Payments, scams and platform abuse
Deepfake scam ads get paid somewhere. Is it through your merchants?
A deepfake celebrity sells a fake supplement or crypto scheme, the landing page takes a card, and the money settles through a merchant account that looked clean at onboarding. The ad platform sees an ad and the issuer sees a dispute weeks later. The acquirer, which the card schemes expect to monitor its merchants, often sees nothing, because its monitoring starts from the website on file, not from the ad.
Built for Acquirers, PSPs (payment service providers, the firms that let merchants take card payments), payment facilitators and card-scheme-facing risk teams; Head of Merchant Risk, Head of Acquiring Risk
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
86.8%
of scam ads reported by Poland's national CERT that Meta declined to remove
pymnts.com, 2026-08
€250 million
EU penalty Poland asked regulators to impose on Meta over scam advertisements it failed to remove
pymnts.com, 2026-08
150
more than 150 BBB reports about LipoMax, one deepfake-advertised weight-loss supplement, in recent months
wgem.com, 2026-08
What you get
The deliverables
You get a one-off sweep that traces live scam ads to the merchants processing them, with the statement descriptor, checkout domain, acquirer where visible, ad IDs, a funnel recording and the receipt for each finding.
A sweep of live scam ads
Scam ads running in your agreed markets, followed from the ad to the payment page.
Merchant matches
For each finding: the statement descriptor (the merchant name that appears on the cardholder's bank statement), the checkout domain and, where visible, the acquirer. Your team maps these to its own merchant IDs.
Evidence for every finding
The ad IDs, a recording of the funnel and the receipt from a minimal test purchase, made with Riskernel's own card in a way your team approves in scope, so your risk team can check and use each one before acting.
A short readout
What was found, which merchants are linked, and where your monitoring did not see it.
How it runs
2 to 3 weeks, start to finish
2 to 3 weeks
Scope
Agree the markets, scam types and the portfolio to check.
Sweep
Live scam ads are followed to checkout and recorded with the payment descriptor and domain each one shows. Your team matches those to its own merchant accounts.
Findings and readout
Each finding is delivered with its evidence, followed by a readout with your merchant risk team.
Consent. The sweep uses only public ads and Riskernel's own test purchases. Your written consent covers the scope: which markets and portfolio to check, how test purchases are made, and who receives the findings. Nothing is sent to anyone outside that scope.
Method
How the answer is produced
Start from the ad
The trace begins with the ad a victim actually saw, not the website you approved, because scam funnels are built to hide from onboarding reviews and crawlers.
Every finding carries proof
Ad IDs, a funnel recording and the receipt from a minimal test purchase (made with Riskernel's own card in a way your team approves in scope) come with each match, so nothing has to be taken on trust.
Works beside your monitoring
It does not replace your merchant monitoring. It answers one question: which scam ads running today are paid for through your portfolio.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on US 12,124,933 B2 (Artificial intelligence system for anomaly detection in transaction data sets, filed at NICE Actimize; granted).
A related idea: it covers learning a pattern across institutions while each keeps its own data, which is the kind of view needed to see a scam funnel that spreads its merchants across several acquirers. The trace is not an implementation of the patent.
View on Google PatentsAmir is a named inventor on US 12,541,721 B2 (Method for extreme class imbalance within fraud detection, filed at NICE Actimize; granted).
A related idea: scam merchants are a tiny share of a portfolio, and this patent addresses building fraud models when the bad cases are that rare. The trace is not an implementation of the patent.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- Health, beauty or generic retail merchants get many not recognised disputes.
- Transactions arrive from checkout domains other than the one you approved at onboarding.
- Low first charges are followed weeks later by larger recurring charges on a merchant registered as a one-off retailer.
- Your monitoring crawls the registered website, not the path from an ad to checkout.
- You have had a card-scheme notice about a merchant you thought was low risk.
Questions
Before you reach out
Do you need access to our systems?
No. The sweep works only from public ads and minimal test purchases. No one at your company or your merchants is contacted and none of your systems are accessed. Your team maps the descriptors and domains to its own merchant IDs.
Won't the ad platforms remove these ads?
Not reliably. In one test by Poland's national CERT, most reported scam ads were not removed. And taking down an ad does not by itself close the merchant account behind it.
How do we know a finding is real?
Each one comes with the ad IDs, a recording of the funnel and the purchase receipt, so your team can verify it before acting.
Is this ongoing monitoring?
No. It is a one-off sweep. Scope and markets are agreed on a short call.
Who should see the results?
Merchant risk and acquiring risk, and whoever handles scheme programmes such as Visa's Integrity Risk Program and Mastercard's BRAM (Business Risk Assessment and Mitigation, its programme for merchants selling illegal or brand-damaging goods).
Scope Scam-Merchant Trace with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.