Meta’s Anti-Scam Campaign: What It Teaches a Small Business About Advice People Act On

Meta’s anti-scam campaign, “One Step Ahead”, reached more than 303 million people across 18 countries in Asia-Pacific, and it did most of its work without a click. Meta reported on 29 September 2026 that the campaign delivered over 1.3 billion impressions and more than 1.2 million link clicks. On those rounded figures, that is roughly one click for every thousand impressions, so the safety advice had to land inside the ad itself.

The campaign runs in Asia-Pacific, not the United States, so it changes nothing about the rules for a small business here. It is still worth reading for two reasons. It lists the account-security tools Meta wants people to switch on, and every business that runs a Facebook Page or an Instagram account has those same accounts to protect. And it states, in three lines, how Meta designed advice that people act on.

What Meta’s One Step Ahead Campaign Is

One Step Ahead is an anti-scam education campaign that Meta launched in May 2026 and ran as ads on Facebook and Instagram across Asia-Pacific. Meta says it designed the campaign with more than 25 local safety organizations, law enforcement groups and government agencies, including Scamwatch in Australia, Netsafe in New Zealand and the National Police Agency in Japan.

The campaign has two jobs. It promotes security tools inside Meta’s apps, and through an element called “Know Your Local Resources” it points people to the organization in their own country that handles scam reports. Meta says the campaign continues through the rest of 2026, with more tools, local resources and partners to come.

One Step Ahead Campaign Figures, As Meta Reports Them

Every figure in the table is Meta’s own report of its own campaign. None has been independently audited, and none measures scams prevented. Read them as the size of the effort, not as proof that it worked.

Why the Anti-Scam Advice Had to Work Without a Click

The advice had to work inside the ad, because almost nobody clicked. On Meta’s rounded figures, 1.2 million link clicks against 1.3 billion impressions is under one click per thousand views. That calculation is ours, not Meta’s, and the true ratio shifts a little because both figures are lower bounds.

That ratio is the useful part for a small business. If a campaign Meta ran on its own platforms depended on the post rather than the link, a small business post that hides its point behind a link is asking for something the feed rarely gives. The message that survives is the one a person can read and act on before they scroll past.

Meta’s Three Principles for Advice People Act On

Meta built the campaign on three principles: safety advice should be practical, easy to act on, and come from a source people trust. Those three tests apply to any small business post that asks a customer to do something, not only to safety messages.

Three Tests From Meta’s Anti-Scam Campaign

1. Is the advice practical?
2. Is it easy to act on?
3. Does it come from a source people trust?

Practical means the reader can picture doing it: “turn on two-factor authentication” passes, “stay safe online” does not. Easy to act on means the step is short and the reader knows where to find it. A trusted source is why Meta worked with police, regulators and local safety groups rather than speaking only in its own name. For a small business, the equivalent is showing the work you actually do and naming who stands behind it.

The Account-Security Steps Worth Taking on Your Business Accounts

The campaign promotes four security tools on Facebook and Instagram, and each one protects the accounts a small business markets through. I run my own Google and Meta ads and learned by doing. The accounts behind a Page and an ad account are worth the same care as the bank login.

Four Meta Security Tools, in a Working Order

1. Add a second check at login
2. Set up a passkey to sign in
3. Run Security Checkup on the account
4. Run Privacy Checkup on the account

Meta describes each tool this way. Two-factor authentication adds a second check at login, so a stolen password is not enough to get in. Passkeys let people sign in with the fingerprint, face or PIN they already use, and Meta says a passkey cannot be stolen, shared, guessed or reused. Security Checkup walks through strengthening a Facebook account, and Privacy Checkup controls who can see, message and connect with the account. The first step above is two-factor authentication. The order is ours: close the password gap first, then review the rest.

If your business uses WhatsApp, the campaign also names two WhatsApp settings: a Linked Device Warning that flags a suspicious login or linking attempt, and group settings that control who can add you to a group.

What Meta’s Anti-Scam Campaign Does Not Tell a Small Business

The campaign reports reach, not results, and it covers Asia-Pacific only. It does not say how many people switched on a tool after seeing an ad, how many scams were reported through the local partners, or whether scam losses fell in any of the 18 countries.

It also does not describe any change for businesses in the United States. The security tools it promotes are features of Meta’s apps rather than of the campaign, and Meta points people to its Scam Protection Center to learn how to use them. The practical step for a business owner here is the same whether or not the campaign ever reaches this market: secure the accounts your marketing runs through, and write posts that carry their point without a click.

For the wider question of what to automate in a marketing operation and what to keep a human on, our guide to building the system before buying the tool sets out where the gates go.