Meta Pixel is a tracking code that websites use to measure their Facebook and Instagram ads. Each Pixel ID tags data to its owner. Scam networks abuse it by loading dozens of Pixels on throwaway job-scam sites before pushing victims to WhatsApp. Their habit of reusing the same Pixel IDs across domains is what links those sites to a single operator.
Meta Pixel is one of the most widely used tracking tools on the web. Millions of websites use it to measure the results of their Facebook and Instagram ads. The same tool is now part of the toolkit of online scam networks, and the way they use it can also give them away.
What a Meta Pixel ID Is
A Meta Pixel is a small piece of JavaScript that a website owner installs to send visitor activity back to Meta. Each Pixel is created in Meta's Events Manager and given a unique number, the Pixel ID. Every event sent with that ID goes to the Business Manager account that created it, so a Pixel ID works like an owner tag on a website.
How It Works
The owner pastes the Pixel's base code into the header of every page. The code loads Meta's `fbevents.js` script and starts the Pixel with the owner's ID.
From there, the process has six steps:
1. Create: The advertiser creates a Pixel in Events Manager and gets its ID. 2. Install: The base code is added to the website header. 3. Click: A user clicks a Meta ad, and the link carries a click identifier (`fbclid`). 4. Fire: The Pixel sends events such as PageView, AddToCart or Purchase to Meta's servers through requests to `facebook.com/tr?id=PIXEL_ID`. 5. Match: Meta uses browser cookies to match the visitor to its own data and build a profile of their behaviour. 6. Use: The advertiser uses the data for reporting, ad optimisation and retargeting audiences.
The owner sees each data source, event and match-quality score in Events Manager.
How It Is Abused
A legitimate website normally loads one or two Pixels, and each one reports to a single ad account. Scam landing pages often load many more, in some cases 30 or more Pixel IDs on one page. That sends the same visitor data to several unrelated ad accounts at once, spreading the tracking across accounts and making it harder to trace.
Research partners of the Ministry of Cyber Affairs have displayed how this works in a WhatsApp task scam:
1. Fake ad: Disposable Facebook and Instagram pages, often with zero to six followers, advertise "earn money from home" commissions.
2. Scam site: The ad leads to a throwaway domain made to look like a job site.
3. Hidden Pixel fire: The page silently fires several Pixels, collecting the visitor's IP address, device details and click events, which lets the scammers optimise their ads.
4. Redirect: A JavaScript redirect sends the visitor off the site.
5. Messaging app: The victim lands in a WhatsApp chat, where "task" instructions lead to payment fraud.
Modus Operandi
Scammers rotate domains quickly, but they tend to keep the same Pixels, because a Pixel's history of training data makes their ads cheaper and more effective. That reuse is their weak point. In the original investigation, seven disposable domains all fired the same Pixel, and a second Pixel appeared on six of the seven. The domains were different, but the owner was the same. Investigators can group sites by shared Pixel IDs, tie throwaway domains to a single operator, and report the whole cluster at once.
This isn't a sophisticated hack, it's a business model failure that Meta has allowed to run for years. Anyone can spin up a Facebook Page with zero followers, a stolen profile picture, and a fake name like "Seeking Talent in India" and be running paid ads targeting desperate job seekers in India within hours. Meta's own system then does the rest: it lets that single disposable landing page fire 30+ Pixel IDs at once, it lets the same two Pixels, masked here as PIXEL_A and PIXEL_B, link seven different throwaway domains together, and it optimizes the scam to find more victims because a "WhatsApp click" looks like a successful conversion. Domain bans are meaningless theater when the audience lives under the Pixel ID, not the domain. Meta knows this clustering signal exists, has the data to block shared Pixels and auto-ban advertiser networks on sight, and chooses not to. Because every one of those fake Amazon and Shopee task ads is still a paid ad.