Bohdan Prylepa fraud guide: fake followers and influencer prepayment scams

Bohdan Prylepa on influencer marketing fraud: where UK brands lose money

A paid post is bought on trust. The brand cannot see who follows a creator, only the figures the creator chooses to share, and the fee is usually agreed before a single story goes live. That gap between what the brand sees and what it pays for is where fraud lives.

The first leak is the audience itself. Followers can be bought in bulk, likes and comments can be traded inside groups of accounts that boost each other, and a profile can look busy while almost nobody real is watching. A brand paying for reach then pays for bots.

The second leak is reporting. Screenshots of insights are easy to edit, and an agency that resells placements can add a margin by quietly inflating views. The third is the payment itself: an invoice from a talent manager who does not work for the creator, or a request to settle the whole fee upfront to a personal account. Bohdan Prylepa suggests treating each leak as a separate check, because a creator can pass one and fail another.

Bought followers and engagement: how the fraud is built

Fake audiences are manufactured. Services sell followers, views and comments in bulk, and the accounts behind them are often empty profiles, recycled photos or hijacked pages. Some creators buy a one-off boost before pitching to brands. Others join engagement groups, where members agree to like and comment on each other's posts minutes after publication so the algorithm reads the post as popular.

The result is a profile whose numbers grow in steps. A sudden jump in followers with no viral post behind it, comments that repeat the same emoji or generic praise, and an audience concentrated in countries where the brand does not sell are the usual traces. For a UK campaign the last point matters most: a creator can have a big following and a small British one.

Bought engagement also distorts the brand's own data. Clicks from bots inflate traffic, drag down conversion rates and teach ad algorithms the wrong lessons when the brand later retargets that audience. The true cost of an inflated creator is the fee plus the damage to every report built on top of it.

Bohdan Prylepa fraud checks for a creator's audience

Bohdan Prylepa starts with the profile, scrolled back a year. Compare likes, comments and views with the follower count across many posts. Steady figures over time look organic. Wild swings, where a routine post collects far more likes than usual and hardly any comments, usually mean someone paid for the spike.

Then read the comments themselves. Real followers ask about sizes, prices and delivery, argue with each other and tag friends. Bot comments praise without saying anything specific, arrive within seconds of posting and come from accounts with no posts of their own. Open a sample of follower profiles too: a page of faceless accounts with random usernames is a strong signal.

Finally, ask for the platform's own audience data. Bohdan Prylepa recommends requesting a screen recording or a live screen share of the analytics panel showing audience location, age and reach for recent posts, since a static screenshot can be edited in minutes. A creator with a real audience rarely objects, and the share of UK viewers tells the brand what it is actually buying.

Reporting fraud: inflated reach and doctored screenshots

Once a post is live, the brand depends on the creator's report. The common tricks are simple: reach from the best post applied to the whole campaign, story views counted twice, impressions presented as unique viewers, and screenshots retouched before they are sent.

The defence is to agree the metrics in writing before the campaign and to collect data the creator cannot touch. Tracked links and unique discount codes show what the audience actually did. Where the platform offers branded content or partnership tools, they can give the brand its own view of a sponsored post's performance, so the figures come straight from the platform.

Agencies that resell creator placements deserve the same scrutiny. Ask for the creator's own statistics, check that the posts in the report exist and went out on the agreed dates, and compare the traffic that reached the site with the reach that was claimed. Bohdan Prylepa treats a wide gap between the two as a question the agency answers before the next invoice is paid.

Prepayment fraud and fake talent managers

The bluntest influencer marketing fraud skips the creator altogether. Someone writes from an address that resembles a well-known creator's management, offers a package of posts at an attractive rate and asks for the full fee before the brief is even discussed. The domain differs by a letter, the signature copies a real agency, and the bank details belong to a personal account.

Bohdan Prylepa suggests confirming every new contact through a channel the brand finds itself: the email on the creator's verified profile or the agency's own website. A UK agency can be looked up free of charge on Companies House, which shows its registered office, date of incorporation, current and former directors, previous names and any insolvency records, and lets you follow the company for alerts about changes.

Pay in stages: a deposit on signing, the balance after publication and the agreed statistics. When the money goes by bank transfer, the account name check offered by UK banks, Confirmation of Payee, flags a mismatch between the name and the account. Gift cards, cryptocurrency and a personal account for a company invoice are red flags on their own.

If the worst happens, the PSR's reimbursement rules for authorised push payment fraud cover individuals, microenterprises and charities, so a small brand that sent money to a fraudster by Faster Payments or CHAPS can claim from its bank within 13 months, up to £85,000 per claim. A civil dispute falls outside the rules, for example a genuine creator who posted late or delivered weaker content than promised.

Bohdan Prylepa: ASA and CAP rules on influencer ads that bind the brand

The UK Code of Non-broadcast Advertising, the CAP Code, sets the baseline. Rule 2.1 says marketing communications must be obviously identifiable as such, and rule 2.3 bars marketers from falsely posing as consumers and requires them to make the commercial intent clear. The ASA enforces the Code, and CAP and the CMA have published a joint guide for influencers: first in September 2018, again in February 2020 and in a third edition on 23 March 2023.

