What we found
The Federal Trade Commission says it is sending more than $15.8 million to 2,124,796 customers of cash advance app company Cleo AI, after a March 2025 complaint alleging the company advertised access to "hundreds of dollars" in cash advances when almost no one received even close to the advertised amounts. The FTC also alleged Cleo AI charged hidden fees for same-day or instant advances that often would not arrive until the next day, and made subscriptions hard to cancel. According to the agency, eligible consumers will receive an email up to October 26, 2026, PayPal payments begin October 27, 2026, and recipients should redeem within 30 days. The press release names one point of contact for payment questions — refund administrator Rust Consulting, Inc., at 877-788-4958 — and directs consumers to the FTC website for refund FAQs. The FTC states that it never requires people to pay money or provide account information to receive a payment, and that it will never demand money, make threats, tell you to transfer money, or promise you a prize. If a message about this refund asks you to pay a fee, confirm bank or card details, or move money to release the payment, stop and ring the refund administrator number listed on the FTC's own site rather than any number, link or reply address in the message. Our harvested material is a single FTC press release; it does not report anyone impersonating this refund programme, and we hold no complaint data showing that such contact has occurred. The source does not describe how the genuine notification emails are worded or what sender address they come from, so we cannot tell readers what a real notice looks like. LIVEFRAUD ALERTS is independent and not affiliated with the Federal Trade Commission, Cleo AI, Rust Consulting, Inc. or PayPal; this alert summarises one public FTC press release and adds no reporting of its own.
- The single source is an official FTC press release carrying named amounts, recipient counts, dates and a published administrator phone number.
- Every claim sentence restates the source's own wording rather than extending it.
- Confidence covers the refund programme facts only; the harvested set contains no reports of impersonation, so no claim is made about one.
- Reviewed by 2 models, 1 from independent houses.
- This is a higher-risk finding. Our rule asks for 2 independent reviews before we state full confidence; 1 returned.
- Confidence is shown as moderate for that reason, not because the evidence is weaker.
THE RULE
A published payment window, a fixed PayPal date and a named administrator are precisely the details an impersonator can copy — and the FTC's own line is that no genuine payment ever requires a fee or account details.
What we don’t know
- Whether anyone has been contacted by someone posing as the FTC, Cleo AI, Rust Consulting, Inc. or PayPal about this refund.
- What the genuine notification email looks like, including sender address, subject line and whether it contains any link.
- What a recipient should do if the 30-day PayPal redemption window passes.
- Which states or groups of customers the 2,124,796 recipients are concentrated in.
The bench — who voted
2 INDEPENDENT AI MODELS REVIEWED THIS. 1 OF 2 — ONE MODEL DISSENTED. READ WHY.
The card names a count. Here are the seats behind it, with what each one said.
ANTHROPICclaude-opus-5 · MODERATE
The headline figure — 'more than $15.8 million' — appears nowhere in the single evidence row supplied. Row [1] establishes only the recipient count (2,124,796), the email cut-off of 26 October 2026 and the PayPal start date of 27 October 2026. A dollar total that leads both the claim and the finding must be sourced to a row, not assumed to be elsewhere in the same release.
DISSENT, PRESERVEDThe draft deserves credit for stating plainly that it holds no complaint data showing impersonation of this refund programme, and for conceding it cannot describe what a genuine notice looks like. That disclosure is the difference between a prophylactic notice and a manufactured scare, and it should survive any edit.
DISSENT, PRESERVEDI grade the underlying pattern moderate rather than high. A government refund arriving unsolicited by email, paid through a consumer wallet, with a 30-day expiry, is a textbook impersonation lure, and the deadline supplies the urgency that scam messages exploit. But no impersonation is reported here, and the published dates are over a year out, so the present exposure to a reader is contingent rather than active.
DISSENT, PRESERVEDBecause the alert cannot tell readers what a real notice looks like, publishing the refund dates and administrator details arguably hands a would-be impersonator a ready-made script while leaving the reader no way to distinguish genuine from forged. If this runs, the single most useful fix is to source and verify the Rust Consulting number against the FTC's own site, and to drop the unsourced allegation narrative entirely rather than trim it.
GROQopenai/gpt-oss-120b · HIGH
The finding adds specifics (the $15.8 million total, hidden‑fee allegations, hard‑to‑cancel subscriptions) that are not present in the cited press‑release excerpt, which only describes the payment distribution schedule and FTC warnings.
