English-speaking markets: the United Kingdom, the United States, Australia, Canada and Ireland.
Every phrasing of the responsibility question returned no data in all five. Who is responsible for scam ads. Is Facebook responsible for scam ads. Can you sue Facebook for scam ads. Scam ad compensation. I lost money to a Facebook ad. Nothing, anywhere.
That is a real absence rather than a limit of the tool, because a deliberately small control term returned a genuine figure in every one of the five markets, so the instrument was capable of reporting at that level and did not. Keyword Planner reports ranges rather than exact counts on an account that is not spending, and no data means absent from the database rather than a measured zero. With those limits stated, the finding stands.
We are including this because we think it is the honest way to publish a piece with no audience waiting for it. This post will not be found by search, and it was written anyway.
The one advert you can always dismiss
There is a narrow exception to all of this, and it is worth knowing because it is the only part of the problem an individual can settle instantly.
Some of the people used in these adverts have published a statement about it. Martin Lewis, the most impersonated name in UK scam advertising, has put his in the flattest possible terms:
"And if it's an ad with me in, it's always a scam, as I don't do adverts."Martin Lewis, MoneySavingExpert
MoneySavingExpert's own analysis of Action Fraud reports found he was named in 1,151 reported scams, 32.4% of all celebrity mentions, across 3,551 reports naming 165 public figures in 2022 and 2023, ahead of Taylor Swift on 21.7% and Elon Musk on 13.9%. MSE notes those numbers are "likely to just be a drop in the ocean", because most scams are never reported.
A statement like that removes the need to assess anything. There is no genuine version to distinguish from a fake one, so the presence of his face in an advert is itself the verdict. We have added him to our Impersonation Index, which records what the most impersonated organisations publish about how they really contact you. He is the only individual in it, because almost no public figure publishes such a statement, which is exactly why the impersonation works.
If you have already paid
The chain above explains why the advice below is ordered the way it is. Go where the duty is, first.
What would actually change the answer
We are a fraud-education site rather than a policy shop, so this is offered narrowly and as opinion, clearly labelled.
Every measure in the draft code aims at the quality of the advert. None of them changes where the loss lands. The single structural change that would alter the chain is the one the payments industry already went through: attach a duty to the party that was paid, owed to the person who lost the money, and let the commercial incentive follow.
That is an argument, not a proof, and its limits are worth stating plainly. Payments and advertising are different markets. The UK reimbursement rules carry a cap and exclude international and cryptocurrency payments. Outcomes vary between firms. But it is the only intervention in recent memory that moved a loss off the victim and onto a party with the means to prevent it, and the results were measured rather than assumed. What is being consulted on now does not attempt that.
Ofcom's consultation on the draft Fraudulent Advertising Codes of Practice is open until 2 October 2026, and it takes responses from the public. If you have lost money to an advert, that is one of the few places the experience currently counts for anything.
Keep reading
Questions people ask
Who is legally responsible if I lose money to a scam advert?
In most countries, nobody in the advertising chain. The account that bought the ad is often a hijacked or purchased business account. The affiliate network that placed it is a web of separate companies. The cloaking layer exists specifically so that everyone upstream can truthfully say they never saw the advert you saw. The platform that was paid to show it has, in the UK, no legal liability for scam adverts today, and Ofcom's proposed code would make it answerable to the regulator rather than to you. The only party in the chain that can currently owe you money is your bank, and only in the UK, only for authorised push payment fraud, and with exclusions. That is the whole answer, and it is why the question is so rarely asked.
Will Ofcom's new scam advert rules get my money back?
No, and they are not designed to. Ofcom published its draft Fraudulent Advertising Codes of Practice on 10 July 2026 under the Online Safety Act, with consultation open until 2 October 2026 and a final statement expected by mid-2027 at the latest. The roughly forty proposed measures create duties owed to the regulator, enforced by penalties paid to the regulator. There is no route in them from a victim to a refund. A fine is not compensation, and no measure in the draft changes that.
Is Facebook or Google liable for scam ads they were paid to run?
Not currently, in the UK. Ofcom's own consultation exists because that duty does not yet exist. In the United States, Section 230 has historically ended most such claims, though it is being tested: the Ninth Circuit has allowed contract claims based on a platform breaking its own terms of service, and one ruling has found no Section 230 immunity for advertisements produced by a platform's own generative-AI tools, on the reasoning that the platform may then be the author rather than the host. In the EU, the Digital Services Act imposes systemic-risk and ad-transparency duties that have already been enforced, but enforcement means fines to regulators, not payments to victims.
Why does a verified advertiser check not stop scam ads?
Because the entity that passes the check is frequently not the operator. The Tech Transparency Project documented more than 110 Facebook groups with over 531,000 members openly trading verified advertising accounts. Malwarebytes documented a campaign that stole legitimate advertisers' own Google Ads accounts and ran scam ads from them, with the hacked business paying for the spend. A verification check applied to that account returns a real, verified, entirely genuine company. It is simply not the company running the scam.
What should I actually do if I paid money after clicking an advert?
Move on the payment first, because that is the only part of the chain with a clock and the only part where anyone may owe you anything. Contact your bank or card provider immediately and say the words authorised push payment fraud if you transferred money, or ask for a chargeback if you paid by card. In the UK you can call 159 to reach your bank on a number you can trust. Then report the crime, and report the advert to the platform that showed it. Reporting the advert does not recover money, but it is the only signal that reaches the party who was paid.
Does reporting a scam advert to the platform do anything?
It is worth doing and it is not a remedy. Reporting removes a single creative, and creatives are the cheapest, most disposable part of the operation. It does not reach the network, the cloaking layer or the account market underneath. Treat it as maintenance rather than justice, and never let it substitute for contacting your bank, which is the only step with money attached to it.
Reuters figures are quoted from Jeff Horwitz's investigation of 6 November 2025 and run with Meta's stated responses. Ofcom's measures, dates and consultation deadline are from its own consultation pages. Advertising-supply-chain detail is attributed to Infoblox, Menlo Security, Dark Reading, the Tech Transparency Project and Malwarebytes. Refund comparisons are from our own Scam Refund Index. Where a figure is disputed we say so beside it. If you find an error, tell us at press@tuteladigitalis.com and we will publish the correction.