Fake storefronts now run ads in the same auctions as legitimate holiday advertising. The FTC is asking whether the platforms that profit from both should be held accountable.
A shopper scrolling Instagram during her lunch break sees a sponsored post from what appears to be a well-known retailer: 60 percent off, professional photography, a checkout page that loads in the brand’s colors. The site is a clone. The ad that brought her there was placed through the same advertising tools, targeting the same audience, in the same auction as the real retailer’s holiday campaign.
The ad auction does not ask whether the advertiser is real. A legitimate retailer and the fraudulent storefront impersonating it enter the same system, use the same targeting tools, benefit from the same optimization algorithms, and pay the same platform for placement. From the auction’s perspective, they are indistinguishable. From the shopper’s perspective, they increasingly are too.
The FTC reported that losses to scams originating on social media reached $2.1 billion in 2025, and that shopping scams were the most reported type: more than 40 percent of people who lost money said they had ordered something from a social media ad, with some of those ads leading to sites impersonating well-known brands.
On September 24, the FTC signaled that it has seen enough. The commission issued an Advance Notice of Proposed Rulemaking asking whether its existing Impersonation Rule should be updated to address the ad-optimization tools offered by social media platforms, search engines, and digital marketplaces, and whether those tools constitute unfair or deceptive practices when they help scammers impersonate legitimate businesses. The commission’s language was direct: platforms “internalize the revenue but externalize the risk.”
Why the auction is structurally blind
The tools the FTC is examining are not obscure features. They are the core of how modern digital advertising works: ad copy and image generation, product listing creation, audience targeting using consumer data, and performance enhancements that improve engagement. Every legitimate advertiser depends on them. The problem, as Commissioner Mufarrige put it, is that impersonation scams “are no longer the work of isolated con artists; they are sophisticated, highly engineered operations powered by the same advertising and targeting tools that platforms sell to legitimate businesses.”
The cost of entry is negligible. The FBI traced a single phishing kit sold for $88 a week that came with 290-plus templates mimicking banks, telecoms, government agencies, and retailers, linked to approximately 3.87 million stolen cards and $1.9 billion in losses since July 2023. At that price point, running paid ads to drive traffic to a fake storefront is a trivial addition, and the platform’s verification systems are not designed to catch it at the point of ad creation.
How fake ads cost retail brands during holiday shopping
For retailers approaching the holiday season, the ad auction problem creates a cost they rarely account for. When a fake storefront bids on a retailer’s branded keywords during Black Friday week, the retailer pays more per click competing against a fraudulent competitor while the customers who click the wrong ad associate the experience with the real brand. The advertising budget and the brand trust erode simultaneously.
Adobe forecasts $275.1 billion in U.S. online holiday sales from November through December, with a record 63 percent of Cyber Week spend expected on mobile, where smaller screens, abbreviated URLs, and faster browsing make the distinction between a legitimate ad and a fraudulent one hardest to draw. Allure’s detection data shows retail brands are already targeted at 2.5 times the cross-industry average, with impersonation running year-round rather than spiking seasonally.
The FTC’s rulemaking will take time. Potential requirements outlined in the notice include verifying advertisers’ identities, reviewing ads before publication, monitoring for impersonation, and suspending optimization services for offending advertisers.
The holiday ad auctions will not wait for the outcome. The brands being impersonated in those auctions need to monitor for fraudulent ads running against their keywords, report impersonation through platform abuse channels, and remove the fake storefronts those ads point to, because the regulatory protection the FTC is contemplating does not yet exist.
The Bottom Line
The same ad auction, the same targeting tools, and the same optimization algorithms serve both legitimate retailers and the scammers impersonating them. The FTC is now asking whether platforms bear responsibility for an arrangement that generates revenue regardless of who the advertiser is. The answer will take months or years to formalize. This year’s holiday season, and the continuous stream of sales events that will follow it into spring, summer, and next fall, does not have that luxury. And the fake storefronts are counting on it.
Key Takeaways
On September 24, 2026, the FTC issued an Advance Notice of Proposed Rulemaking asking whether to update its Impersonation Rule to hold ad platforms accountable for optimization tools that help scammers impersonate businesses. The commission is seeking comment on whether selling ad targeting, creative generation, and audience optimization tools without adequate advertiser verification constitutes an unfair or deceptive practice.
The FTC reports that losses to scams originating on social media reached $2.1 billion in 2025, approximately eight times the 2020 figure. Shopping scams were the most reported type, with more than 40 percent of victims saying they ordered something from a social media ad that led to a fraudulent or impersonation site.
Scammers enter the same ad auctions as legitimate retailers, using the same targeting tools, creative optimization, and audience data to reach shoppers searching for deals. The FBI linked one phishing kit, sold for $88 per week with 290-plus retail and bank templates, to 3.87 million stolen cards and $1.9 billion in losses since July 2023. At that price point, building a fake storefront and running paid ads to drive traffic to it is a trivial investment. The FTC reports that more than 40 percent of social media fraud victims ordered something from an ad that led to a fraudulent or impersonation site.
Ad auctions optimize for engagement and conversion without evaluating advertiser legitimacy. A scammer using a fake storefront can bid on the same holiday keywords, target the same demographics, and benefit from the same optimization tools as the brand being impersonated. The platform earns revenue from both. The FTC’s September 2026 rulemaking asks whether this structural neutrality should be treated as facilitation, noting that platforms “internalize the revenue but externalize the risk.”
Monitor for fraudulent ads running against branded keywords on social media and search platforms. Report impersonation through platform abuse channels. Remove the fake storefronts those ads point to through takedown processes. Allure’s data shows retail brands are targeted at 2.5 times the cross-industry average, and the impersonation infrastructure runs year-round rather than only during holiday peaks.
