FRAUDULENT ADVERTISING ONLINE - EMERGING RISKS AND CONSUMER FRAUD - IP LAW GALLI
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
ABOUT TRACIT The Transnational Alliance to Combat Illicit Trade (TRACIT) is an independent, private sector initiative to drive change to mitigate the economic and social damages of illicit trade by strengthening government enforcement mechanisms and mobilizing businesses across industry sectors most impacted by illicit trade. ABOUT AAFA The American Apparel & Footwear Association (AAFA) is the national trade association representing apparel, footwear and other sewn products companies, and their suppliers, which compete in the global market. Representing more than 1,000 world famous name brands, AAFA is the trusted public policy and political voice of the apparel and footwear industry, its management and shareholders, its nearly four million U.S. workers, and its contribution of more than $400 billion in annual U.S. retail sales. www.aafaglobal.org FOR MORE INFORMATION This report is available online in PDF format, along with an Executive Summary and ancillary documentation. Visit www.tracit.org/publications.html MEDIA All media enquires should be directed to Cindy Braddon, Head of Communications and Public Policy, cindy.braddon@TRACIT.org SOCIAL MEDIA Twitter: @TRACIT_org LinkedIn: www.linkedin.com/company/tracitorg ACKNOWLEDGMENTS We express our appreciation to Toe Su Aung and Sam Irving of Elipe, Ltd., for their diligent research and insightful guidance (www.elipe-global.com). We also appreciate the contributions of the many corporations who have identifed and shared examples of fraudulent advertising of their products. The objective of this report is to help rid the Internet of widespread fraud in advertising. The first step in this process is to shed light on the prevalence of fraudulent advertising appearing on shopping and social media platforms. Better educated consumers are in a better position to defend themselves against fraud. Whenever fraudulent advertisements are found, we suggest in the first instance that these are reported to the relevant platform on which they appear, and where appropriate to law enforcement or government regulators.
EXECUTIVE SUMMARY What’s the fuss about fraudulent websites also show a disregard for data privacy advertising? and expose consumers to credit card fraud, identify theft, and other cybercrimes. Even more Fraudulent advertising is rapidly emerging as a alarming is evidence that a coordinated criminal new risk to consumers shopping online, where network (or networks) are often behind the millions of consumers are exposed to thousands adverts. of fraudulent advertisements taking them to thousands of illegitimate e-commerce websites What needs to be done? that defraud and/or sell counterfeit products and Advertising has long been regulated by deceitful services. governments to ensure that messages are truthful In keeping pace with consumer trends—and to and do not mislead reasonable consumers about stay one step ahead of controls—illicit traders now aspects of a product or service. In some countries, post fraudulent adverts that divert unsuspecting there is also consideration of fairness, which consumers to websites featuring counterfeits, focuses on whether an advert causes substantial fake services, and other fraud. Of concern is that consumer injury.1 the adverts are all over social media networks However, similar controls are not sufficiently like Facebook and Instagram, or other popular applied to advertising on the Internet. While websites like YouTube or Google, where people there are several new initiatives to address certain are not expecting fraud. aspects of online advertising, more controls on This report shows that more than 70 major fraudulent advertising appearing on legitimate international brands were targeted by fraudulent websites including social media are needed. adverts on Instagram and Facebook since 2017, Solutions could be driven by government some of which received up to a quarter of a leadership, through the application of offline million views before they were detected. And just advertising standards to today’s online like legal adverts that seem to magically know marketplaces. Such steps could ensure multi- what you are looking for, even before you started factor verification systems or other mechanisms searching for it, fraudulent adverts are also often to support a “trusted” user program are applied hyper-targeted at consumers based on specific to the act of fraudulent online advertising. interests, location, demographics or browsing history. Leadership could also be taken by the major Internet platforms that are currently enabling In addition to advertising fake and substandard the fraudulent practices. Notably Facebook products, there is a growing trend of deceptive and Instagram are not implementing sufficient advertising for fraudulent commercial and verification of an advertiser’s identity as they financial services, where names and images enter a commercial advertising relationship with of popular personalities are used without these platforms. authorization. Hand in hand with fraudulent advertising is the For consumers, their exposure to counterfeit persisting presence of rogue websites specifically goods and fraudulent services presents direct and built to sell counterfeit or other illicit products. indirect health and safety risks. Most fraudulent FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 1
