The Ad Is Gone. The Scam Is Still Taking Your Money.

For further context, see SPF Readiness Is an Operating Model Problem and From Scam Signal to Reasonable Steps Evidence.

Click to view full size

Imagine the status meeting. The platform has removed the advertisement. The brand team has reported the fake news page. A hosting provider has suspended a domain. Three dashboards show progress. Meanwhile, someone who entered their phone number yesterday is speaking to an “investment consultant”. They have already seen a convincing profit balance. The consultant has a reason why today is the right day to deposit more. The advertisement did its job before anyone took it down. This illustrative sequence exposes a coordination problem that individual takedown statistics can easily hide. A fake investment campaign can cross advertising, publishing, telephone persuasion and payment systems. Its defenders encounter separate pieces, at separate times, under separate rules. A campaign can keep working even when every team handling it has done something useful. That is an uncomfortable failure mode because ordinary activity reports can make it look like success.

Australia’s National Anti-Scam Centre reported A$837.7 million in combined investment scam losses in 2025, down 11.4% from A$945 million in 2024. That remains roughly 38% of the A$2.18 billion in total combined reported scam losses. Total scam losses increased 7.8%, so the improvement in investment losses should not be mistaken for an improvement across every category.^[1]

Source: NASC, Targeting Scams 2025, published 30 March 2026. These figures combine reporting sources with overlap adjustments. They are not Scamwatch-only totals and do not measure every unreported loss. The share is calculated from the published rounded totals.

The relevant question for defenders is what keeps the operation productive. Consider the campaign as a customer acquisition business with a criminal objective. An advertisement attracts attention. A fabricated article supplies credibility. A form acquires a lead. A caller develops the relationship. A payment destination receives the money. Each stage prepares the victim for the next. Examining only the page in front of you can miss the purpose of the entire sequence.

The fake article is a handover document

The ABC’s investigation published on 23 June 2026 documented advertisements using fabricated public-figure stories to direct readers to cloned ABC pages and a fraudulent investment brand, Hexonix 365. The promotion included a false editorial assurance and celebrity testimonials. Registration led to calls from scammers.^[2] These were impersonations, not genuine endorsements. The handover is the key analytical point: a page can prepare a person for later persuasion rather than collect money itself. An investigator therefore needs to examine the destination of the user journey alongside the content of the page. Evidence of one stage should not be stretched into an unsupported claim about who controls every later stage.

A web page can load normally, use HTTPS and contain no exploit kit while still operating as an intake point for fraud. A scanner’s failure to find malware cannot establish the truth of an investment claim. Once contact details have moved downstream, removing the original page does not erase the relationship. Existing leads can remain exposed even while new lead acquisition is interrupted. Those are separate protection tasks and should have separate response actions.

AI is now helping manufacture the “second opinion”

The familiar account of AI-enabled scams focuses on convincing faces and voices. The more consequential development may be what happens when a cautious person checks the story. On 17 August 2026, ASIC warned that scammers were building supporting online footprints with fake reviews, fabricated news and AI-generated material. Its warning was direct: a quick search cannot reliably verify an investment when the material returned by that search is itself part of the deception.^[3] This creates a second persuasion stage. The advertisement introduces the claim. Supporting pages make the victim believe they have independently checked it. Call this manufactured corroboration: several apparently separate sources repeat a claim while providing no independent basis for trusting it. The term here describes an analytical pattern, rather than a formal threat classification. For an investigator, five reassuring pages should trigger a provenance question. Where did each assertion originate? Do the pages cite a real regulator, authentic reporting or independently verifiable records? Or do they repeat one another, reuse distinctive wording and ultimately funnel readers towards the same destination?

The number of pages is a poor substitute for the number of independent sources. Scamwatch’s 28 September 2026 alert adds a telling example: a fake Reuters webpage claimed that an investment platform had passed safety checks and had an official Reuters partnership. The deception impersonated the act of verification itself.^[4] That is a particularly effective way to exploit sensible behaviour. A person who pauses to investigate may feel safer precisely because the attacker anticipated the pause.

Click to view full size

Your AI assistant can inherit the same false confidence

Now place an AI assistant between the person and those supporting pages. A user asks whether the investment brand is legitimate. The assistant retrieves several positive mentions, compresses them into a fluent answer and presents the result as a useful second opinion. If those mentions share a fabricated origin, a well-written answer can still rest on poor evidence. Retrieval supplies material for an answer. It does not, by itself, establish the independence or accuracy of that material. There is also a distinct risk involving instructions embedded in external content. In February 2026, Microsoft documented attempts to use “Summarize with AI” links to plant persistent promotional preferences in assistants’ memory, describing the technique as AI Recommendation Poisoning. Its researchers reported more than 50 unique prompts across 31 companies and 14 industries, while noting that mitigations were evolving.^[5] That research concerns promotional manipulation. It does not establish that the investment scams discussed here used prompt injection, poisoned model memory or defeated an AI assistant.

