If Meta is missing in action, move defence to the call

A bank just publicly accused Meta of being missing in action on deepfake scam ads, including ads that ran an AI-generated version of the bank’s own CEO. This isn’t a hot-take outlet or a privacy NGO talking. It’s Westpac. When the institution that wears the reimbursement bill says the platform isn’t pulling its weight, the conclusion is awkward and obvious. The defence has to move somewhere the platform can’t shrug off.

That doesn’t mean Meta is the whole story. It doesn’t mean every platform team is idle, or that banks get to hand every hard problem to a social network and call it done. Westpac naming the platform in public matters for a different reason. Banks don’t do that lightly.

Public naming usually means the private routes haven’t produced enough change.

Deepfake scam ads are an ugly fit for platform defence. They’re cheap to generate, fast to vary and easy to hang off someone else’s credibility. A fake executive or a fake investment page can be spun up and tested faster than any manual review process wants to admit.

The economics run against the defender. The attacker makes variants at software speed. The platform has to catch them across an enormous surface of languages, formats, accounts and payment methods. Better models will help. Better enforcement will help. But the platform is still a long way from the customer at the moment the scam turns into a decision.

That distance is the lesson.

The scam chain has several links before money moves. Someone sees an ad. They click. They hand over details. They get a message. They take a call. They’re walked into a fake service flow, a fake investment process, or a real bank transfer under false instructions. The platform matters at the first link. It often isn’t there at the last one.

Any defence closer to the customer has more leverage in the later stage. The bank’s own channel. The telco layer. The inbound call. The payment screen. The account-recovery step. The moment someone is asked to trust a name, a voice, a number or an instruction. Those are the points where the institution can be staffed, accountable and specific.

That’s why the Westpac signal is bigger than a fight with Meta. It says a major bank is no longer comfortable treating platform cleanup as the centre of the answer. The platform may still need to do more. The regulator may still push. But the control architecture has to assume some bad material gets through.

Once you assume that, the question changes. It becomes less “why did the ad exist?” and more “how many chances did the system have to stop belief becoming action?”

That’s not a kinder question. It spreads the responsibility around. Platforms remove bad ads, banks harden money movement, telcos cut bad traffic, businesses verify the high-risk conversations before sensitive decisions get made. No one layer gets to declare victory because another layer failed first.

Westpac has just told you, in public, that it’s stopped waiting. Reading that as anything else is wishful.