How to Spot and Block Scam Comments on Ads

Scam comments on ads are fake replies left by fraudsters who impersonate your brand or promise rewards to lure your customers into phishing links and direct messages. To stop them, you filter for three signals that almost every scam shares: a handle that mimics your Page, urgent or too-good-to-be-true wording, and a link or DM request that pulls people off the platform.

The problem is bigger than most advertisers assume. Consumers reported losing $2.1 billion to social media scams in 2025, roughly eight times the losses recorded in 2020, according to FTC data reported by TechCrunch. A meaningful share of that starts in the comment sections of legitimate brand ads, where scammers borrow your credibility to reach a ready-made audience.

Anatomy of a scam comment

Most scam comments fall into three buckets. Learn to recognize them and you are halfway to filtering them out.

Fake support. The scammer replies to a customer complaint or question while posing as your help desk. You might see a comment like "We're sorry for the trouble, please DM our official support account to resolve this." The account looks close to yours, but the goal is to intercept your customer and run a refund or account-recovery con in private messages.

Giveaway bait. These comments announce that the reader has won something or been selected for a prize. "Congratulations, you are our 1000th customer, claim your reward here." The reward never exists. The link collects payment details or login credentials.

Phishing links. The most direct version simply drops a URL, often shortened or disguised, promising a discount, a tracking update, or a limited offer. One click leads to a spoofed checkout page or a credential-harvesting form.

The common thread is that every one of these tries to move your customer somewhere you cannot see: a fake profile, a shortened link, or a private DM thread. That off-platform pull is the tell.

Why scammers target high-traffic ad threads

Scammers are not choosing your ads at random. They follow attention, and paid social concentrates attention like almost nothing else. When you put budget behind a post, you are paying to gather a large, interested audience in one place. A scammer who replies to that thread reaches the same audience for free, riding on the trust you spent money to build.

High-traffic threads also give scammers cover. In a comment section with hundreds of replies, a single impersonation comment is easy to miss, both for your team and for the customer scrolling quickly. The busier the thread, the longer a scam can sit before anyone notices.

Meta is aware of the scale. The company says it removed 159 million scam ads in 2025 and took down more than 92% of them before anyone reported them, according to Meta's own newsroom. That enforcement is real, but it operates at the platform level and focuses on fraudulent ad accounts and large scam networks. Comment-level impersonation on legitimate brand ads slips through that net far more often, which is exactly why it lands on your Page. If you want to understand how much this quiet drain costs, our breakdown of the hidden cost of spam comments on your ad spend puts numbers to it.

Red flags to filter automatically

You do not need to read every comment to catch scams. You need to teach a filter what a scam looks like. These are the signals that reliably separate fraud from genuine engagement.

• Lookalike handles. Watch for account names that copy your brand with a small twist: an extra period, a swapped letter, "support" or "help" appended, or a zero standing in for an O. Legitimate replies from your team come from your verified Page, not a near-duplicate profile.
• Urgency and pressure. Phrases like "act now," "limited time," "your account will be suspended," or "claim within 24 hours" exist to short-circuit judgment. Real brands rarely rush customers in a public comment.
• External links. Any comment carrying a URL, especially a shortened one, deserves scrutiny. Most customer questions do not include links, so filtering comments that contain them removes a large share of scams at once.
• Reward and refund language. "You've won," "claim your prize," "DM to get your refund," and similar hooks are giveaway and support scams in plain sight.
• Off-platform DM requests. A push to move the conversation to a different account or app is the setup for the actual con.

None of these signals is perfect on its own. A loyal customer might share a link, and a real winner might see an urgent-sounding announcement. Combined, though, they form a pattern that automated rules catch with high accuracy.

A real example: the refund impersonation

Here is a scenario that plays out daily on DTC ad threads. A customer comments on your Facebook ad: "I ordered two weeks ago and still no tracking, what's going on?" Within minutes, a reply appears under it from an account named something like "YourBrand.Support.Team," using your logo as its profile picture.

The reply reads: "We sincerely apologize for the delay. To process your refund immediately, please DM this account with your order number and payment details."

To the frustrated customer, this looks like help arriving fast. They message the fake account, hand over their order number, and get walked through a "verification" step that captures card details or a one-time login code. Your brand never touched the transaction, but the customer will remember it as your failure, and they will say so publicly.

This single comment does three kinds of damage at once: it costs the customer money, it erodes trust in your brand, and it discourages other shoppers reading the thread. And you paid for the exposure that put those shoppers in front of it.

Step-by-step rules to catch scams before customers click

You can stop most of these comments the moment they post. Here is a practical rule set to build, whether you configure it in a moderation tool or adapt it to your own workflow.

1. Hide comments containing external links by default. Genuine customer questions almost never include URLs. Auto-hiding link comments removes the single most common phishing vector. If your business relies on customers sharing links, whitelist your own domains and review the rest.
2. Flag lookalike handles. Build a rule that watches for your brand name combined with words like "support," "help," "team," "official," or "service" coming from any account that is not your verified Page. These are near-certain impersonation attempts.
3. Filter urgency and reward keywords. Add terms such as "claim," "winner," "congratulations," "prize," "refund," "verify," and "suspended" to a watch list. Comments combining these with a link or DM request should hide automatically.
4. Catch off-platform DM pushes. Any comment instructing readers to message a separate account is a strong scam signal, especially when paired with refund or reward language.
5. Set rules per Page and per campaign. A giveaway campaign needs different keyword thresholds than an evergreen product ad. Tuning rules to each context keeps false positives low while still catching the obvious fraud.
6. Review the hidden queue, not the live thread. Instead of scanning every comment as it lands, let the rules hide suspects and spend a few minutes reviewing what got caught. This flips your workflow from reactive monitoring to quick confirmation.

The advantage of hiding over deleting is subtle but useful: on Facebook and Instagram, a hidden comment stays visible to its author and their friends, so the scammer usually does not realize it was removed and does not simply repost from a fresh angle.

The one thing that matters most: speed

A scam comment does its damage in the window between when it posts and when it disappears. Remove it in seconds and no customer ever sees it. Leave it for an hour on a high-traffic ad and dozens of people may click before you act. Manual monitoring cannot cover that window around the clock, which is the entire case for automated, real-time filtering.

This is where a tool like Sweep Inbox earns its place. Built on Meta's official Graph API and webhooks with no scraping involved, it watches every connected Page and hides spam, scam, and impersonation comments within a few seconds of them appearing, across more than 50 languages, without anyone staring at a screen. The rules above run automatically, day and night, so your comment sections stay clean while your ads keep working.

Start by auditing one of your busiest ad threads today. Look for the three signals: lookalike handles, urgency, and links. If you find even one scam comment sitting there, that is your proof that customers are being exposed right now, and your cue to put automated rules in place so the next scam gets swept away the second it appears.