A Warsaw think tank spent a year counting the fraudulent advertising that ran on Facebook and Instagram in Poland. Meta answered with a count of the advertising it removed. Those are different questions, and only one party holds the figures that would reconcile them.

Instrat’s paper, published on 16 September, puts scam ads at 10.8% of all advertising reach on Meta’s platforms in Poland. The revenue attached to that reach runs to 760 million złoty for the year to 13 July. That is roughly 37% of what Meta’s Polish entity books as annual revenue. The figure is an estimate, and the foundation says so. It had no way of being anything else.

The method is where the dispute sits. Instrat sampled more than 1.1 million ads from the Ad Library and treated as fraudulent the ones Meta itself later removed. Its definition of a scam advertisement was Meta’s own enforcement record.

Meta called the paper “fiction created to order” and disputed the method itself: the report, Meta said, leaned on data from a single profile deliberately built to attract certain kinds of ads, and on a small research sample. Its own enforcement log tells a tidier story. Between July 2025 and June 2026, more than 88% of the fraudulent ads Meta removed from Poland came down before any user complained.

The same log overstates fraud when a think tank reads it and proves diligence when Meta does.

That 88% describes how removals were triggered, not how much fraud was served. It says nothing about the ads nobody took down. The one outside test of that half came from CERT Polska, the national response team: 122 advertisements it had classified as fraud, 106 refusals. Warsaw’s August request that the Commission fine Meta rests on that count: Instrat’s brief asks for €250 million; the reporting on Gawkowski’s letter cites 1 billion złoty, about €230 million. Same request, two figures, and neither account reconciles them. A refusal rate of 86.8% is an enforcement statistic too.

Counting from outside is hard by construction. Instrat’s researchers worked from an Ad Library that serves about 50,000 records a day to a market running hundreds of thousands of ads. Entries can lag by up to 24 hours, time enough to change the creative behind an approved shell. 41% of the fraudulent ads the foundation examined, in a 108-ad sub-sample, were not accurately represented in the library at all.

Brussels has noticed. The Commission’s preliminary finding in October 2025 was that Meta breaches its Digital Services Act duty to give researchers adequate access to public data. A finding about researchers is, in this argument, a finding about who may check the arithmetic.

For a brand the arithmetic is not academic. Meta now holds the storefront, the verification that says the storefront is genuine, and the paid reach that fills it. We described one piece of that last week, when WhatsApp changed the tests a phone runs on an unsaved business number.

Zuckerberg put the end state to Stratechery in a May 2025 conversation: a business states its objective, connects a bank account, and Meta supplies the results. A label that accepts the offer has handed one company its distribution, its identity check and its media budget. The fake outlet sale trading on its name is bidding in the same auction, against the real one.

Poland’s courts have already ruled on what Meta is in that transaction. The Warsaw Court of Appeal held in March that the platform cannot claim the hosting exemption for advertising. Its role, the judgment found, is “conscious, active and directed at generating financial gain” for itself and for advertisers. A party to the sale is a strange choice of auditor for it.

Every party here can count something. Meta counts removals; Instrat counts reach. The brand whose name appears in the fraudulent advert counts nothing at all, and is the only one of the three that receives an invoice.