“Verified identity”, misleading destination: how paid ads lead Argentine users to fake investments

From an ad to an offer: the scope of this case

A chat using Mercado Libre offers plans of 5, 10 and 20 million pesos and claims to be “verified by YPF”. A fake article imitating La Nación promises 450% on a minimum of 200,000 pesos after a “bond” payment. Another page uses the Balanz brand and requests a card number, holder, expiry date and security code to “deposit”. These are the lures' promises and requests, not returns or payments verified by the investigation.

I documented those paths from one phone on September 30 and October 1, 2026, Argentina time. Almost all began with advertising marked “Sponsored”, in a browser, Gmail Promotions or native-ad networks. The observed Google ads carried an advertiser-identity verification label.

The useful distinction is between the advertiser's declared identity and the legitimacy of the destination offer. The label did not establish that the returns, branding or forms were genuine.

CASHCLOAK LATAM is the tracking label for this work, not an actor name or proof that the paths belong to one gang. The full report and its evidence limits separate observations, assessments and what was not established.

Five observations with different limits

Advertisers declared in six countries

The sample includes the United Kingdom, Cyprus, the Netherlands, Ukraine, Australia and Brazil as declared advertiser countries, with ads directed at Argentine users. Those fields describe what was shown about the advertiser. They do not locate a site's operator or prove the payer controlled the destination. A traffic-buying market is an assessment, not an individual attribution.

The displayed address and opened page can differ

A women's fashion ad, with an advertiser declared in Ukraine, led to lunarbutton[.]site, a fake investment article imitating La Nación. The jump is consistent with redirection or cloaking. The user-side observation did not determine which mechanism produced it.

The same brand appears in several lures

Mercado Libre was the most repeated brand in this sample: a fake article with chat, the “personal manager” at epicharvest[.]info and a “Mercado Pago CFD” offer. That recurrence describes the paths observed, not all Argentine fraud. Shared branding does not establish a shared operator.

Collecting a phone number can be the objective

The “Mercado Pago CFD” path goes through falcon-press[.]com and says “an investment executive will call you”. The assessment of investment-call-center lead collection has moderate confidence. The visible message and its interpretation do not establish who calls, from where, or what payment eventually occurs.

The impersonation form requests a complete card

app.balanztrading[.]com displayed Balanz branding with “PCI-DSS compliant” and 3-D Secure seals. The investigation identifies impersonation, not Balanz participation. The data request is part of the documented risk; the displayed seals were not validated as certifications, and actual card theft or charges were not confirmed.

An “ANSES Loans Guide” landing page showed topical material without requesting sensitive information. It remains context, not phishing. Google, banks and brands are not attributed participation merely because they appear in these paths. I did not establish a common operator.

Using the findings without exceeding the evidence

For readers and users

The case recommends checking the actual destination before submitting information, rather than treating a brand, seal or declared advertiser identity as proof of an offer. Guaranteed returns, a “bond” and card requests on an impersonation site are the signals described here. Do not visit the campaign domains or fill in their forms to check this note.

The prior version made an absolute claim about what no broker requests. This case documents an impersonation form; it does not verify every broker's practices or certify PCI-DSS compliance. The advice here is grounded in the observed destination and context, not that generalization.

For fraud teams, SOCs and CTI

The report proposes correlating indicators with DNS/proxy records and subsequent transactions, and examining complaints for phrases such as “bond”, “personal manager”, “verified by YPF” or “an executive will call”. They are contextual leads, not standalone proof of fraud in any transaction.

The public CSV distinguishes three BLOCK and four HUNT indicators. Their historical labels are retained: HUNT supports investigation, not a blocking order. It includes descubre.upmegaconectnotification[.]click and its parent domain; I do not describe that destination's content. Indicator validity is not updated here and still requires operational validation.

Method and sample limits

The observation was passive: ads shown on the phone, “My Ad Center” information and pages opened by tapping them. I retain the original screenshots and the SHA-256 hashes recorded in the investigation evidence archive, and I separate observed claims, confidence-rated assessments and what I could not establish. Those materials belong to the original collection and should not be read as a later measurement.

One phone and two days document particular paths. They do not measure incidence, losses, affected people or regional frequency. Advertiser countries do not become victim countries. Before publication, I notified the findings to incident response teams in the region and to the impersonated brands.

Report, indicators and downloadable version

The public report develops six verticals, evidence limits, MITRE ATT&CK and recommendations by role. Use the case documents, not campaign destinations, for further reading.

Read the full CASHCLOAK LATAM report.

Download the indicators (CSV): seven domains with context, three BLOCK and four HUNT, all defanged ([.]). Do not visit them.

Download the full report (PDF · 15 pages): all 16 sections of the report, with tables, indicators, MITRE ATT&CK, method and citation.

The PDF and CSV retain their historical versions and this page does not modify them; each download should be cited with its own date and version.