Your name in somebody else's advert
Crypto scam adverts with your brand on them, examined by Ilia Zavialov: how they are made and how to get them down
A customer forwards a screenshot. Your logo, your company name, a photograph of your managing director, and an invitation to an investment program nobody in the building has heard of. The economics behind that screenshot changed recently and not in your favor. Reported losses on complaints flagged as involving artificial intelligence reached 893,346,472 dollars across 22,364 complaints in 2025, impersonation schemes grew by more than 1400 percent in a year with the severity of a single case up more than 600 percent, and analysis shows an operation using these tools takes an average of 3.2 million dollars against 719,000 for one that does not. This is the order to act in, and the order matters more than the speed.
English version for the United States.
01
Why this became cheap
The cost of producing a convincing advert collapsed. A logo, a face, a voice, a set of testimonials and a landing page are now a short afternoon of work rather than a project with a budget.
The measurements show what that did to the economics. Schemes built on ready made phishing kits turn out 688 times more effective in money terms, and operations that buy social media accounts in bulk are 238 times more effective.
Daily output rose with it. The median daily revenue of an operation using these tools is 4,838 dollars against 518 for one without, and it pushes 35.1 transfers a day against 3.89.
The practical consequence for a company is about volume. This is not one advert appearing once. It is a production line that can run dozens of variants against different audiences, and taking down one of them changes very little on its own.
None of this requires anybody to break into anything of yours. Every ingredient is already public: the logo on your site, the executive photograph from a conference, the registration number in a state register. The material is assembled from what you publish on purpose, which is why hardening your own systems does nothing to prevent it.
02
Why the company finds out last
The advert is almost never shown to you. Targeting excludes your own staff, your city and frequently your country, because the operation gains nothing from being seen by the people best placed to report it.
The audience selected is the one most likely to believe the association and least likely to check it. That is usually somebody who has heard of your company and has no relationship with it.
So the first report arrives from outside. A customer, a partner, somebody who lost money and found your real number, or a journalist. By then the campaign has usually been running for a while.
This is why a standing search matters more than a fast reaction. A weekly search for the company name alongside words like investment, platform, returns and giveaway costs nothing and finds things months before a customer does.
03
What is actually being copied
The name and the logo are the least of it. What carries the advert is the borrowed credibility around them: a real executive name, a real photograph from a conference, a real registration number and a real address taken from your own website.
The registration number is the detail that defeats most checking. Somebody who looks it up finds a genuine company, correctly registered, and reads that as confirmation. The number is real and the association with the advert is invented.
Testimonials, review pages and news style articles are produced in the same session. The regulator in Australia removed more than 19,400 scam pages in the 2026 financial year against 6,915 the year before, a rise of 182 percent, which is a rough measure of how many such pages exist to be found.
The breakdown of what was removed is instructive. It included 7,051 fake investment platforms, up 151 percent, 5,476 phishing links, up 279 percent, and 3,106 crypto investment schemes, up 30 percent.
04
The first hour: record before you report
Capture everything before it disappears. Full page screenshots with a visible clock, the advertisement identifier if the platform shows one, the destination address, the landing page saved as a file rather than a link, and the wallet addresses if any are shown.
Record the redirection chain. Adverts of this kind rarely point straight at the destination, and the intermediate hops are what platform teams and registrars actually act on.
Note which audience it was shown to, if the person reporting it can tell you. Country, language and platform determine which regulator is the right recipient later.
Do this before submitting anything. A successful takedown removes the evidence along with the advert, and a complaint to a second recipient a week later has nothing attached to it.
Keep the captures somewhere that is not a chat thread. A dated folder with one subfolder per campaign, holding the screenshots, the saved pages and a plain text note of what was submitted where, is what makes the second and third complaints cheap to file.
05
The order to complain in
Start with the advertising platform, because it is the only party that can stop the campaign inside hours. Use the brand or intellectual property channel rather than the general abuse form, since the two queues move at very different speeds.
Then the hosting provider and the domain registrar for the landing page. Both respond to a complaint that identifies the specific page and names the impersonation plainly, and both are slower than the advertising platform.
