A fake ad using a founder’s face is not just a stolen-photo problem. It can be the first step in an investment scam, phishing campaign, identity abuse or reputational crisis. The case of Polish entrepreneur Rafał Brzoska is useful outside Poland because it shows how difficult the problem can become even when the person targeted has legal resources, media visibility and direct access to regulators.
Brzoska has publicly made strong allegations about Meta’s handling of scam advertising, including claims that the company knows fraudulent campaigns are being bought and profits from the advertising inventory. Those statements must be treated as his allegations and public position, not as independently established facts. What is documented is substantial enough: Poland’s data protection authority ordered a temporary halt in 2024 to fake ads using his real data and likeness; a court refused to suspend that protective order; Meta withdrew its challenges in March 2025; and the issue returned to the public agenda in 2026 as regulators and government bodies addressed further scam advertising.
Why this matters to companies that are not famous
Scammers do not need a celebrity. They need trust. A local hotel owner, dentist, developer, restaurant founder or managing director may be recognisable to exactly the audience the fraudster wants to target. A photo from LinkedIn, a video from a conference and a company logo are enough raw material to create a convincing ad.
The campaign can look professional: a synthetic voice, a cloned face, a fake quote, a logo from a respected news outlet and a landing page designed to resemble a real newspaper or investment platform. The victim sees a familiar face and assumes that the offer has been endorsed. The business then faces two incidents at once: the fraud itself and a loss of confidence among customers who associate the scam with the genuine brand.
The Brzoska case in brief
2024: fake ads on Facebook and Instagram used Brzoska’s identity and likeness to promote supposed investment opportunities. Poland’s UODO described a deepfake implying that he had created a platform offering profits to citizens.
5 August 2024: the President of UODO issued an interim measure requiring Meta Platforms Ireland Limited to stop displaying specified fake ads using Brzoska’s real personal data in Poland for three months. A parallel measure concerned Omena Mensah.
December 2024: the Warsaw administrative court refused Meta’s request to suspend enforcement of the authority’s measures. This did not decide every legal issue in the dispute, but it meant the protective measure was not paused.
24 March 2025: UODO announced that Meta had withdrawn its complaints against the 2024 decisions.
2026: fraudulent ads again became a major public issue in Poland. Government authorities requested information from Meta on advertiser verification, response times and the scale of scam advertising. UODO reported further action after correspondence from Brzoska, while Poland’s CERT continued to warn about fake investment campaigns using public figures and AI-generated media.
The practical lesson is that there may be no single reporting form that closes the incident. A serious response combines evidence preservation, platform reporting, customer communication, cyber-security escalation and, where appropriate, legal and regulatory action.
How the scam typically works
A fraudulent ad borrows trust from a recognisable person or organisation. The click leads to a fake news page or investment site. The user is asked to leave contact details. A “consultant” then calls, often encouraging a small initial payment and showing fabricated profits. In more aggressive versions, victims are asked to install remote-access software or disclose banking credentials.
Deepfake technology makes the story more persuasive, but it is not required. A static image with a fabricated quote can work just as well. Brand monitoring therefore needs to cover display ads, fake profiles, lookalike domains, fake media pages and cloned landing pages — not only manipulated video.
Is a person’s image personal data?
Under the GDPR, personal data includes information relating to an identified or identifiable person. European data-protection guidance explicitly includes photographs, video and voice recordings when they allow a person to be identified. A useful distinction is that an ordinary photograph is not automatically special-category biometric data. It becomes biometric data in the GDPR sense when specific technical processing is used for unique identification or authentication.
For a company responding to impersonation, the practical point is that the same incident may involve several legal layers at once: personal data, image and personality rights, trademark or brand abuse, fraud and potentially criminal conduct. Do not reduce the whole problem to a single copyright-reporting workflow.
Who is responsible: the scammer or the platform?
The person or organisation running the fraudulent campaign is the direct actor behind the deception. Platform liability is a separate legal question and depends on the facts, the type of notice received, the platform’s knowledge and the regulatory framework. It is not accurate to state that every fraudulent ad automatically makes the platform criminally responsible for the advertiser’s conduct.
At the same time, online platforms in the EU have concrete obligations. The Digital Services Act requires accessible notice-and-action mechanisms for illegal content and provides routes to challenge moderation decisions. Data-protection law may provide a separate route where personal data is being processed unlawfully. The Brzoska case demonstrates that regulators can intervene when the facts justify it.
The first 24 hours: an operational response plan
- Preserve evidence before the campaign disappears. Capture screenshots and screen recordings showing the ad, account, landing page and full click path. Save URLs, timestamps, page or account IDs, phone numbers, forms, ad copy and any visible advertiser information.
