Meta reports that its “One Step Ahead” anti-scam campaign has reached more than 303 million people across 18 Asia-Pacific markets since it began in May 2026, generating over 1.3 billion impressions. The company’s regional newsroom says more than 25 government agencies, law enforcement bodies and safety organisations helped deliver the messages. The number measures exposure to educational content, not a drop in fraud. Nothing in Meta’s account says how many of those people changed a setting, avoided a scam or lost less money, and the figures come from the company itself rather than an outside audit.
What Meta’s APAC newsroom counted
Meta describes the campaign as one of the largest online-safety education efforts it has run in the region, and says it continues through 2026. The click figure is the only number in the post that points to people acting on a message: roughly 1.2 million clicks against 303 million people reached.
According to Meta’s September 29 newsroom post, the campaign reached “more than 303 million people across 18 countries,” produced more than 1.3 billion impressions and drew more than 1.2 million link clicks. The post is a company announcement and carries no quote from a named executive or official, so every claim here rests on Meta’s own wording.
Meta says the campaign rests on three principles: advice should be practical, easy to act on, and delivered by a source people already trust. A second figure covers a narrower slice. A separate local-resources element reached more than 27.4 million people in 14 markets, about nine percent of the broader reach if the two figures describe overlapping audiences, though the post does not say how they relate. Meta does not explain how it de-duplicates people who saw the content more than once or in more than one market.
The partners and the markets they cover
Meta names partners in 14 places: Australia, Bangladesh, Hong Kong, India, Indonesia, Japan, Kazakhstan, New Zealand, Pakistan, the Philippines, Singapore, Taiwan, Thailand and Uzbekistan. The post does not list the remaining four of the 18 markets, so the full footprint cannot be reconstructed from the announcement alone. Whether the 14 partner markets are the same 14 that received the local-resources element is also not stated.
The partners are mostly public bodies. Australia is represented by Scamwatch, which the Australian Competition and Consumer Commission runs; Japan by its National Police Agency; Singapore by the Singapore Police Force and the National Crime Prevention Council; and Indonesia by its communications ministry, the national police cybercrime directorate and the Indonesia Anti-Scam Centre. India’s entry is the National Cyber Crime Reporting Portal, and the Philippines list includes the central bank, Bangko Sentral ng Pilipinas, and its Securities and Exchange Commission.
These agencies already run their own reporting channels, and that is the practical point of the pairing. Australia’s Scamwatch reporting page tells people to use its online form, to contact their bank or card provider immediately if personal or financial information was stolen, and to call 000 if in immediate danger. New Zealand’s Netsafe, another named partner, points victims to a seven-step guide for responding to an online scam and advises contacting the bank as soon as possible after losing money.
Passkeys, two-factor login and the WhatsApp warning
The protections Meta promotes are account-level settings. Two-factor authentication “adds a second check at login, so a stolen password isn’t enough to get in,” in the post’s words. Passkeys let people sign in with the fingerprint, face or PIN they already use, and Meta says they “can’t be stolen, shared, guessed or reused.” The company also points to its Security Checkup for Facebook accounts and a Privacy Checkup that controls who can see, message and connect with a person.
The passkey claim matches how the technology is designed. The FIDO Alliance, the industry body behind the standard, describes passkeys as credentials stored on a phone, computer or security key and approved with the same method that unlocks the device. Because the device signs a challenge from the server instead of sending a reusable secret, there is no password for a phishing page to capture. The Alliance calls phishing resistance “a core design goal” of the approach.
On WhatsApp, the campaign promotes a Linked Device Warning that alerts users to suspicious login attempts, unauthorised web clients or possible account-linking scams, plus a setting that lets users choose who can add them to groups. These target a common trick in which a scammer persuades someone to link a stranger’s device to their account. Meta offers a Scam Protection Center as the campaign’s central reference page.
What the figures leave out
The announcement reports reach, impressions and clicks, but no scam-loss data, no count of passkeys or two-factor logins switched on, and no breakdown of the 303 million by country. Without those, the campaign cannot be judged on outcomes. It is also limited to Asia-Pacific, so the 303 million does not describe protection anywhere else. The open question is what happened after the clicks. Meta’s own post gives 1.2 million link clicks as its closest measure of action, and a follow-up with adoption figures for passkeys and two-factor login in the 18 markets would show whether exposure turned into safer accounts.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