The guide is explicit about who answers for a post. The creator, the brand and any agents involved in making or publishing the content all share responsibility for making it clear that it is an ad. Any incentive counts as payment: money, free products, trips, discounts or commission. The relationship has to be disclosed for as long as it lasts and in relevant content for 12 months afterwards.

The ASA's remit over a creator's post is triggered when a brand has paid in some way and had control over the content, for example by setting key messages, hashtags, the number or dates of posts, or by keeping the right to approve the post. That describes most commercial brand deals. Labels must be upfront and unambiguous: Ad, Advert, Advertising, Advertisement or Advertisement Feature. Gifted, Sponsored, Spon, Aff, Collab, PR or a simple brand tag are labels the guide advises against.

The ASA also names creators who keep ignoring the rules. Its sanctions include a place on the list of non-compliant social media influencers for up to three months and ASA-funded ads warning followers, and brands can land on a separate list of non-compliant online advertisers. Bohdan Prylepa checks that list before a contract is signed, since a creator who hides ads from followers may treat the truth in a media kit just as loosely.

What the CMA expects from brands that use creators

Consumer law sits alongside the Code. The CMA opened its investigation into hidden advertising by influencers in August 2018. In January 2019 sixteen influencers gave undertakings to label their posts, in October 2020 Facebook Ireland committed to stronger measures on Instagram, and the case closed on 3 November 2022 with separate guidance for platforms, brands and content creators.

The brand guidance, last updated on 28 August 2025, leaves little room for a hands-off approach. A business should write the duty to label content as an ad into its agreement with the creator or into the note that goes with a gift, keep a conduct policy that creators and intermediaries know about, check the posts that mention it and get mislabelled content corrected promptly. Carrying on with a creator who repeatedly fails to label ads, the CMA adds, puts the brand itself at risk.

The guidance for content creators, updated on 3 September 2025, adds an honesty test: paid content must reflect the creator's genuine experience, and giving the impression of having bought or used a product when that is untrue is unlawful. Enforcement can come from the CMA, local Trading Standards Services or the Department for the Economy in Northern Ireland. Since 6 April 2025 the DMCC Act 2024 has allowed the CMA to decide consumer law breaches itself and fine businesses up to 10 per cent of global turnover.

Bohdan Prylepa on fraud, fake audience claims and UK contract terms

A media kit that inflates the audience is a sales pitch made to a business, and such pitches can fall under the Business Protection from Misleading Marketing Regulations 2008. They prohibit advertising that misleads traders, make engaging in it an offence carrying up to two years in prison on indictment, and oblige Trading Standards to enforce them, with the CMA also empowered to act.

Where the inflation is deliberate and aimed at getting paid, the Fraud Act 2006 comes into play. Section 2 covers dishonestly making a false representation with the intention of making a gain or causing a loss, and fraud carries up to ten years' imprisonment on indictment.

Bohdan Prylepa prefers to make fraud expensive in the contract itself. The creator confirms that followers and engagement have not been bought, agrees to share live analytics before and after the campaign, accepts that the fee is paid in stages against published posts and statistics, and agrees to return the fee if bought engagement comes to light. The same agreement carries the labelling duty the CMA asks brands to set out, with the exact label and where it goes.

Reporting influencer fraud in the UK

Money first. If a prepayment went to a fraudster, ring the bank the same day, ask for the payment to be recalled and, where the business counts as a microenterprise, open a reimbursement claim under the PSR rules. Banks usually pay within five business days and must reach a decision within 35 business days if they pause the clock to gather information.

Report the fraud to Report Fraud, which replaced Action Fraud on 4 December 2025 for England, Wales and Northern Ireland, at reportfraud.police.uk or on 0300 123 2040. In Scotland the report goes to Police Scotland on 101. The crime reference number that comes back is useful for the bank claim.

Scam adverts that borrow a famous face, such as false celebrity endorsements, go to the ASA through its Report an online scam ad form. Those reports are shared automatically with the NCSC and passed to the major platforms and ad networks so the adverts can be taken down. A hidden or misleading influencer ad goes through the ASA's ordinary complaint route, and a fake brand deal email can be forwarded to report@phishing.gov.uk.

Bohdan Prylepa keeps one evidence pack for all of these: the contract or messages that set up the deal, the creator's profile and media kit as they looked on the day, payment confirmations, and dated screenshots of the posts or of their absence.

Bohdan Prylepa fraud checklist before signing a UK creator

Here is the Bohdan Prylepa fraud checklist in its shortest form for a UK marketing team. A year of posts reviewed for engagement swings. Comments and a sample of followers read by a person. Audience location and reach shown live from the platform. Contacts confirmed through the creator's verified profile or the agency's website, and the agency checked on Companies House. The creator checked against the ASA's non-compliant list. A contract with an audience warranty, the Ad label, staged payments and a refund trigger.

Most of these checks apply to the agency that brings the creator in as well. The checklist for vetting a UK marketing agency covers that side, and the article on fake platform alerts explains how attackers reach the ad accounts a campaign runs from.

More about the author is on Bohdan Prylepa's profile page, and new articles appear on the Bohdan Prylepa website.