It does establish why defenders need to separate two problems. False supporting pages can contaminate the evidence an assistant reads. Malicious instructions can attempt to redirect how the assistant behaves. Either can undermine a verification workflow, but they require different checks. For an AI-assisted scam investigation, keep the original source beside every extracted claim. Check claimed licensing against the regulator’s own records and independently obtained contact details. Treat page text as untrusted evidence, including any instructions addressed to the model. Require review before publishing an allegation or initiating an action that could affect a legitimate account. The extension to investment scams is a risk analysis, not an observed finding about the investment operations cited here. It deserves attention because consumers increasingly delegate the very checking process that scammers already try to manipulate. The ABC’s June 2026 investigation, with technical assistance from Qurium, identified more than 3,000 fake investment brands in the ecosystem it examined. It also documented replacement advertiser accounts posting fresh advertisements after previous batches disappeared.^[2]

The count refers to brands in that investigation. It is not a count of criminal groups, a measure of all Australian investment scams or proof that every brand used AI. The operational lesson is that an investment brand can be disposable. A fresh name gives an old mechanism a new search footprint. A different public figure refreshes the hook. Another domain restores a route into the lead form. Generative AI can reduce the effort required to rewrite stories, localise language and produce visual variations. How much this reduces costs in a particular operation requires evidence. The defensive implication is still clear: an investigation tied only to exact wording, a familiar face or one hostname is vulnerable to superficial change. Defenders need to distinguish what the operator can cheaply replace from what the operator repeatedly depends on. A call-handling route, lead intake endpoint or payment relationship may offer greater disruption value than another copied headline. None should be assumed to be permanent, and the highest-value intervention depends on what the evidence actually reveals.

The useful question after a takedown is: what can this campaign still do?

A screenshot records what a page claimed. A redirect capture can show how a particular advertisement reached that page. A verified form destination can connect several pages to a shared intake point. A payment receipt may connect a victim’s experience to a beneficiary that otherwise looks unrelated. Qurium’s August 2026 follow-up illustrates the last point. Its investigation began with a victim’s payment receipt and expanded into an examination of corporate and payment relationships. That evidence path demonstrates how a financial artefact can change the scope of an investigation.^[6] Useful campaign intelligence records these relationships with their provenance. Each link needs an observation time, a collection method and a statement of confidence. Analysts should be able to distinguish a directly captured redirect from a probable match based on a reused template.

Shared infrastructure needs care. Two sites using the same cloud provider or content delivery network do not establish common control. Similar layouts can reflect a widely available kit. Even a shared intake service may connect separate affiliates without proving that one person controls them all. A campaign case should therefore allow provisional links, competing explanations and later corrections. Overconfident clustering can disrupt legitimate services and pollute the intelligence that other teams depend on. AI is useful here for extracting names from screenshots, comparing multilingual narratives and proposing relationships for review. Its output should identify the supporting artefacts and leave unsupported fields empty. A plausible story that silently fills gaps is dangerous in an evidence workflow.

Every team can be right while the victim remains exposed

Specialisation is necessary. A hosting provider cannot make a bank’s transaction decision. A bank cannot remove every fraudulent advertisement. The gap appears when nobody has responsibility for asking whether the combined actions have made the campaign materially harder to operate. The response model proposed here assigns one accountable campaign owner, supported by distributed execution. The owner maintains the shared case, coordinates decisions and verifies the outcome. This is an operating responsibility, not an assertion that one organisation possesses every enforcement power. In practice, that owner needs named escalation contacts and clear decision rights. Who can approve a takedown request? Who can ask a financial institution to review a destination? Who decides whether a customer warning is justified? Who follows up when a service provider declines the request? A shared dashboard helps only if somebody has the authority and time to resolve those questions.

A removal notice establishes that somebody acted. A follow-up observation establishes what changed. A suspended domain may interrupt a lead acquisition route. A restricted telephone service may affect a persuasion channel. An intervention by a financial institution may restrict a particular payment destination. Each outcome matters, but each describes a different capability. Record the action, affected capability, verification time and remaining uncertainty. If one route has stopped working but alternatives remain active, the campaign case should say so. The following four measures are proposed here as a way to make this discipline easier to manage:

Teams should also report evidence quality and coverage. A low reappearance rate can mean successful disruption, or simply insufficient monitoring. A short survival time is meaningless if the investigation stopped looking. For campaigns still active at the end of a reporting period, show their current observed age rather than pretending they ended. Where possible, report medians and longer-tail response times alongside averages so that a few difficult cases do not disappear inside one number.

Where early verification meets payment intelligence

This campaign model explains why public reporting, digital risk protection and payment intelligence need to exchange evidence. A suspicious screenshot may reveal a campaign before a transaction occurs. A takedown investigation may uncover additional intake routes. Verified payment context may help a bank assess a destination that would otherwise appear unfamiliar but unremarkable. It also explains the relationship between Cyberoo’s service areas. Scams.Report supports explainable verification and reporting. NothingPhishy focuses on digital risk protection and coordinated infrastructure disruption. MuleHunt focuses on evidence-supported intelligence about scam-linked payment destinations before a transfer.^[7] The architectural value comes from preserving context across those handovers. A risk label without its supporting evidence forces the next team to start again. A destination indicator without its observation date can outlive the conditions that made it useful. The receiving institution still needs to apply its own controls and decision criteria.

For any provider or internal programme, the test should be concrete: can an analyst follow a finding back to the source, understand the proposed relationship and see what action followed? Product coverage alone cannot answer that question. Choose a recently disrupted investment scam and reconstruct what happened after the first action. Check whether alternative advertisements appeared, whether the same intake route remained reachable, whether affected customers still received contact, and whether any known payment destination received an appropriate review. Assign the unanswered questions to named owners. Keep the case open where active capability remains, even if every individual removal request has been processed. Then ask the person responsible for the combined outcome to show the evidence. After everything we removed, how could this campaign still reach a victim and get paid?

FAQ