TL;DR: Lloyds Bank says 68% of reported customer fraud cases began on Facebook, Instagram, or WhatsApp, with victims sending around £66 million a year to scammers after engaging with scam adverts, according to SumSub’s reporting. The pattern shows consumer fraud now depends as much on platform exposure and ad abuse as on user error.
At a glance
What this is: This is a fraud-risk analysis showing that a large share of Lloyds Bank customer scams began on Meta-owned platforms, especially through scam adverts and marketplace-style lures.
Why it matters: It matters because identity and fraud teams need to govern the exposure path as well as the victim interaction, especially where platform trust, ad review, and account verification intersect.
By the numbers:
- 68% of customer fraud reports began on Facebook, Instagram, or WhatsApp, according to Lloyds Bank data cited by SumSub.
- Consumers were sending around £66 million a year to fraudsters after engaging with scam adverts on Meta platforms, according to Lloyds Bank data cited by SumSub.
Context
Fraud exposure on social platforms is not just a consumer awareness problem. When scam adverts, marketplace listings, and direct-message lures are allowed to reach users at scale, the control point shifts from the victim’s judgement to the platform’s detection, moderation, and reporting workflows.
In this case, Lloyds Bank’s fraud data suggests the exposure path itself is a major driver of loss. That makes platform-mediated fraud a governance issue for fraud teams, not merely a case-management issue after the payment has already left the account.
Key questions
Q: What breaks when scam adverts become the main fraud entry point?
A: Traditional fraud programmes break when they assume the critical control point is the payment system. If the scam begins on a social platform or marketplace, the exposure path happens earlier, before bank-side controls or customer warnings can intervene. Teams need visibility into listing provenance, advert abuse, and message patterns, not just transaction monitoring.
Q: Why do platform-based scams create higher fraud risk than ordinary spam?
A: Platform-based scams work because they inherit trust from familiar interfaces, social proof, and quick transaction flows. That combination makes victims more likely to engage and less likely to question the offer. The risk rises when the platform amplifies distribution faster than moderation, because the scam reaches many users before detection closes the route.
Q: What should fraud and identity teams do when scams start on social platforms?
A: They should treat the platform as part of the fraud control surface, not just the place where the scam was discovered. That means aligning detection, takedown, customer warnings, and step-up checks with the channels where victims first engage. If the control model only starts after login or payment initiation, it will miss the highest-risk stage of the attack.
Q: When should consumer fraud teams prioritise platform abuse monitoring over customer education?
A: Prioritise platform abuse monitoring when the majority of losses start before the customer reaches a payment or account-change step. Education still matters, but it cannot offset repeated exposure to convincing adverts, cloned listings, or fake seller profiles. When the entry channel is industrialised, reducing exposure usually beats relying on user vigilance alone.
Technical breakdown
How scam adverts turn platform trust into fraud conversion
Scam advertisers exploit the trust users place in familiar platforms, then move the victim off-platform or into a payment flow that looks legitimate enough to bypass suspicion. The technical problem is not just deception content. It is the combination of targeting, ad delivery, identity masking, and rapid content rotation that makes each advert hard to classify before it reaches enough users. Marketplace listings and social ads are particularly effective because they resemble ordinary consumer transactions. That creates a fraud path where the platform becomes the initial access layer for the scam.
Practical implication: fraud teams should treat platform-originated contact as an intake source for scam pattern analysis, not as a user-behaviour problem alone.
Why age-linked vulnerability changes fraud monitoring
The article shows younger adults, and especially under-25s in some scam categories, are disproportionately exposed. That matters because fraud controls often assume broad user susceptibility rather than segmented susceptibility by age, product type, and platform behaviour. Ticket scams, deposit scams, and marketplace fraud succeed through different psychological and transactional triggers, so a single warning banner or generic education campaign will not cover the full risk surface. Fraud monitoring therefore needs segmentation by scam type and by the audience that is most likely to engage with each lure.
Practical implication: refine detection, education, and intervention by scam type and audience segment instead of using one uniform fraud-prevention message.
Why scam volume and loss value now matter together
The article cites both the proportion of cases linked to Meta-owned platforms and the annual loss value associated with scam adverts. Those two measures are not interchangeable. Case volume tells you how often the exposure path works, while loss value tells you which scam formats are draining the most money once the victim engages. For governance, that means prioritisation should not be based only on report counts. High-volume low-value fraud and lower-volume high-value fraud require different controls, escalation thresholds, and bank-side intervention points.
Practical implication: prioritise controls by both incident frequency and monetary loss, because the most common scam is not always the most damaging.
Threat narrative
Attacker objective: The attacker’s objective is to convert platform trust into fraudulent payment or deposit transfers at scale.
- Entry occurs when victims encounter scam adverts, marketplace listings, or messages on Meta-owned platforms and engage with the lure.
- Credential or payment compromise follows when the victim is steered into a transaction, deposit, or identity handoff that legitimises the scammer’s request.
- Escalation happens when the scam is repeated across multiple victims or reshaped into new variants before moderation catches up.
- Impact is realised through direct financial loss, with victims sending money to fraudsters after the initial platform interaction.