- Avoid unsafe investigation. A suspicious landing page may contain malicious code or credential-stealing forms. Do not explore it casually from a company administrator account.
- Report the ad, account and landing page. Use the platform categories for fraud, impersonation, identity misuse or illegal content. Keep case numbers and copies of platform replies.
- Check the scale. Search variations of the founder’s name, company name, brand and campaign wording. Scammers often operate several accounts and domains at the same time.
- Warn customers if there is a credible risk. State clearly what your company does not offer, list official domains and accounts, and explain what people should do if they have submitted data or paid money.
- Escalate beyond the platform when needed. Personal-data misuse may justify a complaint to the relevant data-protection authority. Phishing or malicious domains should be reported to the relevant CERT/CSIRT. Suspected fraud, financial loss or identity crime may require police or prosecutorial reporting.
- Give one person ownership of the incident. Legal, marketing, IT and management should work from one evidence file and one approved public message.
Where to report in the EU and EEA
The platform: use the notice mechanism attached to the ad or profile and, where available, the DSA notice-and-action channel. Keep the decision and use the internal appeal process if the report is rejected.
Your national data-protection authority: if the incident involves unlawful use of identifiable images, voice or other personal data, consider a complaint to the authority responsible in your jurisdiction.
Police and cyber-security services: if money has been lost, credentials captured, malicious software installed or a fake domain is collecting data, treat the matter as more than a reputation issue. Contact the bank where relevant and use the national cybercrime / CERT reporting route.
Your national Digital Services Coordinator: under the DSA, each EU Member State has a coordinator responsible for platform compliance. Where a platform’s notice mechanism repeatedly fails or you believe DSA rights are being breached, the national coordinator may be relevant.
How to warn customers without amplifying the scam
A useful alert is factual and short. It does not reproduce the scam in full or link people to the fraudulent domain.
Example:
“We are aware of advertisements using the name and image of [person/company] without permission. We do not operate an investment platform and we do not collect payments through [fake domain]. Our official channels are [list]. If you submitted personal or banking data after seeing one of these ads, contact your bank and the appropriate local authorities. Suspicious materials can be sent to [address].”
Place the warning where customers will verify the story: your website, verified social profiles, newsroom and — where appropriate — your business profile in search. Avoid dramatic language that can create additional reach for the fraud.
What not to do
- Do not wait for the ad to disappear before preserving evidence.
- Do not assume one platform report resolves every duplicate campaign.
- Do not publicly accuse a named person or company of a crime without evidence.
- Do not publish victims’ data, bank details or alleged offender information without a legal basis.
- Do not let several departments issue conflicting public statements.
- Do not pay an unsolicited “reputation recovery” provider that appears immediately after your warning post.
Build the playbook before the incident
Brand protection should be treated like account security. Keep an authoritative list of domains, social profiles and administrators. Monitor search results, ad libraries, new profiles and lookalike domains. Use strong authentication and minimise the number of people with advertising-admin access.
Create a one-page incident playbook: who captures evidence, who reports the content, who speaks to legal counsel, who updates customers and who owns the case log. Prepare a warning-message template in advance. The goal is not to prevent every fake ad; it is to detect it earlier and respond without losing the first critical hours.
What businesses should learn from the Brzoska case
The scammer is borrowing trust that the real person or company spent years building. The stronger the reputation, the more valuable the likeness becomes as social-engineering material. That makes brand protection a business-continuity issue, not merely a social-media moderation task.
When your brand is impersonated, start with evidence, escalation and one clear message to customers. Reputation campaigns come later.
Evidence checklist
- Ad screenshot and screen recording.
- Direct URL and final landing-page URL.
- Profile/page name and ID.
- Date, time and country where the ad was seen.
- Copy, headline, CTA and phone number.
- Form fields and any confirmation screen.
- Copies of platform reports and responses.
- Customer messages reporting the scam.
Keep the original files in a controlled evidence folder. Do not edit screenshots beyond making a separate redacted copy for public communication.
Need help with brand protection, fake ads or impersonation?
FAQ
Is reporting the Facebook ad enough?
Not necessarily. Platform reporting is the first step, but personal-data abuse, phishing or financial fraud may also justify data-protection, cyber-security and police reporting.
Is every face image biometric data?
No. An identifiable photograph is personal data, but it is not automatically special-category biometric data. That depends on specific technical processing used for unique identification.
Should a company repost the fake ad publicly?
Only to the extent needed to warn customers. A cropped example plus clear instructions is usually safer than redistributing the full creative, link or scam contact details.
What if the platform rejects the report?
Keep the decision, appeal through the platform, use the appropriate DSA channel where applicable and escalate to the competent national authority if the situation justifies it.
This article is informational and does not constitute legal advice. Obtain jurisdiction-specific legal advice for a live dispute.