A Polish think tank and Meta are arguing about how much money scam ads make. The argument is the story. Instrat published a policy paper on 16 September estimating that scam ads were 10.8% of the ads Meta served in Poland by reach, and that about 37% of Meta's Polish revenue, up to roughly PLN 760 million a year (roughly 198 million US dollars), came from them. That is an estimate built on extrapolation, and Meta disputes it. Meta replied on 18 September: 137,000 fraudulent ads removed in Poland between July 2025 and June 2026, over 88% of them before anyone reported them, and a new system catching 50% more ads impersonating public figures. It says the report rests on flawed assumptions and imprecise definitions. Those counter-figures are self-reported and unaudited. So one side has an outside estimate the platform calls methodologically wrong. The other side has inside numbers nobody outside can verify. A reader cannot settle either one. That is the harder problem with impersonation ads. Not only that they exist, but that the only party able to count them is the one selling the placement. Meta's own stated goal points somewhere useful: 90% of its global ad revenue from verified advertisers by the end of 2026. Who stands behind an ad is a thing that can be checked. A platform's total of what it removed is not. That checkable layer, who stands behind an ad or an account, is what Wakweli works on. It is early, and a direction rather than a finished answer. If you work in ad ops or trust and safety: what would you accept as an independent count of scam ads on a platform, and who would you trust to run it?

Meta says it took action against about 3.7 million accounts, Pages and pieces of content this year. Most were shell pages, set up in advance, never used. That number is easy to wave away, self-reported platform figures usually are. This one has a second source: the Singapore Police Force's own release on the same information-sharing effort, citing a close figure of its own, nearly 3.8 million scam-linked entities and pages. Two parties who do not share an incentive to inflate the same number arrived at close to the same order of magnitude. That is more than most platform transparency reports offer on their own. It does not tell you what "shell page" means in practice, how many were live long enough to defraud anyone, or what fraction of scam activity 3.7 million actually represents. A large removal number and a large problem can both be true at once. If you work in platform trust and safety, what corroboration would you want before you trusted a platform's own takedown count?

The FTC just published a number that reframes impersonation scams as a platform problem, not just a scammer problem. In 2025, the FTC received more than 1 million reports of impersonation scams, with losses near $3.5 billion. Nearly 30% of people who lost money to any scam said they were first contacted on social media, accounting for $2.1 billion of that total. The FTC is not just citing the number. It opened a rulemaking process asking whether platforms' own ad-optimization tools help promote impersonation scams to the people most likely to fall for them. That is a different question from whether the platform removed the ad after the fact. It asks whether the platform's own targeting made the scam more effective before anyone reported it. If ad-optimization systems can be shown to preferentially deliver impersonation scams to vulnerable targets, what would a fix actually look like: better detection, or a different default for how ads get targeted?

The FBI just put a number on scams where the caller pretends to be the state. Between January 2025 and July 2026, the FBI's IC3 received nearly 61,000 complaints of law enforcement or government impersonation scams, with losses of more than $1.6 billion. That is 19 months of self-reported US complaints, so do not stack it against an annual figure. The detail worth stopping on is in the same alert. The FBI says scammers now use AI to appear as law enforcement and government officials on video calls with victims. Think about what that attacks. When something feels off, the standard advice is to check with an authority. This scheme impersonates the authority. The call you would make to verify is the call you are already on. The FBI's own defence is interesting because it is not about spotting the fake. It is a rule: authorities will never contact the public by phone or text to demand payment or ask for sensitive information. That works because it does not depend on how good the video looks. It turns a judgement call into a fact you can check. That is the direction we think trust has to go: proof of who is on the other end, checkable before you believe the face, instead of a sharper eye for fakes. At Wakweli that work is early, and it does not stop this scheme today. If you or someone close to you got one of these calls: what was the first thing that made you doubt it, something you saw or something you checked?

The UK regulator just attached a date and a penalty to deepfake removal. Ofcom announced on 9 September that platforms will be required to deploy hash-matching technology by 30 September 2026 to detect and prevent the sharing of illegal intimate images and AI-generated deepfakes. Failure exposes a platform to fines of up to 10% of its global annual revenue. Two things to hold before reusing that. The duty, and the linked 48-hour removal rule, are described as forthcoming and arriving via upcoming legal changes, not as law already in force on the day of the announcement. And Ofcom's figure of over 369,000 women in the UK experiencing this abuse annually is a prevalence estimate the release does not attach a methodology to. Now the part that matters if you build detection. Hash matching compares content against a database of material already known to be abusive. It is good at that job. It is the right tool for stopping the ten thousandth copy of an image that has already been identified. It does nothing about the first copy, and Ofcom's own release does not claim otherwise. A deepfake nobody has seen yet has no hash in any database. With a synthetic intimate image, most of the harm is done on the first circulation, not the ten thousandth. So what is being built is a fast, well-funded, revenue-backed answer to redistribution, sitting on top of an unsolved problem of first appearance. That is not a criticism of the duty. It is a description of the seam. The other end of that seam is making "a real, accountable party stands behind this" checkable before an image or an account is believed, so that missing proof becomes the tell instead of the quality of the fake. That is the direction we work on at Wakweli, and it is early. If you work in trust and safety: what share of what you take down is a repeat of something already in your hash set, and what share is something you had never seen before?