Reviewed by 2 independent models; all judged the finding to go beyond the evidence.
▼ Protocol & challenge record
Objection (high): Eligibility is overstated. The source says the FTC 'plans to send payments to 2,124,796 Cleo AI customers WHO PAID FOR ELIGIBLE INSTANT CASH ADVANCES.' The draft's claim line and lead sentence both say simply 'Cleo AI cash advance app customers' / 'customers of cash advance app company Cleo AI,' dropping the qualifier. In a scam-awareness context this is the worst possible direction to err: it tells every Cleo user — including those who never paid an instant-advance fee — that they are owed money, which is exactly the belief a refund impersonator needs the victim to hold. Reinstate 'who paid for eligible instant cash advances' in both places.
Resolved: Restore the source qualifier: claim line to read 'Cleo AI customers who paid for eligible instant cash advances,' and the same in finding sentence 1. Purely a restoration of source wording; no new sourcing needed.
Objection (medium): The claim line is garbled in a way that creates risk: 'paying out more than $15.8 million ... by email notice and PayPal' reads as though money arrives by email. The source separates the two: an email is NOTICE, the payment is PayPal only. A reader who has internalised 'the FTC pays by email' is primed for a payment-link phish. Rewrite as 'notifying recipients by email and paying by PayPal.'
Resolved: Reword claim line to 'notifying recipients by email and sending payments via PayPal' so notice and payment are not conflated.
Objection (medium): The source contains the FTC's own reporting channel — ReportFraud.ftc.gov — and the draft omits it entirely while inventing its own advice ('ring the refund administrator number'). The administrator, Rust Consulting, is a redress contractor for payment queries; it is not the body that takes impersonation reports. The advice sentence routes a suspected impersonation to the wrong party and drops the in-source correct one. This is an omission of sourced, actionable material in favour of unsourced advice.
Not resolved — preserved on the record.
Objection (medium): Internal inconsistency on targeting. targeting_dropped invokes §11 Rule 2 — that naming a group implies that group is being targeted — to kill the share directive, yet the chosen audience_callout is 'ATTENTION: CASH ADVANCE APP USERS,' which is broader than the evidence (Cleo instant-advance payers) and implies cash-advance users generally are a target class. No harvested row supports that. 'ATTENTION: CLEO AI APP CUSTOMERS' is already in callout_options and is the only one matched to the evidence.
Resolved: Swap audience_callout to 'ATTENTION: CLEO AI APP CUSTOMERS' from the existing options list, which matches the evidence and is consistent with the §11 Rule 2 reasoning already applied to the share directive.
Objection (medium): Hard expiry not flagged. Every operative date in this item is within a seven-week window: emails to 26 Oct 2026, PayPal from 27 Oct 2026, 30-day redemption, i.e. the item is stale and potentially misleading by roughly 26 Nov 2026. The draft carries no publication date, no 'as of' marker and no expiry note, and 'will receive an email up to October 26, 2026' drops the source's starting bound ('between now and'), so a reader cannot tell whether the notice window has opened, is open, or has closed. unknowns correctly asks what happens if the 30 days lapse — but that unknown is precisely the state most late readers will be in.
Not resolved — preserved on the record.
Objection (medium): Genre mismatch / manufactured-threat risk. The harvested row describes a lawful redress distribution. There is no reported impersonation, no complaint data, no observed lure. The risk_line ('precisely the details an impersonator can copy') is pure inference presented in the register of a finding, and the piece is packaged as a fraud alert with a threat callout and watch_icons for email/phone/bank. The two limitation sentences are good and necessary, but they sit after the advice. Confidence 'high' attaches to the refund facts only — that caveat is in confidence_reasons but not visible to the reader.
Not resolved — preserved on the record.
Objection (low): Single-source, no corroboration, and the one source is a press release that the draft reproduces rather than checks. In particular the phone number 877-788-4958 is printed by the alert itself while the advice tells readers to take the number from the FTC's own site rather than from any message — including, logically, this one. The source renders the number two ways (spaced in body, hyphenated in the contact block); same digits, but nothing here is a live verification against ftc.gov.
Not resolved — preserved on the record.
