How our fake 'scam' ad breezed through Facebook's approvals process

If you're a Facebook user, it's more than likely that you'll have scrolled past or even unknowingly interacted with a scam ad in your news feed.

These fraudulent adverts - along with other social media scams - continue to become more sophisticated, sometimes resulting in victims putting life-changing sums of money into the hands of criminals.

Facebook is not the only social media platform that suffers from scams, but it's by far the UK's most widely used. One type of scam that often appears on Facebook is for get-rich-quick schemes that fraudulently use the names and images of celebrities who supposedly endorse the scheme.

In 2018, Money Saving Expert's Martin Lewis sued Facebook for defamation after it failed to take sufficient action to prevent a series of fraudulent third-party ads, where his details were used to endorse sham get-rich-quick schemes.

Martin settled the suit after Facebook finally agreed to key measures to stamp down on scams - you can see the details in Facebook's comments, below. But many of these measures will only kick in once a scam ad has already been published.

And with 99% of Facebook's total global revenue coming from advertising, we wonder how motivated it is really feeling to stamp out scam ads?

We decided to put Facebook to the test to see how well it stops scams from infiltrating its network in the first place, by making and posting a fake ad of our own.

Read about spotting a social media scam

What happened when we posted a fake scam on Facebook

Scams can spread like wildfire on social media, the very nature of which encourages us to share and like posts so that they are seen by as many people as possible.

Some potential scams may seem innocent at first - for example, a simple quiz that ultimately gets you to reveal the answers to common banking security questions. We've also seen cases where scammers pose as your Facebook friends and reach out, claiming they are in urgent need of money.

Inspired by a Tesco voucher Facebook ad that the supermarket confirmed as fake, we got to work and made a copy (below). We hosted the fake ad on a business profile on Facebook, which pointed towards a website we cobbled together using an online website creator.

In just a couple of hours, our fake ad was live. It stayed up for around a day, convincing some Facebook users to take a trip to our fake website (below) for some 'exclusive' savings.

Eventually, our Tesco ad was 'flagged for policy violations', presumably by one or more eagle-eyed Facebook users.

When we asked Facebook to explain its ad review process, it told us that 'there's a proactive review every time someone submits an ad ... with artificial intelligence and human review'. Its terms and conditions also state that ads may not be approved if the landing page content isn't fully functional. Our ad obviously weaved its way through this monitoring process.

We tried publishing a second fake ad promoting a cryptocurrency opportunity, but that one didn't go beyond the initial review process. That's good news, but the fact that our Tesco ad was online for so long is concerning.

Our fake Facebook scam in numbers

In the time that our fake ad was visible on Facebook, we received 34 comments. Most of the feedback pointed out that the ad wasn't real - some of those messages came from Tesco employees.

We're pleased that many of the comments called us out on our activities, but the number of clicks and shares suggests many users were taken in by our ad.

Our graphic below shows how long it took from the time we submitted our fake ad for it to be vetted, posted live and subsequently taken down.

What Facebook had to say

When we put our concerns to Facebook, it said: 'We removed the fake ad run by Which? for violating our policies against deceptive, false or misleading content at the time. We are taking action to stop fraud wherever it appears, and will continue to adapt to the increasingly sophisticated techniques fraudsters use to con people.'

'As part of this work, we are donating £3 million to Citizens Advice to deliver a new UK Scam Action Programme and creating a new scam ads reporting tool on Facebook in the UK, supported by a dedicated internal operations team.'

Neither Facebook's ad-reporting button nor the Scam Action Programme are 'live' yet. It's a step in the right direction, but not perfect. And while scammers use devious and ever-evolving tactics to slip through the review process, our investigation suggests that Facebook's ad approval process could be more stringent.

Martin Lewis and his lawsuit against Facebook

In April 2018, Martin Lewis issued High Court proceedings for defamation against Facebook, pledging that any proceeds would go to charity.

Martin told us: 'I found out about my details being used to promote fraudulent, get-rich-quick schemes a couple of years ago. My eyes were properly opened when someone who'd fallen for a scam investment ad contacted me and demanded his money back - he genuinely believed I'd backed the scheme.

'I contacted Facebook and other social media sites, but got very little back.

'We reported 75 scams, but they often took weeks to be taken down, and were usually instantly replaced. We later found out that more than a thousand such ads had been published on Facebook - but because we never saw most of them personally, we couldn't report them.

'Existing law and regulation simply isn't good enough to make them take action to protect people - there isn't a regulator that takes overall responsibility for scams. I've been campaigning to the government to sort this out.

'Eventually a lawsuit was my only course of action, so I sued Facebook for libel - the only law that I could use. All I could do was sue for damage to my reputation, rather than the fact these ads were on the site in the first place.

'Finally this got the attention of Facebook's 'top table' people, and I settled the lawsuit after it agreed to key measures.'

Social media sites must do more to stop scams

Our investigation shows that more work is needed to protect social media users from scams.

Which? has already successfully campaigned for banks to take responsibility for refunding blameless victims of bank transfer scams. Now it's time for Facebook and other social media sites to do more to stamp down on scams and ensure that the content that appears on their platforms can be trusted.

Other Facebook scams to watch out for

Bogus celebrity endorsements

These ads promise that famous figures such as Martin Lewis, Deborah Meaden and even celebrity chef Gordon Ramsay recommend a sure-fire investment scheme, such as Bitcoin. Genuine images of the celebrities on TV are often used, with fraudulent wording overlaid.

Information-mining quizzes

Most Facebook quizzes are innocent, but some appear to have a more sinister goal, asking questions that would reveal answers to common security questions - your mother's maiden name, or home town, for example. A 2018 Royal Wedding quiz asked questions, including your first pet's name, to create a 'Royal Wedding Guest Name'.

Fake voucher giveaways

Often these posts claim that a big brand is giving away vouchers (or other prizes) in exchange for filling in a survey. In reality, the retailers will know nothing about the giveaway. If you receive a 'voucher' - after handing over your personal details - it won't work.

Profile hijacking

A scammer hacks a Facebook user's profile, or uses publicly available information to create a duplicate profile, and contacts everyone on the user's friends list. Tactics can include asking for money to help their 'friend' out of a difficult situation, or simply making other scams sound more convincing as they appear to be from a friend, such as offers for fake goods or warnings about serious 'security' issues.

Read our advice on how to report a scam if you see one.