Facebook and similar companies are generally not legally liable, under "Section 230". "Interactive computer services" have special statutory immunity, whereby they are deemed not to be "publishers", when they simply host material disseminated by some third party (an "information content provider" i.e. the person who posts the material).
Facebook could be prosecuted for fraud if it were itself actually publishing fraudulent material, but Facebook is instead treated more like a copy shop. As put by the 9th Circuit court in Barnes v. Yahoo, "publication involves reviewing, editing, and deciding whether to publish or to withdraw from publication third-party content". There is, of course, some controversy over whether Facebook does reviewing or decide whether to withdraw third-party content, but so far, Facebook is not a publisher, therefore it does not have a publisher's legal liability.
One well-known area of legal liability that Facebook would face is copyright infringement. If a user posts infringing material, the "interactive computer service" potentially has liability for contributory copyright infringement, unless it follows what is known as the "DMCA safe harbor", a routine whereby the service takes down infringing material when notified in the correct manner that there is infringement. The full law (§230) provides other areas where there is no immunity, such as sex trafficking. obscenity, sexual exploitation of children, or wiretapping (i a broad sense).
