Scammers read the same advice and built for it.

What the takedown numbers describe

Australia’s corporate regulator published its scam takedown figures on 17 August. In FY26, ASIC removed more than 19,400 online scams, up 182% on the previous year’s 6,915. Fake investment platforms accounted for 7,051 of those, up 151%. Phishing hyperlink takedowns rose 279% to 5,476. Crypto investment scams rose about 30%, to 3,106. Across three years of running the capability, the total is over 33,400.

Those are enforcement numbers, but read as marketing data they describe something specific. This is not a spray of crude fake pages. ASIC’s description of the method is that scammers create scam brands with unique phrases and a supporting online footprint: news articles, positive reviews, ads and websites that reinforce each other. Deepfake video of a recognisable person sits on top. Then scripted phone calls, a convincing fake platform, and small early payouts to build trust.

In Australia the impersonated names included the Prime Minister, a former senator, a well-known finance presenter and several business figures. Scamwatch tied $7.4 million in reported losses to those impersonations in a single year. ASIC also notes the roster changes with the news cycle, which tells you the operation is being actively managed rather than set and forgotten.

The uncomfortable part for marketers

Every trust signal in that list is one your own marketing team is trying to build. Consistent brand language. Third-party coverage. Reviews. A recognisable face. Ads on platforms people already trust. Enough surface area that a search returns a coherent picture.

The attacker’s advantage is that generating all of it now costs almost nothing, and they do not need it to survive scrutiny for years. They need it to survive one anxious evening of Googling.

Which means the “do your own research” step, the one every consumer education campaign ends on, has quietly become the moment of maximum vulnerability. The victim is not careless. The victim is being careful in exactly the way we taught them, against a target built to reward that behaviour.

You cannot out-content someone who can generate content faster than you can.

What actually works, and it is not what most brands try

The instinct when a brand finds a fake version of itself is to publish a warning post. It helps a little. It also ranks below the scam’s ad spend, and it only reaches people already on your properties, who are not the ones at risk.

The thing buried in ASIC’s release is far more useful. The regulator is asking licensed financial businesses to register their real website addresses on ASIC’s public registers so consumers can verify a site against an official source. That is the actual defence, and the principle generalises well beyond financial services: put the verifiable version of your identity somewhere a scammer cannot publish to.

For most businesses that means being deliberate about a small number of channels nobody else can write into. Your entry on an official register or licensing body. A verified profile on a platform that checks identity. A domain that matches your legal name, held for years, easy to say out loud on a phone call. A single canonical “how we will and will not contact you” page you can point people to.

The test is simple. If a customer rang you tomorrow and said someone was selling your product at half price on a site that looked exactly like yours, what would you tell them to check that a scammer could not fake within a day? If the answer is your reviews, your press mentions, or your social following, you do not currently have an answer.

The takedown sequence, before you need it

Small teams discover impersonation on a Friday and then lose a weekend working out who to email. Write this down now, while it is theoretical.

• Evidence first. Screenshots with visible URLs and timestamps, the ad if there is one, and the platform’s ad library entry. Takedown forms ask for this and stall without it.
• Registrar and host, not just the platform. A WHOIS lookup and an abuse report to the host often moves faster than a platform’s brand form, and it kills the destination rather than one ad.
• Platform brand-protection channels. Most large ad platforms have a separate, faster route for trademark and impersonation complaints than the general report button. Find the link before you need it.
• Your own customers, quickly and calmly. One email, one pinned post, one line on the site. Say what the real domain is. Do not link to the fake one.
• The relevant regulator. In financial services, telecoms and health this genuinely accelerates removal. In other sectors it may do nothing, so set expectations accordingly.

This may not be worth building out if you are a local business with no public profile and no advertising spend, because impersonation follows recognition. The moment it becomes worth building is the moment your founder starts appearing on camera or your ads start running at scale. Those are the same conditions that make you worth copying.

The part that will not be solved by process

There is a real limit here and it is worth saying plainly. A takedown removes one site. The operation spins up another. ASIC removed 19,400 in a year and the honest interpretation of a 182% increase is not that enforcement is winning, it is that supply is growing faster than removal.

So the defensive posture that scales is not detection. It is making verification cheap for your customer. A brand that has told its audience, repeatedly and boringly, “we will only ever contact you from this domain, we will never ask for payment by transfer, check us on this register” is harder to impersonate profitably than a brand with twice the following and no such habit.

Boring, repeated, specific. It is the least exciting brand work there is, and it is the only kind an AI-generated clone cannot copy faster than you can publish it.

