Meta's Profits from Scam and High-Risk Advertisements Exposed
Reuters uncovered internal Meta documents revealing that the company projected $16 billion in 2024 revenue from advertisements linked to scams and banned goods, accounting for approximately 10% of its total revenue. Meta's safety staff estimated that its platforms were involved in a third of all successful scams in the United States, though some of this involvement may be due to the use of WhatsApp for communication rather than direct ad placement. The documents also showed that Meta only bans advertisers if automated systems are 95% certain of fraud; otherwise, the company imposes higher ad rates as a penalty, potentially incentivizing the acceptance of high-risk ads.
Meta's management reportedly weighed the financial benefits of scam ads against potential regulatory costs, with $3.5 billion in revenue every six months coming from ads deemed to have "higher legal risk," such as those impersonating brands or celebrities. The company was willing to forgo only a small fraction of its revenue—about $135 million—to clamp down on suspicious advertisers, suggesting a calculated approach to balancing profit and compliance risk. These revelations have raised significant concerns about Meta's role in facilitating online scams and its internal decision-making regarding fraudulent advertising.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
11 events from the most recent confirmed update back to the earliest known activity.
KnownSec data leak was reported publicly
A large data leak involving Chinese security firm KnownSec was reported in the same news roundup. The summaries did not provide further technical detail, but identified it as a notable disclosure.
Reuters exposed Meta's handling of scam advertising
Reuters published an investigation revealing Meta's internal projections and policies around scam and banned-goods advertising revenue. The reporting brought public attention to the scale of fraud-related advertising on Meta's platforms and the company's internal enforcement thresholds.
Yanluowang initial access broker pleaded guilty in the US
A Russian initial access broker tied to the Yanluowang ransomware group pleaded guilty to hacking U.S. companies. The plea marked a concrete legal action against a facilitator in the ransomware ecosystem.
Law enforcement dismantled a major credit card fraud ring
Authorities took down a large credit card fraud operation, according to the reporting summaries. The action was presented as a significant law enforcement disruption of financially motivated cybercrime.
Ransomware incidents at Jaguar Land Rover and Asahi highlighted economic impact
Reporting cited ransomware attacks affecting Jaguar Land Rover in the UK and Asahi in Japan as examples of the continuing economic damage caused by ransomware. The references framed these incidents as part of a broader trend rather than newly disclosed breaches.
UK suspended intelligence sharing with the US over legal concerns
The United Kingdom suspended some intelligence sharing with the United States over concerns tied to suspected drug-trafficking vessel operations and related legal issues. The move was reported as a significant policy response in the intelligence relationship.
Sandworm launched wiper attacks on Ukraine's grain sector
The Russian military-linked group Sandworm carried out wiper attacks against organizations in Ukraine's grain sector. The campaign was described as an effort to damage a strategically important part of Ukraine's economy.
Hackers breached F5, with Salt Typhoon linked in reporting
State-backed hackers also breached F5 and stole sensitive files including source code, with Lawfare's summary attributing the activity to the Chinese group Salt Typhoon. As with the SonicWall incident, the attackers reportedly showed restraint by not turning the access into mass exploitation.
State-backed hackers breached SonicWall's MySonicWall service
Reporting said state-backed hackers compromised SonicWall's MySonicWall cloud backup service and stole sensitive configuration data. The intrusion was notable because the attackers did not escalate to broad mass exploitation.
Meta used a 95% fraud-certainty threshold before banning advertisers
Reuters reported that Meta generally banned advertisers only when automated systems were at least 95% certain they were fraudulent; otherwise, the company often imposed higher ad rates as a penalty. The policy was described in internal documents cited in reporting published in November 2025.
