Everyone touched it. Who pays you back?
A scam advert is not one decision by one company. It passes through six sets of hands between the person who wrote it and the moment your money leaves. Ofcom has just proposed roughly forty rules aimed at that chain, and the consultation is open until 2 October 2026.
So we walked the chain and asked the same question at every stop. Not who is to blame. Who owes the victim anything?
The answer is the point of this piece, and it is not the answer the debate assumes.
By Peter · Published 2 August 2026 · Updated 6 October 2026
A scam advert passes through several businesses, but a platform taking payment for the ad does not automatically make it your refund provider. Liability and practical recovery are different questions. Start with your payment provider, preserve the ad evidence, and use the relevant complaint routes. Ofcom's draft advertising codes and the FTC's September 2026 rulemaking notice concern platform conduct; neither announcement itself promises you compensation.
Read the image explanation
Illustrative example: Scam advert evidence $450.00 Payment to advertised seller 01-ad-and-advertiser.png 02-landing-page.pdf 03-payment-receipt.pdf 04-platform-report.txt
- The advert. Keep the creative, advertiser identity and where you saw it.
- The destination. Preserve the landing page address and offer before it changes.
- The payment. Separate your payment dispute from the complaint about the advertisement.
September update: the FTC is examining the machinery behind impersonation ads
On 24 September 2026, the FTC announced an advance notice of proposed rulemaking about platforms' ad-optimization tools and impersonation scams. It is asking whether to amend its existing rule, develop a separate rule or take other action. Advertiser checks, monitoring and removal are among the measures under discussion.
This reaches the central question of this article: what responsibility should attach to the businesses distributing the advert? It is a consultation step, not an enacted platform-refund rule. Do not wait for its outcome before pursuing a payment dispute.
The chain, one hand at a time
Each stop below carries the same verdict line, and the verdict is deliberately narrow. Not is this party behaving well. Not could they do more. Only this: what practical route might get your loss considered? These are not findings that any business is immune from a legal claim.
The account that bought the advert
This is the hand Ofcom proposes to verify. The draft code would require platforms to check advertiser identities, and for banking and investment advertisers, to confirm they are legally authorised.
The difficulty is that the account which passes that check is frequently not the operator. The Tech Transparency Project documented more than 110 Facebook groups with over 531,000 members openly trading verified advertising accounts. Malwarebytes documented a campaign in January 2025 that phished legitimate advertisers out of their own Google Ads accounts and then ran further scam adverts from them, with the hacked business paying for the spend until it noticed.
Run an identity check against that account and it comes back clean, because it belongs to a real company. It is just not the company running the scam.
The network that placed it
Between the operator and the platform sits an advertising network, and the largest of them are not small. Infoblox, Menlo Security and Dark Reading have described VexTrio as possibly the largest malicious traffic broker on the web. It has been running since 2015, and it controls both the publishing and the advertising sides through a web of intertwined companies: Teknology, Los Pollos, Taco Loco and Adtrafico.
That structure is not incidental. It is the point. Four names, four sets of paperwork, four sets of counterparties, and no single one of them is the thing you would name in a claim.
The layer that decided what you saw
Cloaking software shows one page to a reviewer and a different page to a member of the public. IMKLO, a cloaker built by IM GROUP and used by VexTrio, is one named example among several, and the same operation has produced software specifically to disguise malicious adverts from security researchers. Smartlinks go further and cloak the final landing page itself, precisely to defeat analysis.
It is worth being exact about what this buys, because it is usually described as deceiving the victim. That is the smaller half of it.
The platform that was paid to show it
This is where Ofcom's roughly forty measures land, and it is the only hand in the chain that took money from the operator and delivered the advert to you personally.
In November 2025 Reuters published an investigation by Jeff Horwitz based on internal Meta documents spanning 2021 to 2025. The figures below are Reuters' wording, and Meta's responses run with them because they are contested.
Meta spokesman Andy Stone said the documents "present a selective view that distorts Meta's approach to fraud and scams", and that the internal 10.1% estimate was "rough and overly-inclusive" because it captured many legitimate advertisements. He declined to provide a corrected figure.
Two further passages matter more than the headline number, and neither is reported as disputed.
The first is the threshold. Reuters reported that Meta "only bans advertisers if its automated systems predict the marketers are at least 95% certain to be committing fraud", and that where the company is less certain but still believes the advertiser is a likely scammer, "Meta charges higher ad rates as a penalty".
The second is what happens to you afterwards. Reuters reported that users who click on scam adverts are "likely to see more of them", because the same personalisation system that serves any other interest serves this one. That is the advertising layer independently reproducing something we have written about before: once you respond, you become a better prospect. It is the sucker list, rebuilt automatically and without anyone having to sell it.
Google, for its part, has been moving in a different direction: TechCrunch reported in April 2026 that it blocked more adverts while banning fewer advertisers, as AI reshapes enforcement. Whether that helps or hurts is genuinely arguable. What it does mean is that the measure Ofcom leans on most heavily, banning known scammers, is being deprioritised by the largest advertising business in the world.
The bank that moved the money
This hand never saw the advert. It has no relationship with the network, the cloaker or the platform. It processed a payment you instructed it to make.
A payment complaint can offer a more direct route than identifying every advertising intermediary. The FCA distinguishes eligible bank-transfer reimbursement from card remedies, including chargeback and, for qualifying credit-card purchases, Section 75.
UK APP reimbursement has eligibility conditions. The PSR policy distinguishes payments to another person from transfers to an account you control. A crypto-related story alone does not determine whether an earlier bank payment qualifies. See the UK scam-refund rules and exclusions.
You
You are the only party in the chain who did not choose to be in it, and the only one carrying the loss by default. Everything the previous five hands did not absorb ends here.
What the chain adds up to
The chain makes evidence and responsibility harder to trace. That is different from proving that nobody is liable. A duty to prevent scams, a regulator's enforcement power and your route to compensation are three separate questions. A useful complaint identifies the business, its conduct and the remedy you are asking for.
Why a fine is not the same as a remedy
Ofcom's draft code would create duties enforced by penalties. Penalties are paid to the regulator. Nothing in the roughly forty measures creates a path from a person who lost money to a person who gets it back.
It is fair to say a large enough penalty changes behaviour even if it never reaches a victim. Reuters reported what Meta's own documents say about that calculation, and it is the most useful passage in the whole investigation:
Reuters also reported that the team vetting questionable advertisers was not permitted to take actions costing more than 0.15% of total revenue, about $135 million against the $90 billion Meta generated in the first half of 2025. Andy Stone said that figure came from a revenue projection document and was not a hard limit, and disputed the documents' assertion that the company acts only when forced: "That isn't the company's policy."
Take only the two figures Meta is not reported as disputing. Anticipated penalties of up to $1 billion, against $7 billion a year from the higher-legal-risk category alone. That is roughly seven to one in favour of continuing, calculated internally, before any regulator arrived.
A former Meta safety investigator, fraud examiner Sandeep Abraham, put the comparison to Reuters more sharply than we would have dared to:
"If regulators wouldn't tolerate banks profiting from fraud, they shouldn't tolerate it in tech."Sandeep Abraham, fraud examiner and former Meta safety investigator, to Reuters
That is the distinction worth keeping: prevention duties and regulatory fines do not automatically put money back into a victim's account.
Three developments, three different stages
Existing complaints options still matter. The Australian reporting guide separates current reporting and bank-complaint channels from the framework's future start date.
The one advert you can always dismiss
There is a narrow exception to all of this, and it is worth knowing because it is the only part of the problem an individual can settle instantly.
Some of the people used in these adverts have published a statement about it. Martin Lewis, the most impersonated name in UK scam advertising, has put his in the flattest possible terms:
"And if it's an ad with me in, it's always a scam, as I don't do adverts."Martin Lewis, MoneySavingExpert
MoneySavingExpert's own analysis of Action Fraud reports found he was named in 1,151 reported scams, 32.4% of all celebrity mentions, across 3,551 reports naming 165 public figures in 2022 and 2023, ahead of Taylor Swift on 21.7% and Elon Musk on 13.9%. MSE notes those numbers are "likely to just be a drop in the ocean", because most scams are never reported.
