Phishing Ads

Phishing ads are paid advertisements, most often native or in-feed placements, that impersonate a trusted brand, government agency, or urgent account notice to trick a viewer into entering credentials, payment details, or other personal data on a fake page. Unlike email phishing, they arrive through the same channels as legitimate advertising, which is exactly what makes them hard to filter out at scale.

How phishing ads get through ad review#

Most phishing campaigns don't advertise the phishing page directly. The visible creative is bland and generic, a security warning, a prize notification, a package delivery update, so it clears automated review without tripping any brand or trademark filters. The real destination only appears after a redirect chain, and the page itself often uses ad cloaking to show reviewers or bots a harmless page while sending real clicks to a fake login form. A domain registered to look like the spoofed brand's real address, a typosquat, usually anchors the whole setup.

Speed also works in the scammer's favor. A campaign can be live within minutes of a self-serve account being funded, and the fake page often gets swapped out or the domain gets abandoned within a day or two, well before manual review catches up. That's why ad transparency tools that record which creative ran, on which network, and where it led matter more here than a one-time compliance check. Even then, a cloaked campaign can show any automated visitor, a transparency tool's crawler included, a different page than the one a real visitor sees.

The creative patterns themselves repeat constantly across campaigns: a fake account-suspension notice, a package-delivery failure alert, a too-good giveaway, all built to create urgency that overrides a viewer's usual skepticism. Recognizing the pattern in the headline is often faster than trying to inspect every landing domain by hand.

Why they matter for advertisers, networks, and the brands being spoofed#

For the impersonated brand, phishing ads cause real financial harm to customers and lasting damage to trust, even though the brand never ran the ad. For networks, tolerating phishing traffic invites regulatory scrutiny; the FTC treats deceptive advertising practices as enforceable regardless of the ad format, and FTC disclosure rules for advertorials sit in the same broader enforcement space. For everyday advertisers, phishing campaigns share ad space and inflate the perceived risk of native buying generally, which is part of why due diligence on a network's brand safety practices matters before committing budget.

The practical defense is visibility into what's actually running and where it actually leads. OpenAdLibrary's ad intelligence index records captured creatives and the landing pages their redirects led to across major native networks, which can help spot a phishing pattern early, such as a spike of near-identical urgent-alert creatives all resolving to freshly registered domains. If you spot one, reporting the scam ad with the captured evidence can help get it removed faster than a plain complaint.