FTC Impersonation Scam Ads Rule 2026: What Businesses Can Do

The US Federal Trade Commission is asking whether online ad platforms should be required to do more to stop scam ads that impersonate real businesses and government agencies. The notice was published on October 1, 2026, and comments are due by November 30, 2026. Businesses copied by scammers can comment, and should tighten their email and domain defenses now.

Impersonation scams hurt the businesses being copied as well as the people who lose money. Customers blame the brand, support teams field angry calls, and ad budgets compete with fake listings. This proposal is at an early stage, but it signals where regulators are heading.

Key takeaways

The FTC announced on September 24, 2026 that it is considering updating its Impersonation Rule to address ad platforms' role in impersonation scams, and the notice was published in the Federal Register on October 1.
It asks about measures such as vetting advertisers, monitoring ads, investigating suspected scam ads and removing confirmed ones, and comments are due by November 30, 2026.
The FTC says it received more than 1 million imposter scam reports in 2025, with nearly $3.5 billion in reported losses.
Businesses can comment, document any impersonation of their brand and tighten their own email and domain defenses now.

What happened

On September 24, 2026 the FTC announced it is seeking public comment on whether to update its Rule on Impersonation of Government and Businesses. The focus is on "ad-optimization practices" offered by search engines, social media and other digital marketplaces that may help scammers run ads posing as legitimate businesses and government agencies.

The Advance Notice of Proposed Rulemaking (ANPRM) was published in the Federal Register on October 1, 2026. The Commission voted 2-0 to publish it. Comments go through Regulations.gov docket FTC-2026-1552 and must arrive on or before November 30, 2026.

What the FTC is asking

According to the FTC's press release, the notice asks about:

the financial incentives behind platforms' ad tools,
whether these practices are unfair or deceptive,
whether to amend the existing rule, write a separate rule or use non-regulatory measures, and
possible measures such as vetting advertisers, monitoring posted ads, investigating suspected impersonation scam ads, removing confirmed ones and disciplining offending advertisers.

Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection, said the agency wants to know whether it should "require platforms to take concrete steps to prevent impersonation ads from ever reaching consumers."

The scale of the problem

The FTC says it received more than 1 million imposter scam reports in 2025, with consumers reporting nearly $3.5 billion in losses. Nearly 30% of people who reported losing money in 2025 said the first contact came through social media, with reported losses of $2.1 billion.

What it is not

An ANPRM is the earliest stage of rulemaking. There is no proposed rule text yet, and nothing in the notice creates new obligations for platforms, advertisers or businesses. The existing Impersonation Rule, which already prohibits impersonating government and businesses, stays in place. See the FTC's Impersonation Rule page.

The picture outside the US

Regulators elsewhere are looking at the same problem from the platform side:

United Kingdom. Under the Online Safety Act 2023, the largest platforms face duties on fraudulent paid ads. Ofcom ran a consultation on draft Fraudulent Advertising Codes of Practice from July to October 2026. Our post on the Online Safety Act for small business websites covers the wider law.
EU, Canada and Australia. Consumer protection and platform rules differ by country. If scammers target customers there, report through the local consumer or fraud authority as well as to the platform.

Who this affects

Well-known local and online brands whose names, logos or offers are copied in fake ads.
Businesses that take payments or bookings online, where a fake ad can lead customers to a lookalike checkout.
Advertisers, who may face more verification checks if platforms are required to vet them.
Agencies that manage ad accounts for clients.

Practical checklist

Consider commenting. If your business has been impersonated in ads, the FTC is asking for real-world evidence. Comments are public and include your name and state, so share only what you are comfortable publishing.
Keep a record. Screenshot impersonating ads, note the platform, date and landing page, and report them through the platform's tools. Report scams to the FTC at ReportFraud.ftc.gov, or the equivalent authority in your country.
Lock down your email domain. Scam ads are often paired with spoofed emails. Check your records with our free DMARC checker and SPF checker, and read our guide to stopping email spoofing.
Watch for lookalike domains. Scam landing pages often sit on newly registered domains. Our domain age checker helps you judge a suspicious URL quickly.
Teach your team to read headers. When a customer forwards a suspicious email "from you", our email header analyzer shows where it really came from.
Tell customers how you contact them. A short page stating your official domains, payment methods and social accounts gives people something to check against. Our post on QR code scams has more examples of how scammers borrow trusted brands.

If monitoring for fake listings and spoofed emails is eating your team's time, Make It Flow can help set up automated alerts; talk to us.

FAQ

What is the FTC Impersonation Rule?

It is an FTC rule that prohibits impersonating government agencies, businesses and their officers as an unfair or deceptive practice. It is already in force. The September 2026 notice asks whether to extend the approach to cover ad platforms whose tools may help scammers run impersonation ads.

Is the FTC creating a new law for ad platforms?

Not yet. The notice published on October 1, 2026 is an Advance Notice of Proposed Rulemaking, the earliest stage. It contains no proposed rule text. The FTC could later propose a rule, choose a separate rule or use non-regulatory measures, each with further public comment.

How can a small business comment?

Comments are submitted through Regulations.gov under docket FTC-2026-1552, by November 30, 2026. Instructions are in the Federal Register notice. Your comment, including your name and state, becomes part of the public record, so leave out confidential customer details.

What should I do if scammers run ads pretending to be my business?

Record the ads with screenshots and URLs, report them to the platform, and report the scam to the FTC or your national fraud authority. Warn customers on your website and social channels, and check that your email domain has SPF, DKIM and DMARC set up.

Does this affect businesses outside the US?

The FTC's rule applies to conduct affecting US consumers. Platforms often apply policies globally, so stricter advertiser checks could reach businesses elsewhere. The UK is also introducing fraudulent advertising duties for large platforms under the Online Safety Act 2023.

FTC Weighs Rules on Scam Ads That Impersonate Businesses: What to Know