A French court has confirmed that a DNS resolver can be ordered to stop answering. On 15 July 2026 France's Conseil d'Etat dismissed Cloudflare's challenge to an order from Arcom, the French media regulator. Arcom had identified 19 web addresses deemed to be spreading material from Russian state media entities under EU sanctions, and on 9 July 2025 notified Cloudflare to prevent access to those services on French territory within 72 hours. What makes this different from a platform takedown is where the duty landed. Cloudflare did not host that material. It resolved a name to an address. The order reached past the party publishing the content to the infrastructure that merely points at it. That is the pattern worth watching, whatever you think of the underlying sanctions. Enforcement against disinformation is moving down the stack: publisher, then host, then resolver. Each step down makes the measure broader and blunter at the same time. A resolver cannot inspect what it is being asked to block. It can only stop answering. And a name made unreachable in one country, at one resolver, is not a claim that has been answered. Reachability is not authenticity. Blocking changes who can get to a source. It does not change whether the source was ever what it said it was. Which is why the layer we work on at Wakweli is the other one: making who stands behind a source checkable up front, so a reader can tell a sanctioned state outlet from an independent one without a regulator having to decide which addresses stop resolving. Early, and a direction rather than a finished answer. For anyone who runs infrastructure rather than a platform: where in your stack would an order like this land, and have you ever been asked to act on something you had no way to inspect?

Australia's financial regulator just put numbers on AI-generated endorsement fraud, and the most useful line in it is not a number. Across its 2026 financial year, ASIC removed more than 19,400 online scams, up 182% on the year before. Inside that total: 7,051 fake investment platforms, up 151%, and 5,476 phishing hyperlinks, up 279%. One honesty note on those percentages before anyone reuses them. They count what a regulator took down, not what existed. Part of that curve is enforcement capacity growing, not purely the threat growing. Takedown counts are an activity measure. The line that does more work than any of the figures is ASIC's own description of the method: celebrity impersonations are often just one part of a broader scam network. That reframes the whole thing. The deepfake of a familiar face is the front door. Behind it sit the fake platform, the fabricated reviews, the phishing link, the support agent who is also them. The synthetic video is not the scam. It is the credential that gets you to walk into the rest of it. Which is why detection keeps losing on timing rather than on accuracy. The fabrication is manufactured in bulk, in advance, cheaply. The removal happens afterwards, one item at a time, by an institution that has to find it first. You can win every individual takedown and still be structurally behind. ASIC also records $7.4 million in losses across the top impersonated public figures for that year. That is a narrow slice, not a national total, and worth quoting as such. The other end of the sequence is the part nobody is bored enough to build: making "this really is who they claim to be" checkable before the pitch lands, so the missing proof becomes the tell instead of the convincing face. That is the direction we work on at Wakweli. Real question, and you may know this better than we do: if you have ever reported a fake investment ad or a cloned celebrity endorsement to a platform, how long did it stay up after you reported it?

A dark-web service called Nexus was selling more than 153 million driver's license scans from US and Canadian residents. Krebs on Security reported it on 1 September, and the FBI's New Orleans field office opened an inquiry the same day. Where do 153 million license images come from? The reporting points, circumstantially, at an identity-verification vendor: the kind of service that scans your license at a rental-car counter, a dispensary or a hotel check-in to prove you are you. The vendor has not confirmed a breach, and the 153 million is the seller's own inventory claim, not an audited count. Hold both caveats. But look at the shape even if the attribution moves. The document you hand over to prove your identity is copied, stored, and then sold to someone who will use it to be you. The verification step is the leak. The more places check your ID by collecting it, the more copies exist, and every copy is a future impersonation. That is a design flaw, not just a bad vendor. Proving who you are by handing over the raw material of your identity means every checkpoint is also a warehouse. The direction we work on at Wakweli is the other way round: a certificate saying that a real, accountable party stands behind this account or claim, checkable by a stranger, without the stranger receiving a copy of your license. The check should not leave you more exposed than you were before it. Real question, since many of you will have a better answer than us: when did you last hand over a license to be scanned, and do you know where that image is stored today?