In the absence of rogue destination websites, Similar verifications should be required for fraudulent adverts would have nowhere to online advertisers, including the disclosure redirect consumers. For these reasons, efforts of certain verified information regarding taken concurrently with domain name registrars sellers, such as identity, principal place of and Internet Service Providers can improve business, contact information, verified bank the prevention, blocking and removal of these account information, government-issued photo infringing sites and, consequently, reduce the identification, and a business tax identification effectiveness of the fraudulent advertising number. schemes. Notably, the converse is also true that The objective of this report is to help rid the these websites would gain little to no traffic Internet of widespread fraud in advertising. without advertising to divert consumers to them. Consumers should have a safe and secure Clearly, a holistic, across-the-board, approach shopping experience like that available offline. is needed to address the misuse of Internet This means defending against the sale of platforms for illicit trade. fraudulent products consumers may find on their Is there a reasonable solution? own as well as defending against the fraudulent advertising that lures consumers to illegal The lack of sufficient policies and procedures websites. to verify an advertising intermediary’s true identity and conduct the necessary vetting and due diligence during the onboarding process2 is a system weakness across multiple Internet-based social media and shopping platforms. Therefore, requiring these intermediaries to provide sufficient and accurate information is a solution of the highest priority, especially when considering that those abusing the platforms will not be sufficiently deterred unless they can be identified and punished. A parallel example is the priority included in the January 2020 U.S. Department of Homeland Security (DHS) Report on Combating Trafficking in Counterfeit and Pirated Goods to significantly enhance vetting of third-party sellers by encouraging platforms to put in place a uniform and articulable vetting regime. 2 TRACIT.ORG
HOW BIG IS THE PROBLEM? Fraudulent advertising is everywhere online Fraudulent advertising has emerged as the latest online threat to consumers. In keeping pace with consumer trends—and to stay one step ahead of controls—illicit traders now post fraudulent ads that divert unsuspecting consumers to websites featuring counterfeits, fake services, and other fraud. Alarmingly, the adverts are all over social media platforms like Facebook and Instagram, or other popular websites like YouTube or Google, where people are not expecting fraud. • Since May 2017, more than 70 consumer and apparel companies confirmed to have been targeted by fraudulent and infringing sponsored adverts on Instagram and Facebook. The actual number is likely to be significantly higher, as these advertisers target brands indiscriminately across multiple sectors. Given a common modus operandi, it appears there may also be a coordinated criminal network or networks behind the adverts, using hacked Facebook or bot- generated profiles together with stolen profit through easy-to-find videos touting credit card data to post adverts that mislead overpriced face masks and bogus vaccines, consumers and direct them to e-commerce costing consumers more than $5 million.4 websites that defraud and/or sell counterfeit products. • An advert on Facebook told a gloomy story of a Los Angeles family that died from COVID-19 • Fraudsters have used Google’s video platform as a trick to divert customers to a website YouTube to exploit the popularity of certain selling protective face masks. Turns out the popular video games to create videos that story is not true; the family is alive and well trick consumers to download risky apps or and the face masks for sale are unapproved.5 purchase bogus services. In worst cases, users are being tricked out of significant sums of • In April 2019, an advert for fake Tommy money. One scam automatically charged Hilfiger apparel was identified on LinkedIn. a subscription fee of $99.99. Within days, The advert was directing people to the rogue it generated over 118,000 views.3 Also on website www.tommy-top.com, that was YouTube, scammers are using COVID-19 to identical to other fraudulent and counterfeit websites identified via Instagram adverts. FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 3
Fake adverts are intended to deceive This means that counterfeiters have figured out precisely how to hide their activities from Just like legal adverts that seem to magically investigation by brands and possibly even the know everyone’s online shopping wish list, platforms themselves. Consequently, it can fraudulent adverts are also often hyper-targeted be extremely difficult to determine the actual at consumers based on specific interests, location, destination website where potentially deceived demographics or browsing history. consumers end up. And even if an originating Moreover, tactics used by counterfeiters fraudulent advert itself may be reported and to confuse shoppers on Amazon or other removed from the platform, the website it once e-Commerce platforms are similarly being used directed to will continue to operate and probably by criminals posting fraudulent advertisements. be used again in another advert. Moreover, some These deceptive tactics include the use of scammers use an innocuous website address well-known trademarks, unauthorized images when configuring an advert (such as a legitimate protected by copyright and fake offers to create website from a department store) only to swap extremely professional looking fake adverts to a counterfeit website as soon as the advert has that would be indistinguishable from legitimate been approved and gone live. adverts—except the hyperlinks divert consumers By conducting reverse IP address investigations to criminal websites selling counterfeit items or on these websites, it was also discovered that fraudulent services. it was possible to find multiple other rogue For example, there was a significant spike in the websites selling counterfeit of many well-known number of fraudulent adverts posted by generic brands. For example, the website http://oite. new accounts (e.g. “Fashion jacket store” and poitemall.com was identified from