Fraudsters can create scam Facebook and Google ads within hours, Which? reveals

A lack of effective controls on Facebook and Google could allow fraudsters to create and post fake adverts to target victims and spread misinformation within a matter of hours, a Which? investigation has revealed. 

Facebook and Google accounted for the majority of the UK’s digital advertising market in 2019, earning 80% of the £14 billion expenditure in this industry, according to the Competition and Markets Authority (CMA). While thousands of legitimate businesses use these platforms to advertise their products or services, in recent years, fraudsters have also used fake companies and false information to lure in victims and steal significant sums of money from them.

The consumer champion created two linked fake companies – a water brand named Remedii and Natural Hydration, an online service offering pseudo health and hydration advice – to expose how easy it is for fraudsters to create and promote false adverts.
Google, which earned £6 billion from UK search advertising in 2019, operates a pay-per-click system which allows businesses to compete for a prominent position on online searches.

The search engine giant has taken steps to improve ad transparency over the last few years and introduced a verification process for political advertisers in 2018. However, this has yet to extend to all advertisers on its platform – and it was shockingly easy to create and post a fraudulent advert.

Which? found that Google just required advertisers to have a Gmail account to create adverts and while it did review adverts submitted, it did not verify if the business existed or was legitimate, nor ask for proof of ID.

In under an hour, the adverts Which? created for both fake businesses were approved by Google and garnered nearly 100,000 impressions over the space of a month. Worryingly, the fake advert for Natural Hydration appeared above the official NHS Scotland pages when users searched for “hydration advice”.

In April, Google announced plans to improve advertising transparency that will require all advertisers to complete an identity verification programme providing proof of identity and/or business incorporation documents.

However, these rules do not come into force in the UK until early 2021 and Which? believes they do not go far enough, as advertisers could still be approved with just a valid UK passport and have 30 days to complete the verification programme. During this time all their ads would remain active – a loophole that could be exploited by scammers.

Facebook earned more than £2 billion from UK display advertising in 2019 and while it has restrictions when it comes to adverts that could cause harm, Which? found it was still worryingly easy to create a fake business page.

Using a personal Facebook account, which only requires an email address or mobile number to set up, Which? created a business page for Natural Hydration and produced a range of posts with pseudo health advice to promote it.

Which? paid Facebook to promote this page, which garnered 500 likes in a week.

In recent years, Facebook has implemented a series of rules restricting harmful advertising, but this does not prevent false advertising from slipping through the net.

Using targeted advertising on Facebook and Google, Which? was also able to tailor the audience who received the fake ads. On Facebook, Which? targeted females aged between 18-65 with interests in health & wellbeing, water and extreme weight loss. On Google, it was possible to target users who searched for terms such as “eczema treatment”, “high blood pressure” and “suicide”.

While Google does allow users to opt-out of personalised adverts, this setting is turned on by default on Facebook. This highlights just how easy it would be for unscrupulous advertisers who abuse the platform to target people with harmful or suspicious adverts.

The CMA has expressed concerns about Google and Facebook’s “unmatchable access to user’s data” allowing it to target advertising and dominate the industry.

Last month, the Advertising Standards Authority (ASA) and Internet Advertising Bureau (IAB), supported by Google and Facebook, launched a scam ad alert system to flag and remove suspicious and fake adverts.

However, the long-overdue scheme won’t remove scams ads immediately, instead the ASA will share reports of suspicious online ads with advertising platforms and publishers, who are then tasked with removing it.

Which? believes tech companies need to take a more proactive approach to stop fake adverts from appearing on their platforms in the first place.

Which? has called for fake and fraudulent content to be brought into the scope of the forthcoming Online Harms legislation. This would require platforms such as Facebook and Google to put better controls in place to prevent such content from appearing, take it down swiftly when identified or reported, and prevent criminals from exploiting their users.

Harry Rose, Which? Magazine Editor, said:
“Fraudulent activity is rife on social media and search engines and our investigation has exposed that a lack of controls on Facebook and Google has made it worryingly easy for fraudsters to create adverts promoting scams or fake products and services.

“Tech giants earn billions from advertising and should be putting more resources into preventing fraudsters from abusing their platforms, so consumers can trust that the adverts they see are legitimate.

“The government should widen its definition of “online harms” to include fake adverts and content, which would mean future regulation would require more action from tech companies to tackle false advertising.”

Notes to editor
Which? created two fake companies – Remedii and Natural Hydration – and paid Google and Facebook to advertise them. None of the ads contained any harmful content, and did not sell any fake products. All websites and content were removed once the investigation was completed.

Video available for use: https://www.youtube.com/watch?v=jt0_c_q9KSA

How to spot a fake ad

• Careful what you click on: Tech platforms want ads to blend in with regular post or search results. So be careful that you don’t end up clicking on something, without actually realising that it’s an ad.
• Who posted it?: With minimal checks on who can advertise online, always look into whether an advertiser appears legitimate. Is it a limited company? Does it have a business address or contact details beyond a generic email?
• Beware bad ads: If an ad has an unbelievable slogan, odd formatting, strange or poor-quality images or even spelling mistakes, don’t click on it. Preview the true URL of web links by hovering over them with your mouse. Avoid those that look dodgy – a jumble of numbers or letters is a clear giveaway.
• The claim game: Be wary of ads making eye-catching financial or health claims, from products that will supposedly reduce your risk of getting coronavirus to schemes that will help you get rich, and quick.
• Report it: If you think you’ve seen a fake ad, report it using the tools provided by Facebook, Google and other platforms. You can also complain about online advertising to the Advertising Standards Authority.

Rights of ReplyFacebook said: “The Facebook Page set up by Which? does not violate our Community Standards and is not currently selling products. We remove harmful misinformation that could contribute to physical harm, such as false health claims, and have strict policies against deceptive advertising and scams.”

Google said: “At Google, our goal is to make more information about the ad experience universally available and accessible. Broadening our verification policy is the next step in reaching that goal. We’ll continue to look for additional ways to increase transparency in ads for our users.” More information available here: https://www.blog.google/products/ads/advertiser-identity-verification-for-transparency/

Press Release