Scam Ads on Social Media: What ESET Says to Check Before You Click

According to ESET, trusting a social media platform does not mean the ads running on it can be trusted too. The platforms themselves sell the tools that let anyone generate ad copy, images and video, and target exactly who sees them, with no check on whether the advertiser is legitimate.

The scale behind this is large. Nearly one trillion scam ads were served to social media users in Europe in 2025, generating an estimated £3.8 billion in revenue for the platforms carrying them. Meta alone projected that 10% of its 2024 revenue, a staggering $16 billion, would come from ads for scams and banned goods. Nearly a third of people who reported losing money to a scam last year said it started on social media.

What scam ads actually look like

ESET lists the shapes these ads take. Some impersonate a legitimate company and lead to a phishing site built to look like the real one. Some offer limited-time deals to create urgency. Some promise investment returns, often in cryptocurrency, with no downside. Some impersonate customer support for a bank. Some promise cash or prize giveaways that only need personal and financial details to claim. Some throw up fake security warnings that a device is infected. Some use clickbait headlines to pull people in.

Behind these, the end goals split into a few types. Malvertising clicks can exploit a browser flaw or quietly install malware through an app download. Phishing-style pages collect personal information that gets used for identity fraud later. Fake e-commerce sites covertly harvest card details at checkout. Direct financial asks want money for a fictitious investment, a non-existent product, or a fake fee.

The sequence worth noticing is where the trust actually sits. A platform can moderate its own content, verify accounts and enforce policy, and still have no reliable check on the ad it is paid to show, because the advertiser bought the targeting tools from the platform itself. That is the gap scam ads are built to sit inside: not a failure of platform trust, but a separation between the feed a person trusts and the ad sitting inside it that was never vetted the same way.

This is the kind of pattern automated monitoring is built to catch: not one scam ad, but the repeated shapes, the urgency cue, the fake support impersonation, the too-good giveaway, recurring across a feed faster than any single user could flag them by hand.

None of this requires spotting every bad ad. It requires treating every ad, regardless of platform, as unverified until proven otherwise. A legitimate company's customer support will never need financial details handed over through a giveaway form. A real investment does not promise high returns with no downside. Checking a deal or a warning against the company's own site, rather than the ad's link, closes most of the gap ESET describes.