The Federal Trade Commission (FTC) wants to stop impersonation scams. Fair enough. But calling a new regulatory venture an “update” doesn’t make it one, and spotting a real problem doesn’t tell you which rules—if any—will solve it. A little more homework would help.
On Sept. 24, the FTC announced an advance notice of proposed rulemaking (ANPRM)—an early step toward a possible rule change—which appeared in the Federal Register on Oct. 1. The announcement asked whether to “update its Rule on Impersonation of Government and Businesses or take other action to prevent online platforms from engaging in ad-optimization practices that may be furthering impersonation scams.”
That’s a potentially substantial shift—from policing fraudsters to holding platforms responsible for the scams they fail to prevent.
Spoiler alert: This should have been a request for information (RFI).
Yes, impersonation fraud is a thing, and no small problem. Yes, it’s within the FTC’s purview. And yes, Section 18 of the FTC Act grants the commission authority to issue rules addressing “unfair or deceptive acts or practices in or affecting commerce,” which Section 5 of the act prohibits.
Still, the ANPRM seems to me, at best, premature and ill-conceived. Before setting new obligations for platforms, the FTC should better understand the problem, the tradeoffs, and its own capacity to enforce the solution.
The Fraud Is Real and So Are the Hurdles
“They say” (or, eek, “many people are saying”) that the first step is recognizing that you have a problem. That may be right, although recognizing a problem is different from accurately diagnosing it. And diagnosis is different from deciding what to do next.
At any rate, the commission is right that online fraud is a problem. As the ANPRM notes, in its annual Protecting Older Consumers Report, the FTC estimated that “the true cost of fraud in 2024, adjusted to account for underreporting, may be as high as $195.9 billion.”
The report adds a qualification I didn’t see in the ANPRM: “these estimates are highly sensitive to assumptions about reporting rates for high-dollar loss frauds as these account for the lion’s share of all losses reported to Sentinel,” the FTC’s consumer reporting network. The report also offers “a very conservative estimate of $31.3 billion in overall fraud losses in 2024, with $10.1 billion lost by older adults.”
That’s a far cry from $195.9 billion, and neither estimate is confined to the types of fraud covered by the existing rule. Still, $31.3 billion is real money, even in Washington. I’m loath to suggest that government and business impersonation fraud are trivial in either frequency or magnitude—I don’t believe they are. Whatever we make of the Impersonation Rule, there’s a there there.
What’s more, fraud sits neatly within the FTC’s authority over unfair or deceptive acts or practices (UDAP). The FTC is quite right that Section 18 of the FTC Act authorizes it to issue UDAP regulations, subject to the limitations of Sections 18, 22, and 5(n). So far, so good, along with the FTC’s actions to enforce the rule against impersonation fraud.
And, to be fair, an ANPRM is a preliminary notice; it’s not a notice of proposed rulemaking (NPRM), much less a final rule. There are no concrete requirements yet on the table. The ANPRM raises some good questions, even if some seem to assume their answers.
The commission (OK, it’s an institution, but really just two dudes: Chairman Andrew Ferguson and Commissioner Mark Meador) is well aware of the hurdles it must clear. These include requirements imposed by the Administrative Procedure Act (APA) and Sections 5(n), 18, and 22 of the FTC Act.
Certain judicial decisions might also be top of mind for the commission, or at least somewhere in the stack: the 8th U.S. Circuit Court of Appeals’ decision in Custom Communications, the 5th U.S. Circuit Court of Appeals’ decision in National Automobile Association, and the Supreme Court’s decisions in, say, West Virginia v. EPA, Loper Bright v. Raimondo, and SEC v. Jarkesy, to name a few.
‘Update’ Is Doing a Lot of Work
Under consideration is no small “update.” The 2024 rule addresses fraudsters directly. It makes impersonating a government agency or official, a business, or a business’s officer, employee, or agent a violation of both the rule and Section 5 of the FTC Act.
