Paid For and Fraudulent: The Online Safety Act Advertising Duties and Where Enforcement Lands

A great many large scams in the United Kingdom begin with an advertisement somebody paid to put in front of the victim. Investment fraud arrives as a sponsored post impersonating a real asset manager or a public figure. Purchase scams arrive as a marketplace listing boosted into a feed. Recovery fraud, the subject of today's theme post, arrives as a paid search result for a collapsed platform. The advertising layer is not incidental to fraud; it is the acquisition channel, and one the financial sector pays for without controlling.

The Online Safety Act 2023 was the first serious attempt to place a statutory duty on that layer. Buried behind the child safety provisions that dominated the public argument sits a set of duties about fraudulent advertising, applying to the largest user-to-user and search services and requiring them to prevent individuals encountering fraudulent advertisements, to minimise the time such content is present, and to operate systems for reporting and removing it. That is a genuine change in the allocation of responsibility, and banks have largely under-invested in preparing for it.

The difficulty is that much commentary treats the regime as though it were fully operative and fully specified, and it is neither. Some of it is settled statute and has been since 2023. Some sits in draft codes of practice and consultation material that has not reached final form. Some, particularly around the advertising supply chain beyond the platforms themselves, is policy aspiration rather than law. This post separates those three categories, then sets out what a bank should be doing regardless of how the detail settles. We assert no commencement dates, because asserting them would be invention.

What Is Changing

Start with the statutory architecture, because its shape explains why the fraudulent advertising duties exist separately at all. The Act's main illegal content duties, which are in force and which Ofcom has been supervising since 2025, bite on user generated content and on search results. Fraud offences sit among the priority offences in the Act's schedules, including fraud by false representation and the offences of carrying on regulated activity without authorisation and making unauthorised financial promotions. But paid-for advertising is largely carved out of the definition of regulated user generated content, because it is not user generated in the ordinary sense. Without a separate provision, one of the most important fraud vectors on the internet would have fallen outside the Act.

The fraudulent advertising duties fill that gap, and they are deliberately narrower in application than the illegal content duties. They apply only to services Ofcom has placed on the register of categorised services as Category 1 user-to-user services or Category 2A search services, following threshold conditions set in secondary legislation. In substance they require a provider to operate proportionate systems designed to prevent individuals encountering fraudulent advertisements, to minimise the time any such advertisement is present, and to remove it swiftly once alerted by any person. Providers must set out their policies in terms of service, and search services must deal with the equivalent problem in paid search results. Ofcom is required to produce codes of practice describing measures that will be treated as compliant.

The enforcement machinery is the same machinery that applies to the rest of the Act, and it is not trivial. Ofcom may require information, may issue confirmation decisions specifying remedial steps, and may impose penalties of up to eighteen million pounds or ten percent of qualifying worldwide revenue, whichever is greater. Beyond that sit business disruption measures, obtained through the courts, which can require payment providers and advertisers to withdraw services from a non-compliant platform or, in the most severe case, require internet access providers to restrict access to it. That combination, revenue linked penalties plus the ability to cut off the advertising revenue of a non-compliant service, is what gives the regime its weight.

Timelines and What Is Still Uncertain

What is settled should be stated precisely. The Act received Royal Assent in 2023 and the fraudulent advertising duties are in the statute. The illegal content regime, including the priority fraud offences, is operative and Ofcom has been running supervision, information gathering and enforcement programmes under it. The categorisation thresholds were set by regulations and Ofcom maintains the register of categorised services, so the population in scope of the advertising duties is knowable rather than hypothetical. The penalty ceilings and the business disruption powers are in primary legislation and are not in doubt.

What is not settled is most of the operational detail a compliance plan would need. The codes of practice for the fraudulent advertising duties are the pivot: they will determine what a proportionate system actually looks like, what verification of financial advertisers is expected, how quickly removal must follow a report, and what evidence a reporter must supply. Ofcom has consulted and the direction of travel is visible, but final code text, parliamentary approval and the point at which the duties become enforceable in practice are not things we will put a date on, and any adviser offering one is selling confidence. The speculative end deserves equal bluntness. Extending statutory duties across the wider advertising supply chain, to intermediaries, exchanges and ad networks that never appear on the register, remains a matter for the government's separate online advertising policy work rather than a measure in force. A compensation route for victims funded by platforms is an idea in circulation, not a draft. Firms that build to either have wasted the money. The realistic expectation for 2028 is a first wave of enforcement concentrated on the largest services and driven by the quality of their reporting and removal systems rather than by any single advertisement.

