FTC Tests Platform Duties for Scam Ads

FTC impersonation rulemaking: what happened

FTC impersonation rulemaking moved to a new stage on 24 September when the US Federal Trade Commission voted 2-0 to seek public comment on online platforms’ role in promoting government and business impersonation scam ads. The agency is considering an update to its existing impersonation rule, a separate rule or non-regulatory action; it has not adopted a final obligation.

The primary record is the FTC’s Advance Notice of Proposed Rulemaking. The American Bankers Association independently confirmed the action and welcomed a broader approach to digital advertising fraud. Because this is a material regulatory story with only one timely independent report, this package uses the documented primary-plus-one central exception: every procedural and numeric claim is directly auditable in the agency notice and narrowly attributed.

The FTC says consumers filed more than one million imposter-scam reports in 2025 and reported nearly $3.5 billion in losses. It also says almost 30% of consumers who reported losing money to scammers were first contacted through social media, representing $2.1 billion in reported losses. These are complaint-system figures, not a complete estimate of all fraud.

Why the inquiry targets ad optimization

The existing rule focuses on impersonating governments and businesses. The new inquiry asks whether platforms’ advertising tools may further those scams by selecting audiences, optimizing delivery or continuing to distribute deceptive ads. That shifts attention from the person who creates a fake ad to the system that helps it find likely victims.

The FTC is requesting information about the financial incentives behind ad-optimization services, how platforms currently prevent misuse and whether particular practices are unfair or deceptive. It specifically asks about advertiser vetting, monitoring, investigation, removal of confirmed scam ads and disciplinary action against advertisers.

The self-contained consequence is clear: FTC impersonation rulemaking could make scam-ad prevention an upstream platform-control obligation rather than leaving enforcement focused mainly on individual fraudsters after victims have already been reached.

That would be a significant design change. A platform might need stronger identity checks before an advertiser spends money, risk scoring before an ad enters an auction, continuous monitoring after approval and evidence trails showing why suspicious creative was allowed, restricted or removed.

What the FTC has not decided

An Advance Notice of Proposed Rulemaking is an exploratory step. It does not establish that any named platform broke the law, and it does not specify a final test for liability. The commission is gathering evidence about prevalence, incentives, technical controls and possible measures before deciding whether to propose binding text.

The comment deadline will fall 60 days after publication in the Federal Register, according to the FTC. Submitted comments will be public on Regulations.gov. Platforms, banks, consumer groups, ad-tech vendors and researchers can therefore shape the record with data about false positives, evasion, costs and effective safeguards.

The difference between an ad host and an optimizing intermediary will be contested. Simply carrying content is not the same as choosing a target audience or recommending budget changes. The FTC’s questions suggest it is interested in where automation changes reach, conversion probability and the platform’s knowledge of suspicious patterns.

Any final rule would also need workable standards. Requiring removal of a confirmed scam is easier to state than defining how quickly confirmation must occur, what evidence is sufficient, how appeals work and who bears the cost when a legitimate small business is blocked by mistake.

The control stack platforms may need

A credible compliance stack would start with advertiser identity and payment checks, but identity alone is not enough. Fraudsters can use stolen credentials, compromised business accounts or short-lived entities. Platforms need relationship checks between the advertiser, the claimed brand, the destination domain and the financial account receiving money.

Creative review must examine more than text. Impersonation can use copied logos, synthetic voices, altered video, lookalike domains and misleading support numbers. Models can help rank risk, but high-impact decisions need deterministic signals, human escalation and auditable reasons. Otherwise, the platform merely adds a second opaque optimization system to the first.

Post-launch monitoring is equally important. Scam campaigns can begin with benign creative, switch landing pages after approval or target small cohorts to avoid detection. Controls should compare ad changes, redirect chains, complaint velocity and payment behavior across related accounts without assuming that every anomaly proves wrongdoing.

Remediation needs a victim-facing path. When a campaign is confirmed, platforms should preserve evidence, stop related ads, warn affected users where feasible and share indicators with banks, registrars and law enforcement under appropriate legal controls. Removing one advertisement without tracing the infrastructure invites rapid re-entry.

Why banks and Indian firms should care

The American Bankers Association said it supports a whole-of-ecosystem approach because fraudsters impersonate trusted financial institutions across ads and social platforms. Banks often see the payment or account-takeover consequence but do not control the ad auction that initiated contact. A platform duty could move part of prevention earlier in the chain.

Indian banks, consumer brands and government bodies face similar impersonation patterns even though an FTC rule would apply in the United States. They should monitor whether large platforms standardize advertiser verification, brand-authority checks and complaint APIs globally. Controls built for one major market often influence the default product elsewhere, although that outcome is not guaranteed.

Brands can prepare by documenting official domains, support numbers, social accounts and authorized advertising agencies. That reference set makes it easier to challenge fraudulent campaigns and gives platforms machine-readable evidence for allow lists. Security teams should connect ad impersonation reports with phishing, domain-abuse and payment-fraud workflows instead of treating each as a separate queue.

Procurement teams should ask ad platforms how quickly they suspend a confirmed impersonator, whether repeated offenders are linked across accounts, what evidence is retained and whether the brand receives campaign-level intelligence. A promise to use AI for safety is not a control specification.

What happens next

The immediate next step is publication of the notice and a 60-day comment period. The commission can then close the inquiry, issue guidance, propose a rule or pursue another route. If it proposes binding requirements, a further notice-and-comment process would normally define the actual text and compliance analysis.

Useful evidence will distinguish losses linked to paid ads from fraud that begins through organic posts, direct messages, email or phone calls. It should also separate platform actions that genuinely reduce harm from measures that mainly create paperwork. The FTC’s reported-loss figures show scale, but policy design depends on causal detail.

For platforms, the safest response is not to wait for final language. Mapping the ad lifecycle now—onboarding, creative approval, targeting, payment, complaints and enforcement—will reveal where evidence is missing. For banks and brands, building rapid reporting channels can improve both today’s response and the record regulators will use.

FTC impersonation rulemaking is therefore a test of accountability at the optimization layer. The consultation may or may not produce a new rule, but it makes the core policy question explicit: when a platform’s systems amplify a deceptive ad, what prevention duties should attach to the infrastructure that made the scam scalable?

Facts at a glance

Item	Verified detail	Source
Disclosure date	24 September 2026	FTC
Procedural stage	Advance Notice of Proposed Rulemaking	FTC
Commission vote	2-0	FTC
2025 imposter reports	More than 1 million	FTC
Reported 2025 losses	Nearly $3.5 billion	FTC

Related Lapaas Voice coverage: Microsoft EvilTokens takedown shifts identity triage, Google location-data fine tests consent design, Discord age assurance uses a tiered check.

FAQs

What is the FTC impersonation rulemaking?

It is an early-stage inquiry asking whether the FTC should update its existing impersonation rule, create a separate rule or use non-regulatory measures to address platforms that may amplify scam ads.

Has the FTC already imposed new platform duties?

No. The agency issued an Advance Notice of Proposed Rulemaking and is seeking comments. No final duty, liability standard or compliance date has been adopted.

What measures is the FTC considering?

The notice asks about advertiser vetting, ad monitoring, investigation of suspected impersonation ads, removal of confirmed scam ads and discipline for offending advertisers.

Why does this matter outside the United States?

Global ad platforms often reuse targeting, verification and risk systems across markets. US rules could influence product controls and provide a benchmark for regulators and financial institutions elsewhere.