From fake bank ads to WhatsApp traps: Inside Israel’s online investment scams
Researchers identified 26,000 fraudulent advertisements on Meta platforms in October alone, documenting how impersonators use familiar names to build trust before soliciting investments.
A new study sheds light on the scale of investment-related scams on social media. According to research conducted by Stark Security, at least 26,000 advertisements classified as financial fraud were posted on Facebook and Instagram during October alone, originating from 1,005 different pages. That amounts to an average of 843 new ads a day, most of them promising investors and savers extraordinary returns or purported gifts from banks. To attract users, many of the advertisements exploited the names, logos or likenesses of well-known institutions and individuals to establish a false sense of trust.
Stark Security specializes in detecting online impersonation by scanning Meta’s Ad Library. The company was founded by Daniel Maman, formerly head of innovation at cybersecurity company CHEQ. According to the analysis, on 24 of the 31 days in October, more than 1,000 fraudulent ads were active simultaneously. On the peak day, the number reached 2,900.
This is the first examination of its kind in the Israeli market, making it impossible to determine from these findings alone whether the number of fraudulent advertisements is increasing. However, data presented by Bank Leumi in a NIS 26.6 million lawsuit filed against Meta in August suggest that the problem may be worsening. The bank said it identified 243 fraudulent advertisements impersonating the institution in July alone, more than the total number it detected throughout the first half of the year.
In its lawsuit, Leumi alleges that Meta facilitates the paid promotion of advertisements impersonating the bank and its affiliates. It is seeking measures to prevent such ads and require the verification of advertisers’ identities. The case has yet to be resolved.
The problem extends beyond Israel. According to the U.S. Federal Trade Commission (FTC), reported losses from scams originating on social media reached $2.1 billion in 2025, an eightfold increase from 2020. Investment scams accounted for $1.1 billion of that total. Facebook was the platform associated with the highest reported losses.
The U.S. figures, however, measure financial losses from all types of social media scams, rather than the number of deceptive advertisements. They therefore cannot be directly compared with Stark Security’s findings in Israel.
The most frequently impersonated names
According to the analysis, the Tel Aviv Stock Exchange (TASE) was the most frequently impersonated institution, with its name or logo appearing in 4,846 advertisements published across 302 pages. Investment firm IBI ranked second, with 4,278 advertisements spread across 66 pages. Bank Leumi appeared in 1,340 ads, followed by Bank Hapoalim with 808.
Other institutions whose names or branding were exploited included Tel Aviv University, Meitav, Excellence, Mercantile Bank, First International Bank and Discount Bank.
Financial professionals and influencers were also frequent targets. Researchers estimate that the likeness of financial planner Dor Itai appeared in approximately 6,500 advertisements, or roughly a quarter of all the ads identified. Another 4,400 advertisements featured smaller-scale investment influencers.
Among the better-known figures whose identities were used were Gilad Altshuler, co-founder of Altshuler Shaham, whose likeness appeared in 466 ads, and financial content creator Micha Stokes, who appeared in 202. Economic journalist Shaul Amsterdamski was featured in 90 fraudulent advertisements, while author and financial blogger Tamir Mandowsky appeared in 40.
The classification system automatically identified impersonations of well-known institutions or individuals in approximately 46% of the advertisements. After manually reviewing the material, including cases involving lesser-known investment influencers, researchers estimated that impersonation was present in roughly two-thirds of all the ads.
From Facebook ads to WhatsApp groups
In 95% of the advertisements examined, users were presented with an investment opportunity. These included promises of insider information about stocks, exceptionally high returns or exclusive recommendations. The vast majority, 92%, directed users to a WhatsApp or Telegram group, or to a private conversation on one of those services.
The shift to private messaging channels moves the interaction away from Facebook or Instagram, giving fraudsters an opportunity to build relationships with potential victims over time and cultivate their trust.
One case study in the report describes a WhatsApp group called "One in a Million 150." Researchers joined the group after encountering an advertisement posing as an investor community associated with Bank Leumi. The group included an individual presenting himself as an investment expert named Warren Daniel, an "assistant" and dozens of other participants who researchers said were likely fictitious.
At first, the group shared market analyses and recommendations involving well-known stocks. Its administrators later began encouraging members to buy two small-cap companies listed on the Hong Kong Stock Exchange.
The pattern resembles a fraudulent scheme known as "pump and dump," or "ramp and dump," in which operators encourage investors to buy thinly traded shares while selling their own holdings at artificially inflated prices. The report does not establish that the group actually manipulated the stocks’ prices. It does, however, document how members were instructed to make purchases through their personal trading accounts and send screenshots confirming their transactions.
Last June, Calcalist reported on a case involving a young investor who put hundreds of thousands of shekels into NTCL, a Singapore-listed stock, after joining a WhatsApp group made up almost entirely of bots. The group persuaded her to invest, and she lost all her money shortly afterward. The loss was allegedly linked to the group’s founders taking a short position in the stock.
The study also examined whether fraudulent advertisements share identifiable warning signs. Researchers looked for four indicators: pages with fewer than 100 likes, promises of profit, suspicious website domain extensions, and discrepancies between the URL displayed in an advertisement and the actual destination to which it directs users.
According to the findings, 82% of the fraudulent advertisements displayed at least two of these warning signs, compared with just 2% of the legitimate ads examined for comparison. The researchers note that the same information is available to Meta, raising questions about the effectiveness of its oversight and enforcement mechanisms.
Meta could not be reached for comment. Yehuda Ben Yaakov, a policy manager at the company, has previously rejected claims by the Israel Securities Authority that Meta has a financial interest in allowing such scams to remain on its platforms.
"The existence of such ads completely undermines Meta’s business model," he said. Ben Yaakov added that the company had invested significant resources in combating fraud, noting that it removed more than 130 million fraudulent accounts globally during 2025.
He also announced that Meta had begun a pilot program for advertiser identity verification in Israel, with the aim of launching a full solution during the first half of 2026. The Stark Security findings, compiled months after the timeline he outlined, indicate that financial scams continue to be advertised on a large scale.
IBI said: "We are flattered that even the impostors choose IBI, though in this instance, we would gladly forgo the top spot. As part of our efforts to combat this phenomenon, we are working with Facebook and Instagram to identify and remove impersonating content. The fact that, according to the research, approximately 99% of the ads impersonating IBI were linked to a single fraud network highlights the need for a systemic approach and more effective enforcement by Meta. We expect Meta to leverage the data and technological tools at its disposal to proactively identify and block fraud networks, preventing them from returning to the platforms, rather than merely removing individual ads after they have already been published.
"Concurrently, we regularly issue warnings and updates to our clients to raise awareness regarding these scam attempts and how to identify them. We urge the investing public to verify the source of any information, ensure that any communication originates from an official company channel, refrain from sharing personal or financial details with suspicious parties, and report any suspected impersonation to us."
Tamir Mandowsky said: "The inaction of the authorities and Meta is simply unfathomable. Imagine a thief lurking in your yard, peering right through your children’s bedroom window, yet the police won't even answer the phone. That is exactly the situation here. For three years, accounts based in Hong Kong have been creating Hebrew-language profiles using my name and photo, something that would be very easy to identify and shut down, yet Meta shows no sign of wanting to put an end to this phenomenon. Israelis have already lost millions of shekels to this scam, and not a single government authority has taken responsibility, not the police, not the Securities Authority, and not the Capital Markets Authority. Meanwhile, in Hong Kong, they are raking in the dollars, because Israel has become a paradise for thieves."