Meta projected $16 billion in scam and banned-goods ad revenue for 2024
Internal Meta documents reviewed by Reuters showed the company projected about $16 billion in 2024 revenue from advertisements tied to scams and banned goods, roughly 10% of total revenue. The documents also indicated Meta platforms were linked to about one-third of successful scams in the United States.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Reuters Blows Lid on Meta's Fraud Profit Scandal
lawfaremedia.org
Open sourceWhy We Can't Expect Meta to Stop Online Scams on Its Own
govinfosecurity.com
Open sourceReuters Blows Lid on Meta's Fraud Profit Scandal
news.risky.biz
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta Expands AI Scam Defenses After Disrupting Southeast Asia Fraud Networks
Meta announced new anti-scam protections across **Facebook, Messenger, and WhatsApp** as it faces growing scrutiny over fraud on its platforms. The company said its AI systems now analyze **text, images, and contextual signals** to detect celebrity and brand impersonation, deceptive links, domain spoofing, and other social-engineering tactics. New measures include Facebook warnings for suspicious friend requests, WhatsApp alerts for risky device-linking attempts involving QR codes or phone-number entry, and expanded Messenger scam detection that can, with user consent, review recent chats for fraud indicators. Meta also detailed privacy-focused link protection in Messenger through **Advanced Browsing Protection**, which checks shared URLs against a large malicious-site watchlist without exposing readable links to Meta. The product rollout follows a broader crackdown on industrialized scam operations, including joint action with the **Royal Thai Police**, **FBI**, **UK National Crime Agency**, and **Australian Federal Police** that led to **21 arrests** and the disabling of more than **150,000 accounts** tied to Southeast Asian scam compounds. Meta said it removed **159 million scam ads in 2025** and took down about **10.9 million Facebook and Instagram accounts** linked to criminal scam centers, while shifting from deleting individual accounts to disrupting entire networks. The push comes as researchers separately documented a large malvertising operation using **300+ paid Meta ad campaigns** to impersonate news outlets and public figures, lure victims to spoofed sites, harvest contact details, and funnel them into call-center-run investment scams across at least **25 countries**.
Jun 29, 2026
Social Platforms Face Scrutiny Over Scam Advertising and Messaging-Facilitated APP Fraud
**Meta** said it is pursuing legal action against advertisers it alleges ran **celeb-bait scam ads** on its platforms, including defendants based in **Brazil, China, and Vietnam**. Meta reported suspending the advertisers’ payment methods, disabling related accounts, and blocking domains used in the campaigns, which allegedly misused celebrity images/voices (including synthetic media) to drive victims to scam sites that harvest sensitive data or solicit money via fraudulent products and investment schemes; Meta also said it sent cease-and-desist letters to marketing consultants promoting services to bypass ad-policy enforcement (e.g., “un-ban” services and renting access to trusted accounts). Separately, a **Revolut** report on **Authorised Push Payment (APP) fraud** found scam origination increasingly tied to encrypted/direct messaging channels, with **Telegram** exceeding **20%** of reported scam origination and showing significant growth versus 2024, while **Meta-owned platforms** collectively remained the largest source at **44%**. The report highlighted category concentration by platform, including Telegram and WhatsApp accounting for major shares of **investment** and **job scams** (with Telegram cited as over **58%** of job scams), reinforcing that a large portion of financial fraud is initiated on social and messaging platforms and prompting calls for stronger platform accountability.
Jun 29, 2026
Meta Expands Anti-Scam Protections Across WhatsApp, Facebook, and Messenger
**Meta** introduced new anti-scam protections across *WhatsApp*, *Facebook*, and *Messenger* to counter fraud campaigns that rely on social engineering, impersonation, and malicious links. The updates include WhatsApp warnings when device-linking requests show scam-related behavioral signals, such as attempts to trick users into sharing linking codes or QR codes, and Facebook alerts for suspicious friend requests from accounts with indicators like recent creation or no mutual connections. Messenger is also adding AI-driven scam detection to identify patterns associated with impersonation and spoofed links in chats. The changes are part of a broader anti-fraud push in which Meta said it worked with international law enforcement to disable more than **150,000 scam-linked accounts** and support the arrest of **21 individuals**. A separate report on a new cross-industry anti-scam accord involving Meta, Google, Microsoft, Amazon, OpenAI, and others describes a wider effort to share threat intelligence, improve fraud reporting, strengthen transaction verification, and coordinate defenses against scam operations that move across multiple online platforms. A report on **Operation Atlantic** focuses instead on cryptocurrency approval-phishing enforcement by U.S., U.K., and Canadian authorities and is a different story from Meta's platform-specific product rollout.
Jun 29, 2026