Objection (low): Context omitted that bears on the numbers: the linked reference release states Cleo agreed to pay $17 million, while $15.8 million is being distributed. A reader doing their own arithmetic, or a scammer quoting '$17 million,' will find the discrepancy. One clause resolves it.
Resolved: Add a clause noting the underlying settlement was $17 million per the FTC's referenced release, with $15.8 million being distributed in this round — sourced to the same row.
Objection (low): Entity ambiguity. 'Cleo AI' is not disambiguated (company, app, jurisdiction). Several products trade under 'Cleo'; name collision is itself a refund-scam vector. The source gives no more, so this is a limitation to state rather than a fix.
Not resolved — preserved on the record.
Objection (low): Quality control on the option lists: callout_options contains 'ATTENTION: SCAMMEDS' (not a word) and 'ATTENTION: EVERYONE'; directive_options contains 'Send this to any administrator you know' and 'Forward this to the administrators in your life,' which are incoherent for this item. Null share_directive was the right call, but these lists should not have reached review in this state.
Not resolved — preserved on the record.
Objection (low): 'The press release names one point of contact for payment questions' — true for payment questions, but the release also lists FTC Office of Public Affairs contacts and points to the FTC redress FAQ and redress dashboards. 'One point of contact' is defensible only with the 'for payment questions' qualifier that the draft does include; flagging so it is not loosened in edit.
Resolved: Keep 'for payment questions' locked in the sentence; do not shorten in copy-edit.
Preserved dissent
ON THE RECORDI do not accept 'high' confidence as currently presented. The underlying refund facts are high-confidence; the item as published is a fraud alert whose central proposition — that readers may be approached by an impersonator exploiting this payout — rests on no evidence whatsoever. confidence_reasons says so internally, but the reader sees a high-confidence fraud alert. If the Desk keeps 'high,' the scope limiter should be surfaced on the face of the item, not buried in metadata.
ON THE RECORDI think OBJ-1 is a publication blocker, not a copy-edit. Telling the general population of Cleo users that they are owed money, when the FTC restricted the class to those who paid for eligible instant advances, actively manufactures the pool of receptive targets the alert claims to protect. It should not go out in its current form.
ON THE RECORDThe 'ATTENTION: CASH ADVANCE APP USERS' callout is, in my judgement, the same §11 Rule 2 violation the Desk correctly identified and dropped on the share directive. Applying the rule to directives but not to the masthead callout is inconsistent, and I would record that the inconsistency was pointed out before publication.
ON THE RECORDOn OBJ-3 I am firmer than 'open': omitting ReportFraud.ftc.gov while substituting the house's own unsourced instruction to phone a redress contractor is worse than the source, not better. A scam-awareness outlet that drops the regulator's reporting channel from a regulator's own release has inverted its purpose.
The sources
Official sourceFTC Returns More than $15.8 Million to Consumers Misled by Cash Advance App Company Cleo AI2026-10-08
The FTC plans to send payments to 2,124,796 Cleo AI customers who paid for eligible instant cash advances, with emails to October 26, 2026 and PayPal payments beginning October 27, 2026.
Authority: official. Retrieved 2026-10-08.
Limitation: A single agency press release about a redress distribution; it describes the refund process and the agency's standing warnings, and does not report any scam activity, impersonation attempt or consumer complaint tied to this payout.
Open the original source →Other checks
Published under standing founder pass (A9) — every claim source-mapped by the machine.
▼ What the machine checked
- ✓ Not a community submission.
- ✗ Draws on an FTC enforcement release, which names a defendant: "FTC Returns More than $15.8 Million to Consumers Misled by Cash Advance App Com".
- ✓ All 5 material sentence(s) map to FTC.
- ✗ anthropic returned "overstated"; groq returned "overstated" — published on the receipt, not blocking (A9 amendment).
- ✓ No audience band is set.
No human affirmed these. They were verified by the classifier described in Amendment A9, on 2026-10-09.
Something wrong here? Tell us and we'll correct it — corrections are published, not quietly edited.
Phishy? Send it → sharelivefraud.com/squire-it
Not affiliated with any government agency, credit bureau, bank, platform, or law-enforcement agency. Informational only — not legal or financial advice.
Naming a source is not an endorsement, and being named here is not an accusation against any company.
Powered by SquireIt™
Verify this receipt at squireit.com