Nine firms kept advertising on platforms after the Financial Conduct Authority flagged them, the consumer group Which? has found.
The Online Safety Act's duty on platforms to stop paid-for scam adverts is not yet in force. Not before 2027.
Nine Flagged Firms, a 95% Ban Rule and a 0.15% Revenue Cap
Which? checked 300 entries on the FCA warning list against the ad libraries of Meta (which owns Facebook and Instagram), Google and TikTok.
Nine firms kept advertising on at least one platform, and two Meta ads were still live six days after Which? reported them in-app.
Documents seen by Reuters, in Pulitzer-winning reporting, show Meta bans an advertiser only at 95% predicted certainty of fraud. Below that, it charges higher ad rates; a Meta spokesman says the documents 'present a selective view'.
A February 2025 document said the vetting team could not take actions costing more than 0.15% of revenue, about £101 million. Meta says that was not a hard limit.
The documents estimate revenue from scam ads rated higher legal risk at about £2.6 billion every six months; one anticipated fine of up to about £750 million. Meta disputes that it acts only under regulatory pressure.
In a Reuters test, an investment ad ran in Britain but was blocked in Australia, where Meta faces potential fines of up to £27 million. Meta cites enhancements to its Australian financial-verification process.
Ofcom's Nearly 40 Measures Await a 2027 Start Date
Ofcom, the communications regulator, proposes nearly 40 measures in a draft code published on 10 July 2026. They include banning repeat scam advertisers, blocking new accounts and checking advertiser identity.
The draft code covers testing AI ad tools. The consultation closed on 2 October 2026, with final decisions due by mid-2027 at the latest.
Fines could reach £18 million or 10% of qualifying worldwide revenue, whichever is greater. Separately, Which? reports Meta has launched a judicial review of how Ofcom calculates such penalties, calling them 'disproportionate'.
The Home Office expects the fraudulent advertising duty to come into force in 2027. It is, in chess terms, a problem of tempo: the Act passed in 2023, the duty is still waiting, and flagged advertisers carried on for weeks.
Ofcom Audit Finds Four of Seven Services Allow Ads Before Further Checks
Ofcom's audit of seven services in October and November 2025 found four let advertisers run ads after supplying only a phone number, email address or payment method, without visible further checks.
Default daily budgets ran from £25 to £65, and extra account security was off by default on all seven. Ofcom does not name individual services.
In the EU, consumer groups sent Meta 503 notices about suspected fraudulent ads between December 2025 and March 2026. Meta took 146 ads down, rejected 216 notices as not fraudulent and ignored 90, says the European Consumer Organisation (BEUC).
Meta says it removed more than 159m scam ads in 2025, 92% before anyone reported them.
Meta Targets 90% Verified Ad Revenue, but Ofcom Audit Did Not Measure Prevalence
Meta says its advertiser verification covers advertisers behind 70% of ad revenue, with a 90% target for the end of 2026. That counts revenue, not the share of advertisers.
Ofcom's audit did not measure how many fraudulent ads exist, and the Home Office has promised to develop prevalence and removal metrics.
Which? found ad libraries uneven: X has none, and TikTok redacts the names of violators.
The FCA told Which? that tech firms 'don't need to wait' and 'should step up now'.
But not before 2027.
