At the scale of FB, handling fraud is a non-trivial effort. At any given time there are probably thousands of somewhat well funded fraud teams looking to bypass

At the scale of FB, handling fraud is a non-trivial effort. At any given time there are probably thousands of somewhat well funded fraud teams looking to bypass whatever shiny new countermeasure FB adds to their site. There is a lot of money to be made from defrauding FB users. This monetary incentive results in criminals investing tons of effort into bypassing anti-fraud stuff. It is a non-stop effort of incremental moves on both parties that will carry on for as long as FB users remain a juicy target.