A statement like that removes the need to assess anything. There is no genuine version to distinguish from a fake one, so the presence of his face in an advert is itself the verdict. We have added him to our Impersonation Index, which records what the most impersonated organisations publish about how they really contact you. He is the only individual in it, because almost no public figure publishes such a statement, which is exactly why the impersonation works.
If you have already paid
The chain above explains why the advice below is ordered the way it is. Go where the duty is, first.
What would actually change the answer
We are a fraud-education site rather than a policy shop, so this is offered narrowly and as opinion, clearly labelled.
Every measure in the draft code aims at the quality of the advert. None of them changes where the loss lands. The single structural change that would alter the chain is the one the payments industry already went through: attach a duty to the party that was paid, owed to the person who lost the money, and let the commercial incentive follow.
That is an argument, not a proof, and its limits are worth stating plainly. Payments and advertising are different markets. The UK reimbursement rules carry a cap and eligibility conditions; international transfers and payments to accounts you control require particular care. Outcomes vary between firms. It provides a concrete example of a defined reimbursement obligation. What is being consulted on now does not attempt that.
Ofcom's consultation on the draft Fraudulent Advertising Codes of Practice is open until 2 October 2026, and it takes responses from the public. If you have lost money to an advert, that is one of the few places the experience currently counts for anything.
Keep reading
Questions people ask
Who is legally responsible if I lose money to a scam advert?
Liability depends on the country, the payment and what each business did. A scammer can be liable even when recovering money from them is difficult. Do not assume every intermediary is immune, or that an advertising rule automatically refunds you. Contact your payment provider promptly: eligible UK APP payments have a reimbursement route, and card disputes follow different rules. Preserve the advert and payment evidence for any complaint.
Will Ofcom's new scam advert rules get my money back?
Ofcom's draft Fraudulent Advertising Codes concern platform systems for preventing and removing scam advertising. They are not an automatic victim-refund scheme. The consultation closes on 2 October 2026. A regulatory penalty and compensation for your loss are different outcomes; continue your bank or card complaint while reporting the advert.
Is Facebook or Google liable for scam ads they were paid to run?
There is no universal answer. It depends on the jurisdiction, the platform's conduct and the legal basis of a claim. Ofcom's draft codes do not themselves provide an automatic refund. In September 2026 the FTC began seeking views on platforms' role in amplifying impersonation ads; that is an advance rulemaking notice, not a new compensation entitlement.
Why does a verified advertiser check not stop scam ads?
Because the entity that passes the check is frequently not the operator. The Tech Transparency Project documented more than 110 Facebook groups with over 531,000 members openly trading verified advertising accounts. Malwarebytes documented a campaign that stole legitimate advertisers' own Google Ads accounts and ran scam ads from them, with the hacked business paying for the spend. A verification check applied to that account returns a real, verified, entirely genuine company. It is simply not the company running the scam.
What should I actually do if I paid money after clicking an advert?
Contact your bank or card provider immediately, explain exactly who initiated the payment, and ask about recall, reimbursement or a card dispute. Do not describe a payment you authorised as an account hack. Save the advert, advertiser details, destination URL, messages and receipts. Then report the advert and the crime through the appropriate channels. A report alone does not guarantee removal or a refund.
Does reporting a scam advert to the platform do anything?
Reporting can help a platform investigate and remove an advert, but removal is not guaranteed and does not reimburse you. Save evidence before reporting, including the ad's URL or identifier and when you saw it. Keep the report acknowledgement for your complaint. Reporting the advert should happen alongside, not instead of, contacting your payment provider.
27 September correction: the original version said only banks could owe compensation and overstated the meaning of missing keyword data. Those claims and the matching diagram have been removed. Australia's membership and complaint-start dates are now distinguished. The FTC update is sourced above.
Reuters figures are quoted from Jeff Horwitz's investigation of 6 November 2025 and run with Meta's stated responses. Ofcom's measures, dates and consultation deadline are from its own consultation pages. Advertising-supply-chain detail is attributed to Infoblox, Menlo Security, Dark Reading, the Tech Transparency Project and Malwarebytes. Refund comparisons are from our own Scam Refund Index. Where a figure is disputed we say so beside it. If you find an error, tell us at press@tuteladigitalis.com and we will publish the correction.