The FBI Boston field office is warning about a scam where the callers spoof the Bureau's own published phone number. If you look the number up to check it, it matches. Then they push you onto an encrypted messaging app, where nothing is logged. Sit with what that breaks. Almost every piece of advice anyone gives about impersonation ends with "verify through the official channel." Here the official channel is the attack. Scale of the category, for context: the FBI records 32,424 US victims of government impersonation with losses over $797 million. Those are national figures for the whole of calendar year 2025 and for the whole category, not for this one scam and not for this month. A caller ID is a claim, not a credential. It was never built to prove anything, and it can be set to whatever string you like. What needs building is a way for the institution to sign what it sends, so that a missing signature is the tell before the person on the other end has to make any judgement call at all. That is the direction we work on at Wakweli. Genuine question, because you may know better than we do: if you have ever tried to verify an inbound call from a bank, a tax office or a police force, what actually worked? Not the advice you have read. The method you used. Source: FBI Boston, fbi.gov/contact-us/field-off…

Nearly $200M taken from consumers by a credit-repair operation the FTC just shut down. No deepfakes. No voice cloning. No AI anywhere in it. The tool was a phone call and a borrowed name. Telemarketers posing as debt collectors and creditors. Military servicemembers were specifically targeted. Worth sitting with, because the deepfake news cycle makes this look like a synthetic-media problem. It isn't. It's an unverifiable-identity problem, and it was already running at nine figures before the AI tools showed up. AI didn't create the gap. It dropped the price of walking through it. Which is why the fix has to land before the contact, not during it. Asking people to detect a liar mid-call is a losing game. The answer is making "this really is who they claim to be" checkable up front. That's the direction we're building at Wakweli. Source: FTC press release, 2026-08-10. ftc.gov/news-events/news/pre…. Figure is the amount obtained from consumers, not the amount recovered for them.

A Wakweli member raised a sharp idea on 17 June 2026. Next to every recommendation the platform makes, show a "Why am I seeing this?" link that spells out the real reason. For example: you're a certifier, you took part in these certifications, or this reflects your contribution score. It's worth noticing the shape of that request. Provenance for content is going mainstream. Provenance for people is exactly what we are building. And provenance for recommendations belongs to the same family: don't just serve someone a result, show your work. Personalized feeds are still a work in progress on our side. Right now everyone essentially sees everything. But this is the direction we want to head, and the idea came from the community, not from us. Want to push it further? The drafts are open for comment on the Wakweli portal right now. Tell us what a good "Why am I seeing this?" should actually reveal.

$115M extorted in 120 network intrusions across 47 US entities. The way in wasn't a secret software flaw. It was phone calls and text messages that impersonated real employees to trick help-desk staff into handing over the master passwords used to unlock every internal system. In some cases: fake police emails sent from compromised government mailboxes, extracting subscriber data. This is the shape of the trust gap in 2026: high-value breaches now hinge on identity impersonation of employees, help desks, even law enforcement. Not malware. People pretending to be people. The counter is revocable, platform-independent proof of who's on the other end. That's the layer we're building. Source: krebsonsecurity.com/2026/06/…

The EU AI Act's transparency obligations for AI-generated content became enforceable on 2 August 2026. Deepfakes, AI-written text meant to inform the public, synthetic media in ads. All of it now legally requires visible labels across the EU. Labels are a floor, not a solution. Detection alone was never going to keep up. What comes next is provenance: cryptographic proof about who and what made a piece of content, portable across platforms, revocable. That's the layer we're building at Wakweli. Source: artificialintelligenceact.eu…

The EU AI Act's transparency obligations for AI-generated content became enforceable on 2 August 2026. Deepfakes, AI-written text meant to inform the public, synthetic media in ads — all now legally require visible labels across the EU. Labels are a floor, not a solution. Detection alone was never going to keep up. What comes next is provenance: cryptographic proof about who and what made a piece of content, portable across platforms, revocable. That's the layer we're building at Wakweli. Source: artificialintelligenceact.eu…

A post-quantum Layer 1 blockchain, @Quantos_tech , has certified its official links through Wakweli's Proof-of-Democracy protocol! Verified by the community. 🤝 Secured on-chain. ⛓️

Ghana's EOCO and the UK's NCA just returned $15M to victims of an "investment platform" scam. Thousands signed up because the platform looked legitimate. Blockchain analysis was strong enough to trace and return the money — months later. Recovery works. It's also always the after-effect. By the time the $15M comes back, the trust was already given, the money already sent, the harm already done. The trust layer we're building isn't about better recovery. It's about making "real" provable up front — so the "investment platform" can't look legitimate to begin with. Verify before. Don't recover after. Source: chainalysis.com/blog/ghana-e…

T-6 days. On 2 August 2026 the EU AI Act Article 50 turns AI-content labelling from "best practice" into obligation. Every deepfake ad, every synthetic voice pitch — legally required to identify itself. The question stops being "can we detect it" and becomes "who verifies the label." That's the layer we exist for.

J-6. Le 2 août 2026, l'article 50 de l'AI Act européen transforme l'étiquetage des contenus IA en obligation légale. Chaque deepfake publicitaire, chaque voix synthétique en démarchage — tenus de se déclarer. La question n'est plus « peut-on détecter » mais « qui vérifie l'étiquette ». C'est la couche pour laquelle nous existons.

T-9 days. On 2 August 2026 the EU AI Act Article 50 turns AI-content labelling from "best practice" into obligation. Every deepfake ad, every synthetic voice pitch — legally required to identify itself. The question stops being "can we detect it" and becomes "who verifies the label." That's the layer we exist for.