The rule declares these practices “unfair or deceptive acts or practices,” in violation of Section 5’s UDAP prong. But the details suggest deception rather than unfairness. Its four specific prohibitions make it unlawful to “materially and falsely pose as” or “materially misrepresent . . . affiliation with” the covered government entities, businesses, or their representatives.
The question now is whether to hold platforms liable for failing to take adequate steps—as yet unspecified—to prevent or limit fraud by third parties. Whatever the answer, a federal regulation that meaningfully imposes such liability would be no mere “update” to the 2024 rule.
That framing may be neither here nor there when assessing the merits of any proposed rule that follows. But it might matter for the process—and for the basic question of what the commission should consider before adopting fundamentally new regulatory requirements.
Prescription for Regulatory Myopia
So what’s not to like? Funny you should ask. OK, I’m the one who asked, and maybe it wasn’t all that funny.
Congress established no mens rea requirement—a requirement to prove a culpable state of mind—for a Section 5 violation. But neither Congress nor the courts have suggested that animus innocens, or “innocent intent,” provides adequate grounds for a federal regulation. Good intentions alone don’t pave the road to regulatory heaven.
My overarching concern is that Chairman Ferguson has been right—if not original—to voice some general concerns about a regulatory approach:
Government regulation, and more precisely, government regulators, can also pose a formidable threat to an innovative, vibrant, and competitive economy. Even when well intentioned, regulations impose serious costs on economic productivity.
He followed with a catalog of concerns about entry, capital investment, and indirect effects, as well as anticompetitive rent seeking—incumbents’ efforts to secure government protection from competition. Those concerns recall, among others, James Buchanan and Gordon Tullock, Sam Peltzman, and George Stigler. Prior FTC chairs have voiced similar concerns, including Maureen Ohlhausen (here and here) and Tim Muris.
To be fair, when Ferguson said that “[i]f competition enforcers want to promote the conditions for an innovative, productive, and growing economy, they should not blind themselves to the potentially anticompetitive effects of regulation,” he was advocating ex post antitrust enforcement—addressing conduct after it occurs—over ex ante antitrust regulation, which sets rules in advance. FTC officials in earlier administrations made similar arguments.
But that doesn’t explain why these concerns wouldn’t apply equally to ex ante consumer-protection regulations, especially those that competition authorities issue and enforce in dynamic sectors of the economy.
Never mind an authority with a dual competition and consumer-protection mission, subject to Section 5(n) of the FTC Act. That provision stipulates that no act or practice may qualify as “unfair” under Sections 5 or 18 “unless the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”
More than that, the FTC’s institutional structure and allotted resources suit it to ex post enforcement. Its design leaves it poorly equipped to enforce ex ante regulations, and historically, it has struggled on that front.
Consider the central—and sensible—requirement of the FTC’s Contact Lens Rule (CLR), first adopted in 2004 and amended in 2020. The rule requires the release of prescriptions for corrective lenses. An eye doctor—an optometrist or ophthalmologist—who examines a patient and conducts a contact lens fitting must give the patient a portable copy of her prescription so she can shop around for the prescribed lenses.
For better or worse, I provided competition input to the FTC team that reviewed the 2004 rule and eventually drafted the 2020 amendments. Well over a decade after the rule’s adoption, staff saw evidence of widespread noncompliance. Yet by 2020, the FTC had brought zero enforcement actions alleging, much less showing, violations of the prescription-release requirement. To the best of my knowledge, the count remains zero.
The FTC has issued warning letters, with batches going out in 2016, 2020, 2023 (called “cease and desist” letters in that case), and 2025. I don’t mean to suggest those letters had no effect on their recipients. But letters to a couple dozen prescribers go only so far—perhaps not very—in establishing a credible threat of enforcement more broadly.
