What brands don't see: how your ad spend becomes phishing revenue

A new product starts to go viral. Seventy-two hours later:

Impersonation ads appear in your brand’s search results. Customers click, believing it’s the official site, and land on a phishing site. Complaints flood your customer service team, and trust in the brand starts to slip.

That’s the moment your ad spend turns into revenue for a phishing operation.

This isn’t a story about a few unlucky brands. Right now, many brands’ ad budgets and customer traffic are leaking to ads and websites impersonating them.

How generative AI changed brand impersonation and phishing

Impersonating a brand used to take time and specialist skills. Generative AI changed that completely.

Fake domains, impersonator sites, brand ads and social accounts can now be created in bulk in minutes. Copying a brand costs less and happens much faster.

More than 1.4 million new phishing sites are created worldwide every month. According to the APWG (Anti-Phishing Working Group), more than 1 million phishing attacks were observed in Q1 2025 alone, the highest level in several years.

The FTC (Federal Trade Commission) reported that consumer fraud losses hit a record $15.9 billion in 2025. Losses tied to brand impersonation are estimated at about $3 billion of that.

This isn’t just a security incident. Between an impersonator site going up and coming down, your ad spend and customer traffic flow to the phishing operation.

Three ways brand ad spend ends up as phishing revenue

Brand impersonation and phishing spread across ads, search, social media and websites at the same time.

① Hijacked brand keywords: the moment ROAS collapses

Impersonators run phishing ads in your brand’s search results. Customers click, thinking it’s an official ad, and land on fake stores and phishing sites. Traffic from your own campaigns flows straight to impersonator sites.

CPCs rise and conversion falls. ROAS deteriorates quickly, and most marketing teams can’t see why. Global ad fraud losses in 2025 are estimated at about $41.4 billion, and some studies find that 14–22% of all ad clicks are fraudulent.

In effect, brand ad spend is turning into revenue for phishing operations instead of winning real customers.

② Slow response: fakes spread faster than brands can act

Phishing sites and impersonation ads have already spread by the time the brand notices. Phishing built with generative AI produces ads quickly, copies domains easily, and looks more and more like the real brand.

Most brands only discover the threat after customers report it. According to the FTC, losses to social media scams topped $2.1 billion in 2025, and many began with brand impersonation ads and phishing links.

Yet the industry’s average response time is still 2 to 8 days. Meanwhile ad traffic leaks away, customers are harmed and brand trust erodes. In the end, the victims remember the brand, not the criminals. This is also the window in which brand ad spend flows to phishing operations.

One MarqVision customer, global loungewear brand N, was losing about $250,000 (about KRW 370 million) in sales a week to phishing sites. Traffic and demand the brand had built itself were leaking to unofficial channels and turning into real lost sales.

Worse, even after the damage starts, response takes time. In that window, shoppers are scammed on impersonator sites and brand trust erodes fast. Shoppers end up remembering the brand, not the criminals, and the ad and marketing spend the brand invested ends up as the impersonators’ revenue.

③ Threats on every channel at once: blocking one domain doesn’t end it

Brand impersonation is no longer about a single site. Impersonator domains, phishing ads, disguised stores and fake social accounts are created and spread at the same time. Block one domain and new ads and sites take its place.

One report classified about 47.4% of all ad traffic in 2025 as fraudulent, a sharp increase from the year before. That is why brand protection can no longer rely on filing reports alone.

What brands need now is a response system that detects in real time, analyzes automatically and blocks quickly, all at once.

Why traditional brand protection can’t handle phishing and impersonation

Most traditional brand protection solutions were designed around marketplace counterfeits. But today’s impersonation threats appear across many channels at once: search ads, social ads, phishing domains and web content.

Manual response can’t keep pace with AI-driven impersonation. While people review, new ads are created, new domains are registered and new phishing sites are cloned.

As a result, brands face slow response, fragmented reporting, repeated false positives and rising legal review costs all at once. Traditional methods alone can’t stop ad spend from turning into phishing revenue.

Marq AI: real-time, AI-based response to brand impersonation

MarqVision connects every digital channel where a brand meets its customers into one response infrastructure. Marq AI detects, analyzes and blocks impersonator domains, phishing ads, web content and fake stores in real time.

It monitors ads, domains and web content based on brand keywords and impersonation signals, and classifies the type of threat by analyzing OCR, screenshots, domain patterns and ad data. It then blocks them quickly through response channels built on global platforms and partnerships.

Results so far:

• Average response time for impersonator domains: under 5 hours
• Average response time for phishing ads on brand keywords: under 12 hours
• AI decision accuracy: 99.8%
• Real detection and analysis data: more than 50,000 cases

That’s up to 37 times faster than the industry average. Find and block threats before your ad spend flows to phishing operations.

[Request a live demo]

See how exposed your brand is right now.

FAQ: where ad spend becomes phishing revenue

Q. How is brand impersonation different from ordinary phishing?

Ordinary phishing targets the public at large. Brand impersonation phishing copies a specific brand’s logo, domain and design to deceive consumers. Because the damage ties directly to brand trust, it’s a more serious threat for e-commerce and marketing teams.

Q. What damage do phishing ads on brand keywords cause?

When fake ads hijack brand keywords, CPCs rise and ad efficiency (ROAS) falls. Customers are sent to phishing sites, and brand ad spend becomes phishing revenue. The complaints and refund requests then land on the brand’s official customer service.

Q. How can we detect brand impersonation phishing early?

Most brands only become aware of threats after customers report harm. To act early, you need a system that automatically monitors search ads, websites and social channels around the clock, based on brand names, domains and ad keywords.

Q. How long does it take on average to respond to brand impersonation and phishing?

The industry average is about 2 to 8 days. MarqVision’s Marq AI supports response in an average of 5 hours for fake domains and under 12 hours for phishing ads, up to 37 times faster than the industry average.

This post is part 1 of our series “What brands don’t see.” Don’t miss the next installments, coming next week:

• Part 2. The moment unauthorized sellers take control of your pricing
• Part 3. Why marketplaces don’t stop counterfeits for you