That’s the lesson of yesterday’s debacle for Avon Products (AVP), the door-to-door cosmetics company that has been a regular subject of takeover talk. Shortly before noon on Thursday, an investment firm calling itself PTG Capital filed a document with the SEC, saying that it had offered to acquire Avon for $18.75 per share. It did not also issue a press release or use any other third party for distribution. Just the SEC’s EDGAR platform.

For context, Avon shares had been trading at around $6.50 prior to the news. Once the filing hit, however, the shares began to surge – climbing nearly 15% before the NYSE halted trading. Pretty soon, media outlets (including us at Fortune) were raising alarm bells over the supposed offer. No one had ever heard of PTG Capital before, nor did the firm seem to exist via Google or LinkedIn searches. Moreover, boilerplate in the filing twice referred to the acquirer as “TPG Capital” – suggesting that it had cribbed the language.

Also not seeming to exist was PTG’s Texas-based law firm. Neither the listed phone numbers nor addresses were legitimate. About an hour and a half after the filing first hit, Avon put out a press release saying that it had not received any takeover offer, and that it couldn’t verify PTG’s existence.

Most likely, this was a stock manipulation scam. Someone owned Avon stock, filed the bogus document and sold when shares spiked.

For Avon to make an actual filing via EDGAR, it needs private confirmation codes and a password. For someone else to file a document that appears under Avon’s ticker symbol, however, all they need is their own EDGAR username and password – neither of which are verified by the SEC. This is how a legitimate hedge fund manager, for example, would file a proxy or tender offer document for a publicly-traded company.

But here’s what’s most remarkable: The phony Avon “takeover” filing remains on the SEC’s website. In fact, it’s the first thing someone searching for Avon Products would see.

When Fortune reached out to an SEC spokesman, he initially said: “Under the federal securities laws, filers are responsible for the truthfulness of their filings, and they are subject to enforcement actions when they are false or misleading. The SEC receives about 4,000 EDGAR filings daily, which are automatically available to the public and involve more than 300,000 individual and 28,000 company and mutual fund filers.”

Okay, but the SEC’s primary mission is investor protection. Including investors who might not be reading the business press. It’s one thing to not have appropriate safeguards on the inbox, but what about after everyone realizes that the filing is fundamentally flawed? The spokesman’s follow-up reply: “We don’t take down documents, or amend them, or pass judgment on them. It is a repository for what is filed, not what is accurate.”

Seriously. The SEC is nonplussed by the idea that its own database may be the primary source of information that defrauds investors. And, if you need further proof, yesterday’s Avon scam looks a lot like a 2012 con related to a company called Rocky Mountain Chocolate Factory – and that filing also remains available on the SEC’s site.

A source familiar with the situation says that Avon has been in talks with the SEC, but it may not actually have the power to have the filing removed. According to the SEC’s website, only a filer can submit a request (in writing) to have a document removed in “very rare and unusual circumstances.” In other words, only the con artist himself can request the removal of his fraudulent filing. Brilliant.

The SEC clearly needs to put greater controls on what enters its system. But, in the meantime, perhaps it could lift a finger and remove an obvious forgery that already walked through the open gates.

Get Term Sheet, our daily newsletter on deals and deal-makers.