What It Means Operationally

The first operational consequence is that a bank's ability to benefit from this regime depends almost entirely on the quality of the evidence it can produce, and most firms cannot currently produce it. A duty to remove content swiftly on being alerted is only as good as the alert. A platform receiving a vague complaint that a firm is being impersonated will act slowly or not at all; a platform receiving a precise, structured, repeatable report identifying the advertisement, the advertiser account, the landing page, the regulated entity being impersonated and the evidence of consumer harm has very little room to argue. That means the claim intake process has to capture the advertisement itself, its URL, a screenshot and the platform, at the moment the customer reports the loss. Almost no claim form in United Kingdom retail banking does this properly, which means the evidence that makes the regime work is being destroyed at source every day.

The second consequence is that takedown needs to become a managed pipeline rather than an occasional act of correspondence. A firm should know, for each major platform and search service, what the reporting route is, who inside the bank is authorised to use it, what the response time has historically been, and what the escalation path is when nothing happens. That record matters twice over: it is how a bank gets content removed quickly, and it is how a bank builds the evidential base that a platform's systems are not working, which is the raw material for a complaint to Ofcom. Ofcom's supervisory posture under this Act is systems focused. It is not, in the main, adjudicating individual items of content; it is assessing whether a provider's processes are adequate. A bank with twelve months of structured data showing median removal times and repeated failures against the same advertiser is contributing something a regulator can act on. A bank with a mailbox is not.

The third consequence concerns brand impersonation monitoring, which should now be treated as a financial crime control rather than a marketing function. The most damaging advertisements in this category impersonate authorised firms, and the firms most often impersonated are frequently the last to know. Institutions should monitor paid placements and search results against their own brand, product names, senior executives and common misspellings on a continuous basis, and feed what they find into the same takedown pipeline. A related internal discipline is uncomfortable but necessary: a bank's own advertising and affiliate arrangements should be reviewed to confirm that its media spend is not funding the same inventory that carries fraudulent advertising.

The fourth consequence is about governance and what a firm should be able to demonstrate. The Financial Conduct Authority's expectations under the financial crime guide and the Consumer Duty are not suspended because somebody else now has a duty too. A bank should be able to show its board, and a supervisor, a simple set of facts: how many fraudulent advertisements it identified in a period, how many it reported and to whom, how many were removed, how long removal took, and what proportion of its own authorised push payment claims originated from an advertisement on a categorised service. That last metric is the one most firms have never calculated and the one that will matter most, because it converts an abstract policy argument into a number the institution owns.

Conclusion

The honest position is that the Online Safety Act has settled the principle and left the practice open. That the largest platforms and search services owe a duty in respect of fraudulent advertisements is law. What discharging that duty looks like, how quickly Ofcom moves from supervision to penalty, and whether the duties ever reach the advertising intermediaries between fraudster and platform, are all unresolved. Expect incremental supervisory pressure rather than a dramatic enforcement moment.

None of that uncertainty changes what a bank should do, because the work is worth doing under every version of the outcome. Capture the advertisement at the point of claim. Run takedown as a measured process with a named owner. Monitor your own brand in paid placements. Count how much of your fraud loss arrives through advertising and put the number in front of your board. A firm that does those four things is better protected today and is in a far stronger position on the day a platform is asked to explain why its systems did not work. A firm that waits for the codes of practice to be finalised will find, when they are, that it has no data with which to use them.

Suggested Next Steps

• Change the fraud claim intake process so that the advertisement is captured as evidence, recording the platform, the advertiser account, the URL, a screenshot and the landing page, and make origin channel a mandatory field on every scam claim.

• Build a single managed takedown pipeline with a named owner, documented reporting routes into each major categorised platform and search service, and a log recording report date, removal date and outcome for every item.

• Stand up continuous monitoring of paid placements and search results against your brand, product names and executive names, and review your own media and affiliate arrangements to confirm you are not funding inventory that carries fraudulent advertising.

• Produce a quarterly board metric showing the proportion of authorised push payment and investment fraud losses originating from an advertisement on a categorised service, together with reported volumes and median removal times, and use it as the evidential basis for engagement with platforms and with Ofcom.

Sources: Online Safety Act 2023, including the illegal content duties, the priority offences listed in the Act's schedules and the duties about fraudulent advertising applying to Category 1 and Category 2A services; the Online Safety Act 2023 categorisation threshold condition regulations and Ofcom's register of categorised services; Ofcom consultations, codes of practice and guidance published under the Act, and Ofcom enforcement programme material; Department for Science, Innovation and Technology online advertising policy work; Home Office Online Fraud Charter and fraud strategy publications; Financial Conduct Authority financial crime guide, Consumer Duty, financial promotions regime under the Financial Services and Markets Act 2000 and warning list; Fraud Act 2006; Payment Systems Regulator mandatory reimbursement requirement for authorised push payment scams; UK Finance fraud analysis and reporting on the origin of scam losses; National Crime Agency and Action Fraud reporting; Global Anti-Scam Alliance research on advertising as a scam distribution channel; TrustSphere Risk Index, April 2026.

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai