The Account You Trusted Sold The Click

HBO Max's Reddit account was compromised this week and used to run ad fraud campaigns, according to AdExchanger. That sentence should land harder in the advertising industry than it appears to have. This wasn't a fake account, a parody, or a spoofed handle designed to fool an inattentive scroller. It was the verified account. The one platforms sell to advertisers, agencies, and brand safety teams as proof that the entity behind the posts is who it says it is. That proof was worth nothing the moment someone else took the wheel.

The Badge Was The Product

Verification exists to answer one question: is this account controlled by the organisation it claims to represent? Platforms charge for that answer, build entire trust and safety narratives around it, and use it to justify premium ad placements and partnership programmes. The HBO Max Reddit compromise answers a different question that nobody in that sales pitch wanted asked: what happens after the badge is granted and nobody is watching the account anymore?

A verification check is a moment in time. It confirms identity at onboarding. It does not confirm ongoing custody. Once an account is compromised, the badge doesn't disappear, the follower count doesn't reset, and the algorithmic trust the account has built up over years doesn't evaporate. It just gets handed to whoever broke in, fully loaded with the credibility HBO Max spent years earning. Nobody's password policy failed here in some minor, forgivable way. The whole point of verification was to tell advertisers this account could be trusted, and for the length of that fraud campaign, it couldn't be, and nothing about the badge itself said so.

The Infrastructure Keeps Growing, The Guardrails Don't

The rest of this week's advertising news reads like an industry building more rooms onto a house without checking the locks on the ones it already has.

• Infillion acquired Foursquare, adding still more location data to an ad tech stack that already has plenty, per AdExchanger.
• Google is testing Discover topic overviews starting with videos, and a separate Dive Deeper feature, expanding the surfaces where users encounter branded content, according to Search Engine Journal and Search Engine Roundtable.
• Google is also adding local businesses to EEA search result units, per Search Engine Journal, pulling more verified business identities directly into the search interface.

Every one of these moves adds a new surface where a "verified" or "trusted" identity, whether a business listing, a location profile, or a branded account, gets treated as reliable by default. None of them come paired with reporting on how those identities get monitored once they're live. The HBO Max compromise didn't happen on some obscure corner of the internet. It happened on Reddit, a platform with verification programmes and enterprise brand partnerships, using an account that had presumably passed whatever checks Reddit requires. If that account can be turned into an ad fraud vehicle, there is no reason to assume the growing pile of location profiles, business listings, and Discover-surfaced content is any better defended.

Somebody Else Already Wrote The Accountability Document

Search Engine Journal reported this week that a school district produced an AI accountability document before any major technology platform did the equivalent for its own systems. Sit with that for a moment. An institution with a fraction of the engineering budget and none of the ad revenue of a platform like Reddit or Google got to formal accountability first. The organisations selling verification as a trust product, the ones with the most to lose when that trust collapses, are still behind.

This matters beyond the optics. An accountability document isn't a press release, it's a commitment to monitor, disclose, and correct. Verification programmes at scale need the same thing: not just a checkmark at signup, but an ongoing obligation to detect when a verified account starts behaving like it's been taken over. Ad fraud campaigns running from a hijacked, previously legitimate account should trip alarms fast. The fact that this reached the point of public reporting suggests those alarms either don't exist or aren't loud enough.

Trust Is Being Tested From Every Direction At Once

The HBO Max compromise wasn't the only brand trust story this week, and the other one makes a useful contrast. Adweek reported that Converse drew backlash over ads accused of evoking a lynching. That's a controversy of intent and judgement, a brand's own creative decision misfiring in public. The HBO Max case is the opposite: a brand did nothing wrong on the creative side and still lost control of its own channel. Put those two stories side by side and the message for advertisers is uncomfortable. Trust can be damaged by what a brand chooses to say, and it can be damaged by what someone else says while wearing the brand's verified identity, and platforms currently have a stronger answer for the first problem than the second.

What Verification Would Have To Become

None of this argues for abandoning verification. It argues for being honest about what it actually covers. A badge that only certifies identity at signup, with no ongoing monitoring commitment attached, is not a trust guarantee, it's a one-time credential check dressed up as one. Advertisers who built brand safety strategy around the presence of a checkmark got a live demonstration this week of exactly how much that checkmark protects them once someone else is holding the keys.

The fix isn't complicated to state, even if it's expensive to build: verification needs a maintenance obligation, not just an approval process. Platforms adding new surfaces, whether it's Discover overviews, EEA local business units, or the ever-growing location data pool that Infillion just bought its way further into, are all expanding the number of places a "verified" identity can be trusted by default. Every one of those places needs the same question asked of it that HBO Max's Reddit account just failed: not who was approved, but who is in control right now. Until platforms can answer that continuously rather than once, the badge is a snapshot, and advertisers are paying premium rates to trust a photograph.