How can cybercriminals weaponise House Hold Income based advertisement targeting of Meta

October 6, 2026, New Delhi, India : Ask Meta to show your ads to the “top 10%” by household income, and you get two different things. In the US, you reach people in the richest tenth of ZIP codes. In India, you reach people Meta estimates live in the richest tenth of households.

The US version is an area average built from public data, and it has been around since 2018–19. The India version began rolling out quietly in late September 2025, and Meta hasn’t published the details of how it works.

Read side by side, Meta’s own Ads Manager numbers show how differently the two systems behave, and how loosely “top 10%” should be read in both.

The US: ranking neighborhoods

In the US, Meta’s income bands describe where you live, not what you earn. Meta sorts ZIP codes by average household income and offers four bands: the top 5%, top 10%, top 10–25% and top 25–50%.

When MarTech covered the feature in 2019, Ads Manager said the income data was based on public information, matched to the ZIP code users say they live in. A 2018 agency post said the figures come from the IRS, but Meta’s interface didn’t name a source.

So a student renting in a wealthy ZIP code counts as “top 10%”, while a high earner in a mixed neighborhood doesn’t. And because the bands count ZIP codes rather than people, they aren’t equal in size.

By the numbers: Source: Meta Ads Manager, October 2026. Shares use midpoint of each range.

• Top 5% (15.1–17.8M Meta accounts), sits inside top 10%, ∼13% of top-half accounts
• Top 10% (31.2–36.7M), 20% of top-half ZIP codes, 26.6% of top-half accounts
• Top 10–25% (39.5–46.5M), 30% of ZIP codes, 33.7% of accounts
• Top 25–50% (46.5–54.7M), 50% of ZIP codes, 39.7% of accounts

The richest ZIP codes hold more than their share of Meta accounts, and the 25–50% band holds less. Nothing is offered below the top 50%.

India: estimating each person

In India, the bands describe a person’s estimated household income, not a neighborhood. Under Demographics > Household income > India, advertisers see six bands: top 10%, 11–20%, 21–30%, 31–40%, 41–50% and lower than 50%.

Meta’s description is brief: people whose household income “is estimated to be in the top 10% within India.” It doesn’t say what the estimate is built from.

What India’s numbers show

India’s six bands add up to 1.09–1.29 billion Meta accounts. That’s more than the 1.03 billion internet users DataReportal counted in India at the end of 2025.

The gap is possible because Meta counts accounts, not people. Meta says audience size isn’t a measure of active users, partly because one person can hold several accounts. Facebook said in a statement reported by MarTech that its reach estimates “are not designed to match population or census estimates.”

Meta accounts per 10% household-income band · dot = midpoint, line = Meta's low-high range. Bottom band shown as total ÷ 5. Source: Meta Ads Manager, October 2026

Spread evenly, each 10% band would hold about 119M accounts; the top band holds about twice that, 232M at midpoint. Ten percent of India’s 1.47 billion people is about 147 million, so its accounts work out to roughly 1.5–1.7 per person. Either many people in it hold several accounts, or Meta places too many people there; the numbers can’t say which.

Lower down, the 31–40% (88M) and 41–50% (76M) bands hold fewer accounts than the bottom half’s average (112M). That doesn’t fit a simple story in which richer people hold more accounts.

Every range we recorded, in both countries, has the same shape: the high end is exactly 1.176 times the low end. Meta switched to ranges in 2021 for consistency with other ad platforms, so a range’s width is fixed, not a measure of confidence.

How criminals and other actors could abuse the feature of Meta Ads

In India, where the band is an individual estimate, the pattern is straightforward. The top 10% band is a ready-made list for investment scams, fake luxury and crypto schemes, romance scams that need a wealthy mark, and business-email-compromise lookalikes that sell “premium” services. One advertiser we spoke to put it bluntly: if you can tell Meta you only want rich people, you don’t have to waste money showing a ₹2-lakh watch scam to someone who can’t afford it. At the other end, the bottom 50% and 41–50% bands are useful for predatory lending, “instant loan” apps, gambling and betting apps, fake work-from-home and government-job schemes, and high-fee training courses that promise income. When money is tight, a promise of quick cash converts better.

Income is one of the most powerful qualifiers for fraud, which is exactly why a reliable income filter is valuable, and risky. For a scammer it means higher return on ad spend.

Different rules in each country

The rules on sensitive ads differ too. For housing, employment and financial-services ads, Meta restricts targeting; ZIP-code targeting, for one, is unavailable.

Meta’s developer documentation applies those limits to advertisers based in the US, or to ads targeting the US, Canada or Europe. An Indian advertiser targeting India falls outside them; a US-based advertiser doesn’t. Meta has since renamed the credit category “financial products and services.”

India’s own privacy rules are still arriving. The Digital Personal Data Protection Rules were notified on November 14, 2025, and their data-processing provisions take effect 18 months later, around May 2027. How an estimated income band fits under them is an open question worth putting to Meta.

The twist: the band is often only a hint

Picking an income band often doesn’t limit who sees an ad. Since late 2025, Meta has treated detailed targeting, where the income bands sit, as a suggestion for most campaign goals.

That holds even when advertisers switch off Advantage+ audience, Meta’s automated targeting, according to Jon Loomer, who tracks Meta’s ad tools. The goals include conversions, link clicks, landing page views, app events, leads and calls. For those, Meta can show ads outside the chosen band when it expects better results.

Only goals outside that list, such as reach, can keep the band as a hard limit. Location and minimum age stay firm either way. In practice, the band tells Meta where to start looking, not where to stop.

Why India matters to Meta

India gives Meta huge reach but little revenue per user, so tools that pick out richer buyers could matter commercially. Meta India’s advertising revenue rose 29% to ₹29,392 crore in fiscal 2025 (April 2024–March 2025), exchange4media reported.

What it means

For advertisers:

• US: the band is a neighborhood average, so it suits area-level campaigns, not individual wealth.
• India: the band is Meta’s estimate, so test it against a campaign without it before trusting it.
• Both: check whether your campaign goal turns the band into a suggestion, and use location for anything that must be a hard limit.

For users: Meta’s income bands are estimates, not answers you gave. Your ZIP code decides in the US, and undisclosed signals decide in India.