How Facebook-sponsored posts aid falsified information

Recent findings from an online investigation conducted by Daily Trust on Sunday indicate that scammers have resorted to using sponsored posts on Facebook to amplify their fraudulent schemes as a means to target desperate Nigerians. These posts typically take on the guise of outdated federal government COVID-19 loans, free scholarship opportunities, mobile data offers and […]

Recent findings from an online investigation conducted by Daily Trust on Sunday indicate that scammers have resorted to using sponsored posts on Facebook to amplify their fraudulent schemes as a means to target desperate Nigerians. These posts typically take on the guise of outdated federal government COVID-19 loans, free scholarship opportunities, mobile data offers and job adverts in order to entice and lure unsuspecting victims to malicious websites. The ultimate goal of these scams is to steal the personal data of individuals and deceive them into giving away their money.

After conducting an analysis of several websites using Open Source Intelligence Techniques (OSINT), it was revealed that a number of them are operating as phishing sites while others use false information to attract visitors. This deceptive tactic is used to generate traffic to the sites, where visitors are at the risk of having their personal information compromised. Additionally, the individuals responsible for these scams are using inactive Facebook pages to post their advertisements. In many cases, these posts do not even appear on the pages themselves, making it even more difficult for unsuspecting individuals to identify and flag them as fraudulent.

How sponsored ads work

According to an article by the Native Advertising Institute sponsored posts are described as regular posts on Facebook that are paid for in order to reach a wider audience. This allows such posts to be visible to individuals who are not directly connected to the person who made the posts. According to the article, many businesses have adopted this approach due to changes in Facebook’s algorithm, which have reduced the number of organic posts that appear in users’ news feeds.

It is worth noting that sponsored adverts differ from Facebook ads in that the former involves boosting the visibility of a regular post in order to increase user engagement (such as likes and comments), whereas the latter is a paid service that allows subscribers to create custom advertisements with specific designs and targeted audiences. The only difference is that a sponsored post is labelled as such without more information about who is sponsoring the advert.

Increased violence, vote buying mar governorship, assembly polls – CDD

AGRO SOLUTIONS: 13 things successful grain farmers do

How scammers prey on Facebook users

For many years, Nigerians have been turning to Facebook as a primary means of connecting with friends and staying informed on current events. With a youthful population similar to other parts of sub-Sahara Africa, the use of Facebook has become deeply entrenched.

According to a report by Statista, Facebook is the second most popular social media platform in Nigeria, after WhatsApp. A report published in January 2023 also revealed that 28million Nigerians, largely made up of those between the ages of 25 and 34, use Facebook, followed by those aged between 18 and 24. This substantial number of individuals utilising this social media platform has made it an ideal environment for the spread of falsified information with the aim to exploit unsuspecting users.

Given the various challenges currently facing the country, including but not limited to inflation, high rate of unemployment and rural-urban migration, it can be reasonably concluded that the spread of falsified information has been facilitated by these difficulties.

Nigeria has seen a significant rise in inflation over the past year, with government figures indicating that 42.5 per cent of young people are currently unemployed. In response to these challenges, the government implemented a COVID-19 stimulus package in 2020 to alleviate the economic strain on businesses and individuals. The package, which was in the form of loans, was intended to revive socio-economic activities that had been adversely impacted by the pandemic. Although economic activities have begun to pick up slowly, the stimulus package expired in 2021.

Scammers are well aware of the popularity of the Facebook platform among Nigerians and have capitalised on this by exploiting the economic challenges faced by citizens. They use a combination of outdated COVID-19 loans and fake free scholarships to attract the attention of unsuspecting Facebook users.

Since posts on Facebook are typically only viewed by followers and those who have liked a particular account, scammers have begun utilising sponsored posts feature in order to reach a wider audience. By leveraging advertising tools developed by the platform, even individuals who are not connected to the accounts can be targeted by these fraudulent adverts.

How scammers utilise sponsored ads feature

Meta has put in place efforts to promote transparency in its advertisements by developing an Ad Library that archives ads related to social issues, elections or politics for up to seven years. The Ad Library includes information about who funded the ad and the audience targeted by the advertiser. However, despite these efforts, scammers have been successful in tricking users by spreading false information through sponsored ads. Additionally, the library is not capable of recording ads created through sponsored posts, which makes it an attractive target for scammers to take advantage of the sponsored ad feature by abusing its intended purpose and violating the terms of use.

Our investigation revealed that more than 20 posts on the platform were part of coordinated efforts by scammers to defraud users. We thoroughly documented and reviewed these posts and found that they often utilised the same images and design across multiple accounts. These posts were specifically crafted to prey on unsuspecting users. This is an alarming trend that must be addressed.

