Deepfake Scam Ads Get Paid Somewhere. Is It Through Your Merchants?

A deepfake video of a well-known doctor or TV presenter recommends a supplement, or a "trading platform" a celebrity supposedly backs. This is not hypothetical: in August 2026 the Better Business Bureau warned of deepfake videos of celebrities and medical professionals selling a weight-loss supplement on Facebook and Instagram. The ad runs on a social platform, the landing page collects a card, and the money settles through a merchant account that passed onboarding without trouble. The platform sees an ad. The issuer sees a dispute weeks later. The acquirer, which is the party the card schemes hold responsible, often sees nothing at all.

This article is for acquirers, payment facilitators and their risk teams.

Why the acquirer carries this

The card schemes put responsibility for merchant behaviour on the acquiring side. Visa's Integrity Risk Program requires that merchants in high-risk categories be registered by their acquirer, with heightened due diligence, and Visa describes the programme as a set of controls designed to deter, detect and remediate illegal activity from entering its payment system. Mastercard's Business Risk Assessment and Mitigation (BRAM) programme works on the same principle: it targets illegal or brand-damaging processing and holds the acquiring bank responsible, with fines that the acquirer may pass on to the merchant.

Scam-ad funnels are built to sit outside those controls. The merchant account is opened for something ordinary, often a generic health or e-commerce store, under a merchant category code that does not trigger high-risk registration. The scam only appears when you follow a real ad, through a real funnel, to the payment page.

That leaves a specific ownership gap. The ad platform's trust team owns the ad. The issuer's dispute team owns the cardholder's complaint. The acquirer's merchant risk team owns the merchant, but works from onboarding files, website crawls and chargeback ratios, none of which start from the ad. Unless someone deliberately joins those three views, the merchant that is actually being paid stays invisible until a scheme notice arrives.

Why platform takedowns do not close the gap

It is tempting to assume the ad platforms will remove the ads before money moves. The evidence says not reliably. Poland's national CERT reported 122 advertisements it judged fraudulent to Meta through the ordinary reporting route. According to the account of that test, ten were removed, 106 were declined and six received no response, and Poland asked the European Commission to fine Meta EUR 250 million. CERT's methodology is not public and a refusal is not proof an ad was unlawful, but the direction is clear: ads stay up long enough to take payments.

Even when an ad does come down, the merchant account behind it usually stays open. A new creative goes live the next day, and the same merchant ID keeps settling.

How it fails in practice

• Onboarding was clean. The website reviewed at onboarding was a plausible store. The scam funnel is a different domain, cloaked so that reviewers and crawlers see a harmless page.
• The descriptor does not match the story. The customer bought "Dr X's joint formula". Their statement shows a generic store name. Disputes are coded as "not recognised", not as fraud tied to an ad.
• Subscriptions hide in small print. The first charge is a low trial price. The rebills, which drive the disputes, arrive weeks later, so chargeback ratios lag the harm.
• Load is spread. The same operator runs volume across several merchant accounts, sometimes across acquirers, so no single account crosses a monitoring threshold.
• Website monitoring looks at the wrong page. Crawling the registered URL tells you nothing about the ad-to-checkout path a victim actually took.

A self-check for your merchant portfolio

1. Search the ad libraries for your own descriptors. Public ad libraries, such as Meta's Ad Library, show many active ads, with coverage that varies by region. Look for celebrity names commonly used in supplement and investment scams in your markets, follow a sample to checkout, and see whose descriptors appear.
2. Read your "not recognised" disputes. Pull a month of disputes with that reason on health, beauty and generic retail merchants. Compare the product names in the merchant's own order records and in the dispute documentation with the store name. If they never match the store name, that is a signal.
3. Compare onboarding URL to checkout referrers. Where you have the data, check whether transactions for a merchant arrive from domains other than the one you approved.
4. Look for trial-then-rebill shapes. A cluster of low first charges followed by larger recurring charges 14 to 30 days later, on a merchant registered as a one-off retailer, deserves a look.
5. Link merchants by more than legal entity. Shared directors are easy to rotate. Shared bank accounts, support phone numbers, site templates and payment page code are harder to change.
6. Test your monitoring vendor with a known case. Give them a merchant you already know was running a scam funnel and see whether their crawl would have found it.

How Riskernel runs this as a fixed-scope assessment

The Scam-Merchant Trace is a one-off sweep. Riskernel traces live scam ads to the merchant accounts processing them. For each finding you get the merchant ID, the descriptor, the ad IDs, a recording of the funnel and the receipt from the purchase, so your risk team can verify every finding independently before acting on it.

It is designed to sit alongside your existing merchant monitoring, not replace it. It answers one narrow question with evidence: which of the scam ads running today are being paid for through your portfolio. Scope, markets and fees are agreed on a short call.