An app sitting in a store has to be discovered and installed by someone who went looking. An ad arrives because a targeting system picked the recipient as likely to engage with it [8]. The people who received these ads were the ones Meta's system read as receptive to a pornography ad, and that is also the audience with a reason to keep the install quiet, which pushes back the complaint that would have flagged it [7].
On the handset, the app could pull one-time passwords and banking PINs and move money out of an account without the owner knowing [3]. In OTP flows, the code in the message is treated as proof that the person is holding the device. In practice, the device already approved a permission list during install, and after that approval the code and the device sit on the same side of the fence [19]. Mobile banking is the main route to financial services for many newer account holders in India, so that fence is the account [12].
Meta's own numbers give the scale of the incentive. An internal projection reported last year estimated scam and banned-goods advertising at roughly 10 percent of 2024 revenue, about $16 billion [9]. Set the enforcement against that. India's recorded cyber fraud losses for all of 2025, close to $2.4 billion [5], come to about 15 percent of that one-year advertising figure [13]. Poland's request that the European Commission fine Meta 250 million euros over scam advertising [11] is roughly 1.6 percent of it, before anyone converts currency [14]. India has separately summoned Meta over Instagram ads promoting child sexual abuse material and ordered their removal [17], and banks in the UK say a large majority of the payment fraud they encounter starts on Meta's platforms [15]. The company running the auction is also the company running the review that decides what the auction may carry [18].
Meta is building scam detection into WhatsApp, Messenger and Facebook [16]. Hold that apart from what happened to these particular ads: one batch came down after a government advisory, the remainder after a reporter asked [1][2], and the questions were answered with removals rather than comment [4].
The version of this you can apply on Monday to any channel you depend on, or that your customers can be reached through, comes down to two things: whether the channel pushes to an audience it selects or waits to be found, and whether the party paid for delivery also judges what is admissible. Where both answers are the unhappy one, the detection lag is the interval until someone outside the company writes in. In this case that interval was long enough to cover a government advisory and 39 ads still running afterwards [2].