The CLR imposes relatively straightforward, low-cost requirements, but enforcing it isn’t easy. The FTC does, of course, enforce other rules. Still, regulations impose costs on regulators as well as on those they regulate. And for better or worse—maybe better—the commission is far from a well-oiled regulatory machine. Actual FTC rule enforcement often looks like case-by-case law enforcement, something the FTC is designed to do.
At one level, there’s an easy answer to whether the FTC should have adopted its Contact Lens Rule or, for example, its Children’s Online Privacy Protection Rule. Congress expressly charged the FTC with issuing those rules, addressing those issues, in those ways. For the Contact Lens Rule, that charge—and the prescription-release requirement—appears in the federal Fairness to Contact Lens Consumers Act. There’s no such charge behind this ANPRM.
Of course, none of this disputes the problem of impersonation fraud or rules out platform negligence. And it seems within the realm of possibility that well-tailored regulations can address demonstrated market failures without doing more harm than good.
It’s just that real challenges—both general and FTC-specific—stand between recognizing a problem and adopting and enforcing a rule that does more good than harm. A little “regulatory humility” can go a long way.
Four Cases, One Online Ad, Plenty of Extrapolation
The very different rule adopted in 2024 (16 CFR Part 461) has been in force for just over two years. Since then, the commission has brought four enforcement matters—all in 2025—under it. I haven’t done a deep dive, but I’ve read the complaints, and they do appear to involve bona fide fraud. So good on ’em as enforcers, as far as that goes.
But of the four complaints (Blackstone Legal, Click Profit, Panda Benefit Services, and Superior Services), only one says anything about online advertising, targeted or otherwise. In Click Profit, the FTC alleged that consumers typically first encounter the defendants’ advertisements on search engines, social media, and third-party websites, where deceptive claims lure them to Click Profit’s websites. In the other three, bad old-fashioned communications seem to be the fraudsters’ routes to their victims.
For example, in Blackstone Legal, the FTC alleged:
Defendants generally initiate contact with consumers by sending letters to consumers that contain consumers’ sensitive personal information and threaten damage to consumers’ credit scores. In some instances, however, Defendants initiate contact by placing telephone calls to consumers.
In Panda Benefit Services:
Defendants’ scheme relies heavily on false and misleading representations made by Defendants’ representatives to consumers, often made during an initial call between a telemarketer and a consumer. In many instances, Defendants use mailers delivered to consumers’ mailboxes to entice consumers to call them and speak to a telemarketer.
And in Superior Services, the FTC alleged that the fraud began “with the delivery of a mailer that, based on its contents and appearance, leads consumers to believe it has been sent by a government agency or a government-affiliated student-loan servicer.”
Mass mailings, telephone calls, etc. The question of how the fraudsters identified their targets remains. But nothing in those three complaints suggests that online platforms’ inadequate screening of targeted ads played a key role.
As for Click Profit, the complaint says little about what, if anything, the platforms or third-party websites should have done differently. That may be understandable given the nature of the 2024 rule, but it underscores the limits of the FTC’s enforcement experience in this area.
The point is not that Click Profit’s approach is unique. The FTC’s 2025 report, Protecting Older Consumers: 2024-2025, certainly suggests otherwise. It observes a sharp increase since 2020 in older adults’ reported losses to “fraud that started on social media”—a significant concern even though “reported median individual losses for phone fraud remained far higher.” The underlying data have limits, but nothing in the report—or elsewhere, as far as I know—indicates that such scams are infrequent or declining.
The report is useful and gives cause for concern. But it doesn’t examine the role of targeted advertising or the tools platforms use to mitigate fraud. And the commission’s recent, relatively limited enforcement experience with conduct that might fall under a major expansion—and reorientation—of the existing rule doesn’t get us much further.
An AMG Workaround or Too Clever by Half?
There are other nits to pick and threads to pull, and they may not all be trivial. But I’ll skip some to focus on the fraught—and flagged—matter of the AMG workaround.