Since most of the cash grants that were provided by federal government agencies mandated the submission of a Bank Verification Number (BVN), scammers have exploited this requirement by setting up phishing sites that trick unsuspecting individuals into entering their BVN numbers, which the scammers use to drain the individual bank accounts. Other fake grant programmes that do not request a BVN number often require the applicants to share the website link with their Facebook or WhatsApp contacts in order to redeem the falsified loan. This is after collecting their personal information.

In an attempt to make their offers appealing, some posters promoting COVID loans and other government financial interventions feature a picture of the country’s president. In one instance, scammers used a manipulated tweet from a media aide to the Nigerian president to announce the availability of the loan.

The scammers use a similar gimmick where they present a hyperlink that appears to be the authentic gateway to the associated educational agency. They reroute those who visit the said hyperlink to a separate website that features content pertaining to swindling educational scholarships.

Upon conducting a more in-depth analysis of a link provided in the fraudulent sponsored post, it was discovered that it redirected any visitor who attempted to access it to a website that appeared to be a phishing site. At the time of this publication, the phishing website had been removed, but the link and its contents were archived for further reference.

Upon further analysis, it was gathered that some of the misleading sponsored posts lead to websites where the scammer’s post links to several characteristics, with some being phishing sites designed to trick people into divulging sensitive information. Others are online forms that lack links to the actual loan application portal, and some redirect visitors to subscribe to a particular product.

It is crucial to remain vigilant and skeptical when assessing such posts, to avoid falling prey to fraud.

Operation in disguise

One of the posts advertising free scholarships include a Facebook account by the name of Williams Petro, who urged those interested in the scholarships to contact him through the comment section. When our reporter contacted Petro through Facebook messenger to express interest in the scholarships, he was informed that Petro was involved in cryptocurrency and resided in Ukraine. Since our reporter was unable to obtain any information regarding the scholarships from Petro, the conversation was stalled for some time.

A few weeks later, Petro reached out to our reporter and inquired if he was still interested in registering for the scholarship. He responded positively and Petro then messaged thus, “Look, you don’t have to be afraid, you are at the right place for your scholarship, but you have to be registered so you can have all the necessary requirements.”

Asked about the registration fee, Petro initially quoted $100 but later reduced it to $50, claiming that the reporter was a “beginner” in their company. Petro urged the reporter to use any cryptocurrency to send the money, and to use TrustWallet for the transaction. He stated that the reporter would need to pay an additional $150 for visa processing.

Petro’s sense of urgency in the conversations with our reporter indicated a level of desperation as he stated that there was the need to act quickly and proceed with the registration process.

A check on Petro’s Facebook profile revealed that he is from Ukraine and is involved in the cryptocurrency industry. However, it was noted that his Facebook location was set to Port Harcourt, the capital of Rivers State in Nigeria.

Upon conducting a reverse image search using one of the pictures posted on his Facebook account, it was discovered that the same image had been used by a Twitter account under the name, Adex.

Further investigations revealed that the Twitter account belonging to Adex, who is also into crypto, was from Florida in the United States. Adex and Petro appeared to be the same person based on the pictures on their profiles.

However, during the conversation, Facebook gave a pop-up warning message that reads, “Scams often begin as messages from strangers. Be wary of claims about, and never send payments to someone you don’t know,” but this might not be effective as scammers tend to prey on the needs of their victims in order to achieve their fraudulent objectives.

Uncovering website identity

After analysing some of the websites through Scamadviser, a tool used for verifying website safety, it was discovered that the majority of them conceal their identities by hiding their WHOIS data.

An in-depth analysis of some websites revealed that they display traits indicative of fraudulent behaviours as demonstrated by their low trust scores.

For instance, Qatar Scholarship and the Website 2023 both received a score of one out of 100 on Scamadviser’s trust rating. This low score was attributed to a number of factors, including the concealment of the website owner’s identity on WHOIS, the presence of malware on the site in the past, the location of the site in a high-risk country, the server of the site hosting several low-rated websites, the relatively young age of the site and an inability to analyse the site’s content.

In conclusion, it is essential that Facebook and individual users take responsibility for preventing the spread of such information and prioritise the accuracy and truthfulness of the content.

This article was produced with mentorship from the African Academy for Open Source Investigations (AAOSI) to tackle disinformation that undermine democracies as part of an initiative by the International Centre for Journalists (ICFJ) and Code for Africa (CfA), in partnership with Daily Trust Foundation.