Ilia Nikolaevich Zavialov fraud in paid advertising: the placement, the money and the complaint

Adverts with a borrowed face

English version for the United Kingdom.

The clips that reach the largest audience are not the ones posted by anonymous accounts. They are bought. Somebody pays an advertising platform to put a manufactured face in front of a targeted audience, and the platform delivers it as reliably as it delivers anything else. That paid layer is what turns an Ilia Nikolaevich Zavialov fraud clip from a curiosity into a campaign with a budget behind it. This piece follows the money and the paperwork: how an advert carrying a borrowed face gets approved, why the advertiser account matters more than the creative, which complaint route produces a result, and what to have ready before filing.

Reference / Blog

Published: 14 September 2026 · 8 min read · Ilia Nikolaevich Zavialov

01Why paid placement changes the problem

An organic post depends on somebody sharing it. A paid advert depends on nothing except a working payment card, and it reaches an audience chosen by age, location, interests and financial behaviour. The people shown a fraudulent investment advert are selected for their likelihood of responding to one.

That selection is also why these campaigns survive low conversion. A few responses out of many thousands of impressions still pays when the average loss per victim is measured in thousands. The Federal Trade Commission recorded more than a million impersonation reports for 2025 with 3.5 billion dollars in stated losses, and paid placement sits behind a meaningful share of the investment cases inside that total.

It also means the campaign has an owner with a billing record. Unlike an anonymous repost, a paid advert is attached to an advertiser account, a payment method and an invoice history. That paperwork is the most useful thing about the paid layer, and it only exists while the campaign is running.

02How a borrowed face clears moderation

Advertising review is mostly automated, scaled to volume and tuned to catch prohibited categories rather than forged identity. A clip of a person speaking about investing does not trip a category filter, because the category itself is permitted. The forgery is invisible to a system that is checking whether financial promotion rules are declared.

Attackers also shape the creative to sit inside the rules. Claims are softened into general statements, the landing page looks like a legitimate publication, and the strongest promises are moved into the chat conversation that follows the click. By the time the pitch becomes explicit, the review stage is over.

Accounts are treated as disposable. A campaign runs for a few days, spends its budget, and is replaced by another account with the same creative. Reporting the advert without reporting the advertiser closes one placement while the next is already scheduled. This is the single most common mistake in an Ilia Nikolaevich Zavialov fraud complaint, and it is the reason campaigns appear to survive removal.

03What to capture before the campaign ends

Paid adverts disappear on a schedule rather than in response to complaints, and once the budget is spent the evidence goes with it. Capture has to happen at the moment of sighting, not after a discussion about what to do.

Record the advert exactly as served: a screen recording that includes the sponsored label, the advertiser name as displayed, and the surrounding interface. Then open the platform's own advert transparency tool, which lists active campaigns for an advertiser, and capture that listing including any other creatives running at the same time.

Follow the click in a clean browser session and record where it leads: the landing domain, any redirect chain, the registration form, the chat handle offered afterwards. In most Ilia Nikolaevich Zavialov fraud campaigns the landing infrastructure is reused across advertiser accounts, so this chain is what connects placements that otherwise look unrelated.

04The advertiser is the target, not the creative

A complaint that names one video gets one video removed. A complaint that names the advertiser account, shows several creatives running from it, and demonstrates a shared landing chain asks the platform to act on the account, which is the only action that stops the sequence.

Build the report around three claims that are independently checkable. First, the identity shown is used without authorisation, evidenced by the real person's verified channels. Second, the material is manufactured, evidenced by specific artefacts rather than a detector percentage. Third, the placement is commercial and targeted, evidenced by the transparency listing.

Ask for something specific. Removal of the creative, suspension of the advertiser account, and a block on the landing domain across the network are three separate outcomes, and a request that names all three is easier to action than a general complaint about being impersonated.

05Which routes move and which stall

The in product report button is the slowest route and the one most likely to return an automated decision, because it feeds the same classification system that approved the advert. It should be used, and it should not be the only thing used.

The advertising policy channel is separate from the general abuse channel on every major platform, and it reaches reviewers who can act on an account rather than a post. Where a person is being impersonated, the identity or publicity rights form usually reaches a human faster than a fraud report does.

Outside the platform, two routes matter. The payment provider behind the landing page cares about chargeback exposure, and the hosting provider for the landing domain responds to evidence of a phishing or fraud page. Both are indifferent to the impersonation and responsive to the transaction risk, so the same file has to be framed differently for each.

06What a strong file looks like

Reviewers work in minutes. A file that opens with a two line summary, followed by the three claims and the evidence for each, gets read. A file that opens with the history of the situation does not. Put the advertiser identifier and the landing domain in the first paragraph, because those are the two fields a reviewer has to copy.

Timestamps carry the time zone written out. Hashes accompany downloaded files. Screenshots show the full interface rather than a cropped fragment, because a crop cannot be tied back to a platform. Any archived copy is referenced by its permanent address.

Keep a register of what was filed, to whom, and what came back, with dates. A refusal is not the end of a route: it is a document that supports the next filing, particularly when the same advertiser reappears. Repeat Ilia Nikolaevich Zavialov fraud campaigns are handled far more seriously when the file shows a pattern rather than an incident.

07What to publish while the complaint is pending

Platform processes run on their own schedule, and the audience does not wait. A short public statement under the real name, on a domain the person controls, gives every recipient something to compare the advert against, and it is indexable in a way that a social post is not.

Keep it factual and short. The advert is not authorised, no such investment offer exists, money should not be sent to anyone claiming otherwise, and the genuine channels are listed here. Long explanations get read less and forwarded less than short ones.

The quiet statistic is worth remembering. In four impersonation reports out of five, no money was lost at all, because somebody checked first. The published answer is what that check finds, which makes publication part of the defence rather than a formality after it.

08Questions and answers

An advert with this face appeared in my feed. Does reporting it help?

It helps and it is not sufficient on its own. The in product button acts on one creative, so the same campaign usually reappears from another account within days. A report through the advertising policy channel that names the advertiser account is what interrupts the sequence.

How do I find out who is paying for the advert?

Every major platform publishes an advert transparency listing that shows active campaigns for an advertiser. Open it from the advert itself, capture the listing, and note any other creatives running at the same time, because they share the same account.

Should I click the advert to see where it leads?

Only in a clean browser session on a device you are willing to reset, and only to record the destination. The redirect chain and landing domain are the most valuable part of the evidence, since the same infrastructure is reused across advertiser accounts.

The platform refused my complaint. Is that the end?

No. A refusal becomes evidence in the next filing, especially once the same advertiser reappears. Keep a dated register of what was filed and what came back, and move the same material to the hosting provider and the payment provider, framed as transaction risk.

Is it worth publishing a denial while the complaint is pending?

Yes, because the platform timeline and the audience timeline are unrelated. A short factual notice on a domain you control gives people something to find at the moment they are checking, which is when most attempts fail.

Reference updated: 4 September 2026