Then the financial regulator in the country where the advert was shown. This is the slowest route and the one that produces structural results, because regulators maintain removal programs at scale rather than acting page by page.
Keep a register of every submission with the date, the recipient, the reference number and the outcome. Repeat campaigns are normal, and a second complaint that cites the first one is treated very differently from one that starts over.
06
What to tell customers, and when
Publish a short notice on your own site early, and keep it permanently. It gives search engines something authoritative to rank for your name alongside the word scam, and it gives a doubting customer somewhere to land.
State plainly which channels you actually use and which you never use. A sentence saying the company never offers investment programs and never contacts people about returns is more useful than any technical explanation.
Tell your own front line staff first. Support, sales and reception will receive these calls before anybody else, and an unprepared answer from them causes more damage than the advert did.
Avoid quoting the advert in detail or reproducing its images. The aim is a page that answers the question for somebody searching your name, without becoming a distribution channel for the material itself.
07
What not to do
Do not engage with the operation directly. Messaging the advertiser, replying to the account or contacting the support number confirms that the impersonation was noticed and mostly results in faster rotation to new assets.
Do not assume a takedown ended it. The same landing page reappears under another domain within days, and a campaign that stops on one platform usually continues on another. Treat a removal as one item closed rather than the matter closed.
Do not let the incident close without writing down what was learned. The useful artefacts are a monitoring routine, a named owner, a prepared public notice and the list of recipients with their reference numbers.
Do not overstate what happened in public communication. If nobody lost money through your systems, say exactly that and say it once. A defensive statement that goes further than the facts produces its own second story.
08
What reduces the next one
Name one person who owns brand impersonation before it happens, and give them the authority to file complaints without convening a meeting. In the hours that matter, the ability to submit immediately is worth more than a considered analysis a week later.
Keep the monitoring cheap and regular. A weekly search combining the company name and the executive names with investment terms, plus alerts on those phrases, catches most campaigns early.
Keep a prepared complaint template for each of the three recipient types, with the evidence checklist attached. The templates are what turn a two hour scramble into a twenty minute submission.
Accept that the base rate is rising. Impersonation was the fastest growing category measured in 2025, up more than 1400 percent, and a company with a public name and a public executive should plan for recurrence rather than for a single incident.
| Where it appeared | Who to write to | What to attach |
|---|---|---|
| A paid advert on a platform | The platform brand or IP channel | Advert identifier, screenshots, destination |
| A landing page on a domain | Hosting provider and registrar | Full URL, saved page, registration proof |
| A social media account | The platform impersonation form | Account link, dates, your official accounts |
| A fake news style article | Hosting provider and search engine | URL, saved page, the false claims marked |
| An advert shown in another country | That country's financial regulator | Everything above plus where it was shown |
| A video using an executive face | Platform impersonation channel | Link, timestamps, the real source footage |
| A wallet address collecting funds | Exchanges that touch the address | The address and the transaction references |
| A repeat of a removed campaign | The same recipients, citing the first case | Previous reference numbers and outcomes |
Questions and answers
Why was the advert never shown to us?
Because targeting excludes the audience most likely to report it. Staff, the head office city and often the whole home country are filtered out, which is why the first report almost always arrives from a customer rather than from inside.
They used our real registration number. How does that help them?
It converts a check into a confirmation. Somebody who looks the number up finds a genuine, correctly registered company and stops there. The number is real and its connection to the advert is not.
Which complaint gets the fastest result?
The advertising platform, through its brand or intellectual property channel rather than the general abuse form. It is the only recipient that can stop a live campaign within hours.
Should we contact the advertiser to demand removal?
No. It confirms the impersonation was noticed and usually accelerates rotation to new domains and accounts. Every message should go to a platform, a provider or a regulator instead.
Is it worth publishing a warning on our own site?
Yes, and it is worth keeping permanently. It gives an authoritative page for searches that combine your name with the word scam, and it gives a doubting customer a place to land that you control.
How likely is this to happen again?
Likely enough to plan for. Impersonation was the fastest growing category measured in 2025, up more than 1400 percent with the severity of individual cases up more than 600 percent, and takedown volumes rose 182 percent in one regulator's program alone.