“I saw the ad on Facebook. It had the bank’s logo. It had the CEO’s face. It looked real.”

It usually does. By the time someone walks into your office with that story, the money has moved, often more than once. The ad may already be gone, as may the website it linked to.

But gone from view isn’t necessarily gone. Nobody can buy advertising without filling out (mostly digital) paperwork. The scammer did some homework on your client. Now it’s our turn to do some homework on the scam.

Why should I care? Isn’t this a consumer-protection problem?

It’s a consumer-protection problem that turns into litigation. The FTC reports about $3.5 billion lost to imposter scams in 2025, out of $15.9 billion in reported fraud losses. Social media is a leading way these scams first reach people. These scams are a form of social engineering, otherwise known as “human hacking.”

In September 2026, the FTC announced it was considering whether to extend its Impersonation Rule or take other action addressing platforms’ ad-targeting and optimization practices. It’s an early inquiry, and there’s no proposed rule text yet. Where that lands legally is for the lawyers, not computer geeks like me.

For me, the question is simpler: What survived, and where is it?

So what does the evidence trail look like?

Human nature persists and there has always someone interesting in profiting from the unwary. The tools are just different these days. The con artist used to need a storefront and a good suit. Or at least a convincing classified ad in a newspaper. Now an online ad account and a cloned website can reach thousands of potential victims.

Targeting records. Advertisers can select audiences by location, age, interests, and other characteristics. Platforms also use automated systems to decide who sees an ad. Those records can show why a particular retiree received a fake investment offer. Public ad libraries provide limited information; the platform may hold considerably more.

Payment records. Ads cost money, and that money came from somewhere. It might be a stolen credit card or a compromised business account. The name on the payment method could belong to another victim rather than the scammer.

Platform accounts. When was the account created? Who were the administrators? Login histories, IP addresses, and linked accounts may help establish who controlled an advertising campaign. A business page created last Tuesday and renamed twice tells a different story from a ten-year-old account, although neither proves who’s behind the keyboard.

Cloned websites. Fake banking and investment sites tend to carry leftovers from the original: analytics identifiers, file paths, copied images. Domain registration, hosting records, certificate transparency logs (crt.sh is a good place to start), and the Wayback Machine can pin down when a site appeared and how it was connected to others.

A cloned website is a forgery, and forgeries sometimes leave fingerprints in the margins.

Cryptocurrency transfers. Some scams finish with instructions to move funds into a supposedly safe wallet. It is amazing how many people follow these instructions, and it’s easy to judge when it’s not you. But in the heat of the moment, a particularly convincing set of interactions can get you to push the button and make the transaction. Like the candy at the checkout counter, it’s an impulse buy, and the scam is designed to keep you in the checkout line.

On transparent blockchains, investigators can follow transactions through multiple addresses. And by the way, “untraceable” crypto can turn out to be traceable. It’s just tedious. Records from exchanges may help identify account holders. But following the money and identifying who controls it are two different jobs.

Isn’t all that locked up inside the platform?

Some of it, yes. Some may be sitting on your client’s phone.

Browser history or the link they clicked, tracking codes and all. Screenshots, texts, emails, the wallet app. Roll them all together, and they might just establish what your client encountered and what happened next. They also point to which records to request elsewhere.

And they’re vulnerable. A frustrated or frightened client deletes the messages, clears the browser, or replaces the phone, and just like that, your starting point has disappeared.

Getting records from platforms can be complicated, particularly in civil litigation. The Stored Communications Act restricts certain disclosures, and content and non-content records raise different legal questions.

My job is to find what exists, tell you, and get it preserved before it doesn’t.

What about the defense side?

The trail cuts both ways.

Suppose your client’s name, credit card, or business page appears in the advertising records. Does that establish participation in the fraud? Hardly. Stolen identities and compromised accounts are all too common.

Login histories, payment records, and device evidence can separate the account’s owner from whoever was at the controls during the scam.

The evidence is the evidence, whichever side is asking.

So, what should happen first?

• Preserve the client’s devices and relevant accounts. Arrange an appropriate forensic acquisition before anyone cleans things up.
• Capture the advertisement and website immediately, including URLs, ad-library records if they’re available, and dated page captures.
• Send preservation requests early. Platforms, hosting providers, registrars, and exchanges all have retention windows, and they aren’t waiting for you.
• Trace cryptocurrency while the trail is warm. The longer funds sit, the more hops they take.
• Verify who controlled an account before settling on whose name is on it.

Scam ads are built to find people fast. The evidence they leave behind fades more slowly than most people assume, as long as someone goes looking before the retention clocks run out.

Have you had an impersonation-fraud matter where the platform or payment records changed the direction of the case? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.