Breaches seen in the wild
- New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
- Meta Muse Spark evaluation breach 2026: A misconfigured third-party cyber evaluation pointed Meta's Muse Spark 1.1 at a real website, which it exploited and modified.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Platform exposure has become part of the fraud control surface: The old model treated scam prevention as a victim education and payment monitoring problem. That assumption is too narrow when the most common entry point is a social platform that can distribute convincing fraud lures before any bank control sees the transaction. Practitioners should treat upstream exposure as part of the fraud lifecycle.
Ticket and marketplace fraud now behaves like an identity trust problem: Users are not simply fooled by content. They are persuaded by the apparent legitimacy of the listing, the seller profile, and the payment path. That makes account provenance, advert provenance, and transaction context central to fraud governance, not optional enrichment. Fraud teams should model trust signals explicitly.
Exposure reduction is now a measurable governance objective: The relevant question is no longer only how many fraud cases were detected after loss. It is how much fraudulent exposure the platform and its surrounding controls prevented from ever reaching a user. The more the attack depends on broad distribution, the more important pre-engagement filtering becomes.
Consumer fraud is converging with platform abuse management: Scam operations increasingly exploit ordinary consumer journeys rather than isolated malicious events. That means fraud, trust and safety, and identity verification functions need shared visibility over lures, profiles, adverts, and payment triggers. Practitioners should align fraud response with platform abuse monitoring, not keep them in separate silos.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
Platform-mediated fraud is now a governance problem, not a peripheral abuse issue: When fraud begins in the discovery layer, teams have to measure exposure before they measure loss. That changes the operating model for fraud, trust and safety, and identity verification functions that have historically worked after the fact.
Consumer scam defence needs a provenance model: The key question is not only whether a message or listing is fraudulent, but whether the offer can be trusted at source. Provenance checks, account reputation, and advert-review signals matter because scam conversion depends on believable origin stories.
Loss prevention and exposure prevention are different controls: Banks can recover only a fraction of what platform-mediated scams extract. If practitioners do not reduce the number of victims who ever engage, they will keep absorbing the same pattern through case handling and reimbursement.
For practitioners
- Map platform-originated fraud paths Trace how scam adverts, messages, and marketplace listings move a user from first contact to payment or deposit. Use that mapping to decide where platform filtering, bank intervention, or step-up verification can interrupt the scam before funds move.
- Segment fraud controls by lure type Separate ticket scams, marketplace scams, and rental or deposit scams in detection rules and customer warnings. Each category uses different language, urgency, and transaction patterns, so generic controls miss the behavioural cues that matter.
- Prioritise high-loss scam channels Rank fraud sources by both report volume and average loss. A channel that produces fewer cases can still justify stronger controls if the average claim value is materially higher than other categories.
- Strengthen provenance checks on user-generated offers Require stronger review or verification for accounts and adverts that present goods, services, or event access at short notice. Scam content often succeeds by borrowing ordinary marketplace cues that look routine until payment is requested.
Key takeaways
- The core risk is that scam adverts and platform listings now function as a primary fraud entry point rather than a secondary channel.
- The article points to two signals that matter for governance, the share of cases linked to Meta-owned platforms and the annual money lost after engagement.
- Fraud teams should shift from pure post-payment detection to exposure reduction, provenance checks, and channel-specific intervention.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Scam flows exploit ordinary consumer journeys and payment handoffs at scale. |
| Recommendation — Map high-risk consumer journeys to API6-style flow abuse and add stronger checks before payment or deposit completion. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraud prevention here depends on controlling who can create, distribute, or amplify abusive content and flows. |
| Recommendation — Apply PR.AA-05 to restrict abusive content creation and transaction-triggering paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Fraudsters rely on account creation, reuse, and rapid turnover to sustain scam distribution. |
| Recommendation — Use CIS-5 to tighten account lifecycle controls for high-risk and abuse-prone user populations. | ||
| MITRE ATT&CK | TA0006; TA0009 — Credential Access; Collection | The scam pattern depends on eliciting payment details or transactional value from victims. |
| Recommendation — Track fraud campaigns under TA0006 and TA0009 to improve detection of credential and payment-value harvesting. | ||
Key terms
- Platform-Mediated Fraud: Fraud that begins on a trusted digital platform and uses that environment to reach victims before they enter a bank, merchant, or identity-control boundary. The platform is part of the attack path, so moderation, provenance, and abuse-detection controls become fraud controls.
- Scam Advertising: Paid or promoted content designed to create fraudulent engagement, often by imitating legitimate offers, urgent opportunities, or marketplace listings. In practice, scam advertising converts platform reach into victim interaction, making content review and account trust signals central to prevention.
- Provenance Validation: A control approach that verifies where a payment, credential, or approval came from, who authorised it, and whether its path matches expected business logic. It is stronger than appearance-based review because it anchors trust in lineage and context, not visual similarity.
- Exposure Reduction: Exposure reduction is the measurable decline in unprotected or overly accessible sensitive data over time. It is the most practical indicator that discovery, access control, and remediation are working together, because it tracks whether the programme is shrinking risk rather than just identifying it.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org