A single generative AI tool can now churn out thousands of convincing scam adverts in minutes, at virtually no cost. Ofcom has decided that the platforms profiting from those adverts must bear the burden of stopping them.

The regulator's new draft code on fraudulent advertising, published alongside its register of categorised services under the Online Safety Act 2023, proposes nearly 40 practical measures that will force the UK's largest platforms to verify advertisers, stress-test their AI tools, and embed anti-fraud governance at board level. 

The register of categorised services lists the larger platforms which must have in place greater levels of transparency and accountability, empower users with more choice and control, and protect users from fraudulent advertising. Larger services may fall under Category 1, 2A or 2B, and Category 1 and 2A services must take steps to prevent fraudulent advertising appearing on their platforms.

What are categorised services?

Category 1 are user-to-user services that have 34 million UK users and a content recommender system, or 7 million UK users, a content recommender system and the ability for users to share/forward content. 

Category 2A are search services, that is, search engine or a site or app with a search function that can pull results from a range of sources, with over 7 million UK users.

Code on fraudulent advertising

Ofcom has now published a draft code including the following measures, among others:

• Assessing risk and having robust governance processes: it is proposing that platforms 
  should undertake a 'fraud indicator assessment' to assess how fraudulent advertising manifests on their service and what indicators suggest that individual advertisements and accounts pose a material risk of fraud. Ofcom says they should use these insights to more effectively apply mitigations to tackle this harm. Ofcom also proposes a suite of governance measures so that services' most senior governance bodies have oversight and proper accountability for compliance with their fraudulent advertising duties.
• Making it harder for fraudsters to access advertising accounts: Ofcom proposes a number of measures to help achieve this, including that platforms should:
  • Undertake robust checks when advertisers open accounts to check who they work for;
  • Check advertising accounts for indicators that they are likely to engage in fraud;
  • Carry out checks to make sure those advertising financial services products are legally permitted to do so;
  • Put in place robust security measures to stop bad actors from taking over legitimate 
    advertisers' accounts; and
  • Ban advertisers that post fraudulent advertisements and prevent them from returning 
    to the service.
• Robust testing of AI tools: the use of generative AI has significantly reduced the friction 
  and cost associated with producing fraudulent advertisements. To address this, Ofcom is 
  proposing that platforms that make AI ad generation tools available to advertisers, 
  product-test these tools to identify vulnerabilities in them and take steps to address the 
  vulnerabilities they identify.
• Strengthening reporting functions: Ofcom says that effective reporting is crucial to capturing fraudulent advertising that has evaded detection by other means. Ofcom's proposals include that providers establish a dedicated reporting channel, which enables organisations with the requisite expertise to report fraudulent advertisements quickly and easily. It is also suggesting an ad library that has the principles, functionalities and information categories needed to enable experts to quickly identify fraudulent advertising, so it can be taken down. 

Ofcom also wants to see proactive technology used to filter out fraudulent ads at source, and will consult separately on detailed proposals in autumn this year alongside a broader package of new safety measures aimed at enhancing its online safety work.

The consultation ends on 2 October, and taking responses into account, Ofcom will set out its final decisions next year. 

Other rules for categorised services

As well as the proposals on fraudulent advertising, Ofcom has published a broader set of draft rules for categorised services including:

• Protecting news, journalism and content of democratic importance. The guidance aims to help safeguard news and journalism and give media organisations more influence when platforms seek to moderate or remove their content. Ofcom's measures also aim to make sure that sites and apps take more care with content that matters most in a democracy, like journalistic content and political debate.
• Giving adult users more control. The law already requires services to tackle illegal content, and to protect children from content that is harmful but not criminal. On top of this, Ofcom proposes that platforms offer adults tools to help keep suicide, self-harm, eating-disorder, hateful or abusive content out of their feeds. Alongside this, people must be given the choice to filter out content from, and prevent their own posts being seen by, accounts that haven't been verified. Ofcom hopes that this will help guard against distressing and disturbing content online.
• Being more accountable. Ofcom expects sites to have clear and accessible rules for users. Platforms should comply with such rules themselves, as well as providing easy and straightforward complaints procedures.

In addition, these platforms will face greater scrutiny by being required to publish a summary of their assessments of the risks of illegal content and harms to children on their services and be more transparent. The consultation on these measures also ends on 2 October, and Ofcom will issue its final decisions next year.