In AMG Capital Management v. FTC, the Supreme Court held that Section 13(b) of the FTC Act did not “authorize the Commission to seek, and a court to award, equitable monetary relief such as restitution or disgorgement.” Those remedies return money to victims or strip wrongdoers of their gains. The decision limited the FTC’s ability to obtain monetary relief for first-time violations.
That was a bummer from an enforcement perspective, especially where monetary remedies, penalties, or damages would be most efficient, forcing wrongdoers to bear the costs of their wrongdoing.
But that barrier is part of the commission’s statutory design, not a drafting error or an eccentric reading by the Court. Not for nothing, AMG was a unanimous decision. And the limitation goes hand in hand with Section 5’s extraordinary breadth and generality. Its original prohibition covers “unfair methods of competition.” The 1938 Wheeler-Lea Act amendments added the prohibition of “unfair or deceptive acts or practices,” establishing the FTC’s basic consumer-protection authority.
After a breezy—one might say “conclusory”—identification of market failure, the ANPRM declares that a new rule could realign “incentives by subjecting Platforms to court-imposed monetary sanctions for their involvement in furthering those [fraudulent—or fraud-facilitating] ads.”
Indeed, it could do that, among other things. But statutory damages for knowing rule violations might or might not be efficient—or even roughly tethered to the costs of consumer harm. And the commission’s sunny observation could easily read as an attempt at a clever AMG workaround. If so, courts might think it too clever by half. (Note to self: some thoughts do not need to be shared; and some sharing shouldn’t be published in the federal register.)
Yes, the process is cumbersome. That’s part of the point—a point underscored by Sections 5(n), 18, and 22, and the judicial decisions mentioned above. Those provisions impose substantive and procedural limits on Magnuson-Moss rulemaking, the process the FTC uses to issue UDAP rules.
All of that counsels caution. At one level, I get it. Fraud is fraud. It’s widespread. It harms consumers—very directly, and sometimes catastrophically—and core fraud cases come with no procompetitive rationale. Combating fraud sits at the heart of the FTC’s UDAP authority and has driven many sound enforcement actions, under this administration and historically.
But while core fraud cases may avoid hard questions about tradeoffs—including those required by Section 5(n)—the regulations contemplated in the ANPRM raise those questions squarely.
Slow Your Regulatory Roll
It’s tradeoffs all the way down. The FTC’s ANPRM acknowledges them, noting that targeted advertising “capabilities benefit both businesses and consumers.” It also asks whether “the Platform UDAPs identified . . . have any benefits for businesses or consumers?”
Good, although I’d rewrite that question to tie it more directly to the tradeoffs. For one thing, the FTC hasn’t actually found UDAP violations caused by platforms’ inadequate or negligent filtering.
More than that, what tradeoffs would a regulation requiring . . . what, exactly? . . . create? Certain standards for platform tools to identify and suppress bad actors’ targeted ads? One-size-fits-all standards? Static or dynamic standards? These tradeoffs concern both ad quality—for advertisers and consumers—and the means of funding billions of dollars’ worth of content that consumers can access for free.
Of course, tradeoffs cut both ways. The benefits of targeted advertising don’t make the costs of fraud disappear. But those benefits are real, complex, and substantial.
Those benefits also warrant consideration alongside the FTC Act’s rulemaking restrictions, the case law, and the very messy history of FTC rulemaking. On that history, there’s this and this—among many other things—from the International Center for Law & Economics (ICLE).
There’s a substantial body of literature besides, including contributions from former FTC chairs Ohlhausen and Muris; Muris and Howard Beales, former director of the FTC’s Bureau of Consumer Protection; former Chairman William Kovacic and David Hyman; and administrative law scholar Richard Pierce.
None of this says “do nothing.” But most of it counsels caution. So maybe . . . slow your regulatory roll.
Research First. Rulemaking Second.
