Meta's 'Penalty Bid' System Reveals Scam Revenue Isn't a Bug—It's a Business Model

Leaked internal documents suggest Meta's historical business model accommodated fraud revenue—until 2025 enforcement improvements raised a critical question: was 2024's underfunding a capacity constraint or a prioritisation choice? That's the key insight from new research from ASTRA Safety analysing leaked internal documents first reported by Reuters that revealed $16 billion in annual scam advertising revenue.

The most significant finding isn't the scale—it's the mechanism. Internal documents reveal Meta charges premium rates to suspected scammers rather than banning them—what ASTRA characterises as a "Penalty Bid" system—effectively monetising access to victims. Meanwhile, internal guardrails capped fraud-prevention spending at just 0.15% of revenue, suggesting safety measures were constrained to protect profit margins.

The Penalty Bid System: Monetising Scam Advertising

Internal Meta documents leaked to Reuters in November 2025 revealed the company generated approximately $16 billion during 2024 from scam advertisements and banned goods—constituting 10.1% of total annual revenue. ASTRA's analysis suggests this significantly underestimates the full scope, as Meta's broader "fraudulent-adjacent" ecosystem—including spam farms, clickbait networks, and engagement-bait content—likely generates 15-30% or more of total ad revenue.

The leaked documents reveal that Meta's advertising system applies algorithmic surcharges on advertisers flagged as high-risk rather than outright bans—what ASTRA's analysis characterises as a "Penalty Bid" system. The result: suspected scammers pay premium rates to continue operating.

"This appears to represent not moderation failure, but structural business model choices. When your system charges suspected scammers more instead of removing them, regulators need to ask whether this represents negligence or something more systemic. The leaked documents suggest this was projected, not accidental—and Meta's 2025 improvements demonstrate the enforcement capacity existed."

— Alex Zarov, Founder & CTO, ASTRA Safety

Calculated Constraints on Safety

Beyond the penalty system, the documents reveal historical constraints on fraud prevention that Meta's 2025 improvements suggest were not technically necessary:

• Safety spending explicitly capped at 0.15% of revenue
• Internal projections forecasting continued scam revenue through 2027 (reducing only to 5.8% of revenue)
• Revenue guardrails ensuring fraud prevention never threatens margins
• Anticipated regulatory fines (~$1 billion) constitute only 14% of semi-annual scam revenue
• When scam advertisers are banned, Meta almost invariably retains revenue generated during their operation—effectively keeping proceeds of fraud

"When anticipated fines are 14% of semi-annual scam revenue, that's not deterrence—that's cost of doing business. The regulatory framework treats this as content moderation negligence. The financial evidence suggests prioritisation choices that warrant serious regulatory scrutiny."

— Alex Zarov, Founder & CTO, ASTRA Safety

The Scale of Harm

Key findings from ASTRA's analysis:

• $16 billion annual scam revenue (10.1% of 2024 total revenue, per internal projections)
• $7 billion specifically from "higher risk" scam ads annually
• $200 million earned by spammers via malicious link farms on Meta platforms
• 15-30% or more estimated total revenue when including full "fraudulent-adjacent" ecosystem
• 0.15% of revenue allocated to safety measures—100x less than scam revenue generated

The Scale Changes Everything

"A few million dollars in scam revenue could be explained as schemes slipping through the cracks—pockets of bad actors that are hard to catch. But $16 billion? That's not a gap in moderation. That's a pattern. When the number is that large, you're not missing scammers—you're accommodating them."

— John Kraszewski, Senior Researcher, ASTRA Safety

"If a shopping mall landlord discovered 10% or more of their tenants were running scams, then charged those scammers higher rent instead of evicting them, we'd call that racketeering. Now consider it at scale, generating $16 billion annually while capping safety spending at 0.15% of revenue."

— John Kraszewski, Senior Researcher, ASTRA Safety

The Broader Impact

ASTRA's analysis estimates Meta's fraud-adjacent ecosystem (including spam farms, clickbait networks, and political manipulation) could generate $27.5-44 billion annually—representing an estimated 17-28% of total ad revenue—while imposing an estimated $250-850 billion in externalised costs on society through victim losses, cognitive degradation, and democratic erosion.

"When a company earns $1 from harmful systems while imposing $1.50-$5 in societal costs, that's not just business negligence—it's systemic extraction."

— Alex Zarov, Founder & CTO, ASTRA Safety

Full Research Available

The full analysis with 70 citations, "Meta's Systematic Complicity in Global Fraud: Internal Evidence of Profit Optimisation from Scam Advertising," is available at:

This analysis has been circulated to major global outlets and platform reporters, including Reuters, the Financial Times, The Guardian, and Mashable's news team for independent review.

About ASTRA Safety

ASTRA (Alignment Science & Technology Research Alliance) is a global research institute dedicated to ensuring artificial intelligence and algorithmic systems remain safe, aligned, and beneficial to humanity.