Editor’s note: This area changes quickly, so check the latest platform policy before making compliance decisions.

The post Scammers Now Build a Whole Brand Before They Steal Anything appeared first on Mark8ng.com.

On 17 August the Bundeskartellamt, Germany’s competition authority, closed its case against Apple’s App Tracking Transparency Framework after accepting binding commitments. The finding underneath it is the part marketers should copy out and keep, because it has almost nothing to do with Apple.

What the regulator actually objected to

Apple’s framework requires third-party apps to get an extra layer of consent, on top of data protection consent, before using cross-company data for personalised ads. Apple’s own apps sit outside that framework and use their own prompt.

The authority’s assessment was that the two prompts were not equivalent, and that the gap was bigger than the underlying data processing could justify. In its words, the wording, design and selection options in Apple’s own request had the potential to encourage consent, while the request Apple wrote for everyone else had the potential to discourage it. Third-party apps also had to ask more than once in some cases, even where valid data protection consent already existed.

So Apple will now remove what the regulator called possibly discouraging symbols and wording, and the prompts will be, in the Bundeskartellamt’s phrasing, neutral in terms of content, wording and layout. Apple has four months to implement. The commitments run for seven years with an independent monitoring trustee, and although this was a German case, the changes are expected to reach most of the EU.

Worth noting the price of getting there ahead of Germany: French and Italian authorities fined Apple 150 million and 98.6 million euros respectively over the same framework.

What most marketers will take from this, and why it is the wrong lesson

The obvious read is “iOS opt-in rates might improve, so app install campaigns get cheaper.” Maybe. Nobody should build a Q4 plan on it. Apple has four months, testing happens with app publishers first, and consent behaviour is stubborn in ways that survive prompt redesigns.

The lesson worth having is the standard itself. A regulator has now written down, in a binding decision, that asymmetric consent design is the problem. Not missing consent. Not unlawful processing. The symbols. The wording. The layout. The number of times you ask.

Now go and look at your own cookie banner.

Most small business sites are running a banner where Accept All is a filled button in the brand colour and Reject is grey text, or a link, or one layer down behind Manage Preferences. That is the exact shape of the thing Apple just spent four years defending and lost. The German case was argued under competition law rather than data protection law, so it does not directly create a new obligation for your site. But regulators read each other, and Andreas Mundt was explicit about the goal: users who do not want their data used must be able to make an equally free and informed decision as users who do.

Consent design is now a documented enforcement target, not a dark pattern that everyone quietly tolerates.

The bit that is actually good news

Buried in the commitments is something publishers have wanted for years. App publishers and content providers will get more scope inside the prompt to explain what personalised advertising means for their offering and their business model. Apple will also let publishers combine its required consent request with the ones required under data protection law, instead of stacking them.

That turns a compliance screen into a piece of copy. Someone has to write it.

This is a genuinely unusual opportunity, and I expect most teams to waste it. The instinct will be to write something manipulative, because the metric on the dashboard is consent rate. The regulator has pre-emptively closed that door: Mundt said plainly that the aim is not to achieve the highest possible levels of consent. Push too hard on the wording and you rebuild the problem from the other side.

The version that works is boring and specific. Not “we value your privacy” but “ads pay for this app, personalised ads pay roughly twice as much, and that is the difference between free and a subscription.” People respond to a real trade-off explained honestly far better than they respond to reassurance.

A simple action plan

Three things, in order, none of which require a lawyer to start.

1. Screenshot your consent banner and look at it as a stranger. Are the two options equally easy to see, equally easy to click, equally weighted in colour and size? If a reasonable person would say the design is steering, it is steering.
2. Count the asks. If a user has already consented once, does something ask them again on the next page or the next session? Repeat prompting was one of the specific complaints in this case.
3. Write the honest explanation now. One or two sentences on why you want the permission and what the user gets. You will need it for app prompts within four months, and it improves your web banner today.

If everything is optimised for the yes, nothing is really consented. That is the direction the enforcement is moving, and the teams that get there voluntarily will spend a lot less on the retrofit than the ones who wait.

For advertisers, this sits alongside a broader pattern of platforms controlling the interface between you and your customer, which is the same tension behind Google labelling AI ads without an opt-out. You do not own the box your message appears in. You only own what it says.

Editor’s note: This area changes quickly, so check the latest platform policy before making compliance decisions.

The post A Regulator Just Ruled on the Design of a Consent Box. Read Your Cookie Banner Again. appeared first on Mark8ng.com.