Investigation: what the links in 398 investment scam ads give away

Updated on November 7, 2026 · 6 min read

In short: when someone clicks an ad, the link usually carries data from the campaign that created it. We analysed 398 distinct links from fraudulent investment ads in 24 countries. Many show the name the advertiser gave the campaign: the celebrity, the country, the age of the audience and the date. 13% are copies of earlier campaigns, and when the name includes a date, the ad is usually less than three days old.

What we looked at

Every time we record an ad, we save its link. Of the 705 detections made between 26 October and 5 November 2026, 398 links are distinct and all of them carry tracking parameters. This is the data that appears after the “?” sign in a web address.

Advertisers use them to find out which ad works. They do the same job in a legitimate ad. What is interesting here is that many scammers leave their internal names in plain sight. 238 links contain names written by a person or readable automatic labels. 130 contain random 10-character codes that say nothing.

We did not use any link to access accounts or systems. We also do not publish identifiers, because they add nothing for the reader.

The celebrity is a line in the spreadsheet

In 23 links, the campaign name includes the person being impersonated. They follow formats like these, from which we have removed the codes:

For whoever runs the campaign, the celebrity is one more variable, just like the country. They change it, test it and compare. Nearly a hundred links also carry the country code, which confirms what we saw in the same platform with a different celebrity in each country.

They choose the age

Some names state the chosen audience: 25+, 30+, 35+, 45+, 32-65, 38-65, 40-64 and 55-65. We found this 37 times, and none includes anyone under 25.

It is a small sample, because most campaigns do not put this in the name. But it points to what you would expect: they are after adults with savings, not just anyone.

Ads only hours old

In 51 links, the name carries a date we can compare with the day we saw the ad. In 42 of them, the difference is two days or less. The median is one day.

This needs reading with care: the advertiser sets that date, and it may not be the publication date. But it fits with everything else we see. These ads are very recent when they reach people, so no warning list will have them yet.

Copy and start again

52 links (13%) carry copy markers: “Copy”, “Clone” or the Russian equivalent, “Копия”. In six, the marker appears twice, which means they are copies of copies.

This is the mark the ad tool leaves when a campaign is duplicated. Duplicating is normal in advertising, and on its own it does not prove the original ad was blocked. But it shows production-line work: a campaign is cloned, one detail is changed and it goes out again. That is why taking down one specific ad achieves little if the account stays active.

Russian labels in 16 countries

43 links (11%) contain Cyrillic text, and they appear in 16 countries, from Italy to Japan and Ghana. They are spread across 26 platforms.

In 15 links it is the automatic label the ad tool creates when it is set to Russian: “Новое объявление с целью “Лиды””, meaning “New ad with the objective “Leads””. Others are handwritten notes, with words such as “ручной таргет” (manual targeting) or “каталог” (catalogue).

We are not the only ones to have seen this. In March 2026, Bitdefender published an analysis of 310 campaigns on Meta with the same terms, including “Копия”, “крео” and “ручка”, jargon from the affiliate industry.

This only shows that some of the people buying these ads use the tool in Russian. It says nothing about anyone’s nationality or about who runs the scam. Most links carry no Cyrillic, and we found several very different naming styles: this does not look like a single team, but like many ad buyers with their own ways of working.

What they are after: your phone number

When the name states the campaign objective, the most common is “Leads” or “Лиды”, potential customers (31 links), followed by “Sales” or “Purchase” (17). In other words: the ad sells nothing, it gets a contact. What is being paid for is your completed form. Then the calls start.

25 links also carry fields typical of affiliate programmes, such as an offer or affiliate ID. That suggests part of the traffic is bought by third parties who are paid per contact.

Two names, one campaign

The most useful data for tracking the network is repeated codes. A single campaign should not advertise two different platforms, and yet:

• Garantésure and Fonds Thesorelle share campaign codes, in France.
• PoundLedgerix and Prizantment share a campaign and a tracking pixel, in the UK.
• Immediate Growth and Senvix share an unusual campaign name.
• Halal Trade AI and WIN Token share a tracking pixel, in the UAE and Saudi Arabia.

This is stronger evidence than sharing celebrities: the same ad account promotes two names. It is another reason why the name matters little.

Where they appear

196 links state where on Facebook the ad was shown:

One in four appeared on Marketplace, a place people go to buy things and where they may be less alert. Bear in mind that these figures only reflect the ads we record, not everything that is published.

What this means for you

1. Not appearing on any list means nothing. These ads may be a day old. Check whether the company is authorised, not whether it has a warning against it: how to check a broker.
2. You were not chosen by chance. The ad targets a specific country and age, with the celebrity they have tested on that audience. Feeling that it is close to home is part of the design.
3. An ad on Marketplace or in your feed has not been reviewed by anyone who vouches for the investment.
4. If you leave your phone number, you have already done what they wanted. If this has happened to you, follow the victim guide.

Limitations of this investigation

• We only see the ads we record in 24 countries over eleven days. It is not a random sample.
• The advertiser sets the campaign names. They may contain errors or be misleading.
• We interpret abbreviations we cannot always confirm. For example, we do not know for certain what “Cat” means.
• A single link can pass through several intermediaries, and we do not know who bought each ad.
• Identifying the language of a tool does not identify a person.