Yes, there’s a long road from an ANPRM to a final rule. Yes, this ANPRM recognizes some of the complex tradeoffs further regulation might entail. No, it doesn’t specify what the commission intends to adopt. Indeed, it asks whether further regulation is warranted: “Is there a need for new regulations to prevent Platform UDAPs”?
As I suggested above, this could have been an RFI. The ANPRM raises many important questions, even if some should have been posed differently. It’s not wrong to ask stakeholders, academics, and others for input and data.
But the commission has considerable research expertise at its disposal. Why not deploy it first to investigate these questions, report on what it learns, then issue a better-informed, more targeted ANPRM—if warranted?
There’s a lot to untangle, no doubt. But that’s the job of a research-based enforcement agency, and the commission and its staff are capable of doing it. An ANPRM should cite systematic, pertinent research heavily, speeches and newspaper articles sparingly.
A Case for Bringing Cases
I get it. Law enforcement can be cumbersome. But the FTC knows how to do it. Bringing sound UDAP cases—and litigating them to decisions on the merits—can address real harm and establish legal precedents.
Cases and their underlying investigations can also illustrate how Section 5 violations cause consumer harm under varied facts and circumstances. That, in turn, can inform firms, consumers, lawmakers, economic and policy research, and even regulation.
It’s not easy, but it’s at the core of the FTC’s statutory mission. And the commission can pursue it where it has good “reason to believe” it will be constructive, without the cumbersome checks Congress has placed on the agency’s consumer-protection rulemaking.
Fix the Rules for Making Rules
Perhaps regulatory humility—like charity—should start at home. In 2021, under Lina Khan’s leadership, the FTC adopted significant changes to its internal rules of practice. The commission adopted them on a party-line vote, over a vigorous dissent from Commissioners Christine Wilson and Noah Phillips, without any prior ANPRM or NPRM.
The changes came under the banner of streamlining—a way to turn “the page on decades of self-imposed red-tape and return to the participatory process for issuing Section 18 rules that Congress envisioned.”
Heck, much of it would involve overdue, largely routine updating and cleanup. You know, “conforming edits to make the rule language more gender-neutral; use active voice instead of passive voice; replace ambiguous uses of ‘shall’ with ‘may,’ ‘will,’ or ‘must’ as appropriate; make nonsubstantive grammatical changes; and add and standardize citations to the U.S. Code where appropriate.” How could anyone—much less sitting commissioners—object?
Well, Wilson and Phillips saw it differently:
The majority asserts that the revisions to Section 18 procedures are designed to “streamline” rulemaking and reduce “red tape.” (To be clear, the red tape in question helps avoid the ill-advised application of red tape to American businesses.) What the changes – adopted without public input – in fact do is fast-track regulation at the expense of public input, objectivity, and a full evidentiary record. We see no need for bulldozing procedural safeguards in our Section 18 rulemaking Rules of Practice and are concerned in particular that the reforms undercut the independence of those charged with conducting evidentiary hearings, limit valuable input from the public, and reverse decades of practice regarding agency transparency. (internal citations omitted)
They saw not-so-much streamlining as a “corruption of the fact finding process.” They had this wacky idea:
Better regulation—which is not the same as more regulation—ought to be the goal. By reducing transparency and objectivity in the rulemaking process, the revisions to our Section 18 procedures move us away from that goal and toward more—and worse—regulation.
The dissent is a tight, well-reasoned six-page document. I commend it to you. Not incidentally, I agree with every line—rare for me, but that’s on me, and it’s a welcome novelty.
This commission has been more attentive to process than the last. That’s a good thing. Enforcers don’t tend to welcome constraints, but I suspect Ferguson might share many of Wilson’s and Phillips’ concerns.
My proposed first step toward amending FTC regulations is to rescind the 2021 changes to the rules of practice. No Magnuson-Moss restrictions stand in the way. Easy peasy.
The post Fraud, Platforms, and the Art of Getting Ahead of Yourself appeared first on Truth on the Market.
