Executive Summary
- The European Commission commissioned a 2025 study on online financial fraud in the DSA context.
- The study, carried out by Open Evidence and Spark Legal and Policy Consulting, classifies fraud types into six categories.
- Platform features such as advertising systems, recommendation algorithms, private messaging functions, account manipulation and generative AI are named as exploitation vectors.
- Countermeasures are grouped into four categories: access restrictions, detection/removal measures, user-focused measures and platform policy/cooperation.
What happened?
Facts: The European Commission commissioned a 2025 study on the prevalence and countering of online financial fraud in the DSA context. The investigation was conducted by Open Evidence and Spark Legal and Policy Consulting. It maps six broad fraud categories: investment scams, romance scams, e‑commerce scams, employment and collaboration scams, unexpected‑gain scams, and disaster‑relief scams. The study furthermore identifies a range of platform features exploited by fraudsters, including advertising systems, recommendation algorithms, monetization systems, app‑store content, private messaging functions, inauthentic identities, misleading commercial content and generative AI. The study also notes that organized criminal networks sell tools and services that lower the barrier to entry for fraud activities. It lists four categories of countermeasures and explicitly states that it does not assess the compliance of Very Large Online Platforms (VLOPs) and Very Large Search Engines (VLOSEs) with the DSA.
Context: The study provides a systematic stock‑take of the phenomenon within the DSA framework and summarizes technical and organizational attack surfaces as well as possible intervention points. As an EU‑commissioned report, it is primarily oriented toward supervision and regulation and thus serves as a basis for policy and supervisory decisions.
Why does it matter?
Facts: According to the study, investment scams and romance scams are the most common and fastest‑growing fraud types in Europe. The investigation shows that fraud methods increasingly overlap and platform mechanisms are deliberately abused. It also finds that access barriers are reduced by a market for fraud tools.
Context: For decision‑makers, the study signals that fraud risk is not limited to single services but operates across platforms and is becoming further professionalized through automated and commercialized attack methods. The mention of generative AI as a used feature indicates that technological developments create new attack surfaces affecting both security teams and compliance departments.
What does this mean for mid-sized companies?
Facts: The study lists concrete countermeasures, grouped into access and gatekeeping (e.g. Know‑Your‑Business‑Customer / identity requirements), detection and removal (automated and manual review processes), user‑oriented measures (reporting tools, information on legal remedies) as well as platform policy and cooperation with third parties.
Context: For mid‑sized companies this implies several action areas: exposure to risk when using platform services and advertising, potential threats from fake business partners or manipulated content, and the need for processes for reporting and response. The study itself does not evaluate the extent to which large platforms meet DSA requirements, which can leave uncertainty about practical implementation. Decision‑makers at mid‑sized companies should factor this uncertainty into their risk assessments and review which platform features are most relevant to their business.
Related: AI Readiness Check
Recommendation from Future AI Solutions
Future AI Solutions recommends the following pragmatic steps:
- Inventory: Identify which platform features (advertising, recommendation algorithms, private messaging, app integrations) affect your business model and customer communications.
- KYC and supply‑chain checks: Implement or review existing Know‑Your‑Business processes for partners, advertisers and third‑party providers.
- Reporting and response processes: Establish clear internal reporting channels for suspected cases and define escalation paths to platforms and legal counsel.
- Employee awareness training: Sensitize sales, HR and marketing teams to common fraud patterns (e.g. romance or investment scams, fake job offers) and how to spot them in platform environments.
- Assess technical measures: Evaluate market‑standard detection tools and automation for spotting suspicious content or accounts; combine automated detection with human review.
- Cooperate with platforms: Document cases and use platform reporting channels; consider contractual arrangements with key platform partners on security and response standards.
These recommendations are intended as practical starting points. For concrete implementation we recommend reviewing the study in full and obtaining tailored advice to align measures with company size, sector and technical infrastructure.