Facebook and Google lack effective controls to prevent fraudsters from posting scam adverts, according to a Which? investigation.