Our response to Ofcom's consultation on scam ads

Summary

The Centre for Digital Consumers welcomes the opportunity to respond to Ofcom’s consultation on the draft Fraudulent Advertising Codes of Practice.

We support the proposals. Ofcom estimates that between 181,000 and 202,000 people in the UK lose money to a fraudulent advertisement every year and says that it has taken a cautious approach so as not to overstate that figure (Volume 1, 4.13). Ofcom also finds that no major platform currently has all the proposed measures in place (Volume 1, 1.13). The case for intervention is made.

We recommend that Ofcom goes further in three areas. We set out our reasoning for each below, under the consultation question it relates to.

• Ofcom should consult on a measure requiring providers to notify users who engaged with an advertisement later found to be fraudulent.
• Ofcom should set out how it will assess whether a provider had insufficient control over the placement of advertisements on its service.
• Ofcom should require providers to record and report the time taken to remove a fraudulent advertisement once it has been identified.

Question 2

Do you have any comments on Ofcom’s assessment of the causes and impacts of fraudulent advertising? Do you think we have missed anything important in our analysis?

We agree with Ofcom’s assessment of the causes and impacts of fraudulent advertising and consider the analysis of under-reporting in Volume 1 to be well evidenced. We think one thing is missing from it.

Ofcom identifies late realisation as a cause of under-reporting

Ofcom finds that fewer than one in seven fraud offences are reported to the police or Action Fraud (Volume 1, 4.14), and that 21% of users took from a few days to more than a month to realise that a paid-for advertisement they engaged with was fraudulent (Volume 1, 4.17). Ofcom concludes that by that point the advertisement is likely to be difficult to track down and report.

Ofcom also cites BILETA’s observation that those who report fraudulent advertising tend to be people with consumer awareness or knowledge of the harm, “rather than those who are likely to fall victim to the fraud itself” (Volume 1, 4.15). Taken together, these findings describe a population of people who have already been harmed, do not yet know it, and are least likely to find out in time to act.

No proposed measure addresses it

Where a provider determines that an advertisement is fraudulent, it would take the advertisement down (Volume 4, 2.17) and ban the advertising account holder responsible (Volume 3, 5.6). Nothing in the proposed measures requires the provider to tell the people who saw or engaged with that advertisement while it was live.

We raise it here because Ofcom’s own analysis identifies the harm that notification would address, and because the proposals demonstrate that providers hold the information needed to act on it.

Providers would already hold the necessary information

The proposed ad library measure would require providers to publish, for each advertisement, the target audience by demographic and the target or actual reach (Volume 4, 5.9). A provider that can publish who an advertisement was aimed at and how many people it reached is a provider that can identify who to notify.

Recommendation

Ofcom should consult on a measure requiring providers of Category 1 and Category 2A services to notify users who engaged with a paid-for advertisement that the provider subsequently determines to be a fraudulent advertisement, and to include in that notification the steps a person can take if they have lost money.

Question 6

Do you agree with our proposal?

We agree with the principle behind the proposed measure. Ofcom is right that the pathway a provider uses to place advertisements “should not result in different safety outcomes” for users (Volume 2, 2.4). We have one concern about how the measure would operate.

The threshold is undefined and self-assessed

The measure applies where a provider cannot implement a measure due to the degree of control it has and requires it instead to use all reasonable endeavours to implement something as similar as possible. Ofcom states that it has not defined sufficient control or insufficient control, because this “will likely be context-dependent and is not static” (Volume 2, 2.5). The measure is then engaged where providers “conclude that they are unable to apply a measure” (Volume 2, 2.6).

A provider therefore assesses itself against a threshold that has not been defined, and a provider that concludes it has insufficient control moves from a specific obligation to a general one. The only check proposed is an internal record of which measures could not be implemented and why (Volume 2, 2.6).

We do not think this is a large gap today

Ofcom’s initial analysis is that most providers of Category 1 and Category 2A services use owned-and-operated supply chains, with intermediaries appearing mainly in hybrid arrangements (Volume 2, 2.3). On that evidence the measure would apply to a minority of inventory. Our concern is with how the threshold would behave over time rather than with its scope at the point the Codes come into force.

Recommendation

Ofcom should publish the factors it will consider when assessing whether a provider reasonably concluded that it had insufficient control, so that the conclusion is capable of being reviewed rather than simply asserted.

Question 24

Do you agree with our proposals?

We agree with the proposed moderation measures. We do not agree with the decision to leave the speed of removal both undefined and unmeasured.

The standard is statutory, but Ofcom declines to define it

Section 38(1) of the Act requires providers of Category 1 services to operate systems and processes designed to minimise the length of time fraudulent advertisements are present, and to swiftly take such content down once aware of it. The draft Code carries that standard through: measure FAU C2 provides for the swift take down of fraudulent advertisements, and states that the provider “should swiftly take down the advertisement” (Annex 4, FAU C2.3).

Ofcom is nonetheless “not proposing to provide detailed guidance on how quickly service providers should act”, expecting only that removal happens as quickly as is feasible for the service and the advertisement involved (Volume 4, 2.21). Swiftly is therefore the standard, and it is left undefined.

Nor is it measured

Ofcom describes the purpose of the ad library and complaints measures as supporting the duty to prevent users encountering fraudulent advertising and to “minimise the length of time any such content is present on a service” (Volume 4, 5.13). No proposed measure records that length of time, and none requires a provider to report it.

Why this matters more for advertising than for other content

A paid-for advertisement is bought to reach a chosen audience at a rate the provider sets. A feasibility standard that the provider also defines for itself is therefore not assessable by Ofcom.

We are not asking Ofcom to put a fixed deadline in these Codes, or to define swiftly in hours. We accept the reasoning at Volume 4, 2.20 that providers should retain flexibility over the systems they use. A measurement duty does not constrain that flexibility.

Recommendation

Ofcom should require providers to record the time between determining that a paid-for advertisement is a fraudulent advertisement and removing it, and to report that data to Ofcom, so that compliance with the duty to act swiftly and to minimise the time fraudulent content is present can be assessed against evidence.

References are to the consultation documents published by Ofcom on 10 July 2026: Volume 1 (Context), Volume 2 (Risk, governance and control), Volume 3 (Ensuring account integrity), Volume 4 (Moderation), and Annex 4 (the draft Code of Practice for Category 1 services). The consultation closes at 5pm on 2 October 2026, and anyone can respond.