a Facebook “Backpack discount”) in the two-week run-up advertisement targeting Japanese consumers. to “Black Friday” in 2019. The adverts and the The website shares its IP address with 232 associated rogue websites offered huge unrealistic other domains/websites, including http://www. discounts targeting popular toys, handbags, denlweshop.com which targeted the luxury brand winter jackets and boots, guitars, and fitness Coach. Similar to the other counterfeit sites trackers, as well as many popular fashion clothing sharing the same IP address, this one likewise brands. Underpinning the scam is the consumer offered “80% off”, displayed false company knowledge that discounts from legitimate brands and address information about the website’s may be higher than normal around Black Friday. operator and included a Russian email address Hand in hand with the fraudulent advertising is (24service@bag-ok.ru) that did not match the the deployment of falsely displayed destination domain name. This suggests there is a larger URLs within the adverts, multiple URL redirects, cybercriminal network utilizing these domains to URL cloaking techniques and URL shorteners exploit consumers across different search engines (bit.ly) to deceive consumers and prevent and social media platforms. detection from investigators. These sophisticated Product fraud and counterfeiting URL redirects will often change the website destinations when a user clicks on an advert Scams can spread like wildfire on social media, depending on whether the user is viewing the the very nature of which encourages us to advert on a desktop browser or via the social share and like posts so that they are seen by as network’s own app. In addition, many of these many people as possible. Millions of consumers links are only accessible when viewed within the are exposed to thousands of fraudulent Instagram app (and not on the desktop browser). advertisements taking them to thousands of 4 TRACIT.ORG
illegitimate e-commerce websites that defraud Services fraud and/or sell counterfeit products and deceitful In addition to fraudulent adverts of fake or services. substandard products, there is a growing trend of Some potential scams may seem innocent at first. fraudulent advertising of commercial and financial For example, a simple quiz that ultimately gets services. Public figures such as UK financial you to reveal the answers to common banking journalist Martin Lewis8 and Dutch businessman security questions. There are also cases where John de Mol9 have spoken out about how their scammers pose as your Facebook friends and names and images have been used without reach out, claiming they are in urgent need of authorization in adverts to promote fraudulent money. services and fake products. Both have taken legal measures to compel action against these scams. This report is underpinned by data collected on more than 70 consumer and apparel brands Martin Lewis initially sued Facebook for confirmed to have been targeted by fraudulent defamation after a year in which over 1,000 scam and infringing sponsored adverts on Instagram adverts abusing his name or image had appeared and Facebook since 2017 (Figure 1).7 The actual on the platform, likely seen by millions of people number is likely to be significantly higher, as in the UK. In response, Facebook acknowledged these advertisers target brands indiscriminately the scale of the problem, its impact on real people, across multiple sectors. Furthermore, the adverts and agreed to commit to making a difference both are optimized to attract attention and can receive on its own platform and across the wider sector. large numbers of views even if only active for a Dutch billionaire John de Mol filed a lawsuit short period of time. It has been observed that against Facebook for allowing fake adverts on some of these adverts have received over 240,000 its platform, which used his name and image to views within just a couple of days. Given the size, perpetrate Bitcoin-related fraud. Lawyers for De scope and number of brands affected, the scale of Mol said that consumers had been swindled out the deception and fraud occurring on social media of €1.7 million ($1.9 million) by the fraudulent platforms cannot be underestimated. Figure 16 1. Adidas 21. Dewalt 41. Moncler 58. Stone Island 2. Apple 22. Dr. Martens 42. Montblanc 59. Superdry 3. Arc'teryx 23. Emporio Armani 43. Monsoon and 60. Supreme 4. Ariat 24. Fila Accessorize 61. The North Face 5. Balenciaga 25. Fjällräven 44. Muck Boots (Honeywell) 62. Timberland 6. Berluti 26. Geox 45. National Football League 63. Tommy Hilfiger 7. Bose 27. Gymshark (US NFL) 64. Tony Bianco 8. Braun 28. HP (laptops) 46. National Hockey League 65. Trek (bikes) 9. Breville 29. Hugo Boss (US NHL) 66. TUMI 10. Brooks Sports 30. Husqvarna 47. New Balance 67. UEFA Football Club 11. Calvin Klein 31. JBL 48. Nike jerseys (including 12. Camper 32. Keen 49. Nintendo Juventus F.C., Liverpool 13. Canada Goose 33. Kenzo 50. Off-White F.C., Real Madrid C.F. and 14. Canon 34. Kipling 51. Patagonia Tottenham Hotspur F.C.) 15. Carhaart 35. Lacoste 52. PlayStation (Sony) 68. Ugg/Deckers 16. Cartier 36. Lego 53. Ralph Lauren 69. Van Cleef 17. Chanel 37. Levi's 54. Ray-Ban 70. Vans 18. Clarks (Shoes) 38. Louis Vuitton 55. Salomon 71. Vasque 19. Converse 39. Makita 56. Saucony 72. Weber 20. Delonghi 40. Michael Kors 57. SKECHERS 73. Xbox (Microsoft) FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 5
adverts, and that he was only one of several Although this report is not a quantitative study Dutch celebrities targeted. In this case, the on the size and value of counterfeiting, important Amsterdam District Court found that while it may conclusions on the impact of fraudulent not be “technically easy” for a platform to take advertising can be drawn from current trends. measures against these serious advertising scams, According to a 2017 report by Frontier Economics, it is still the platform’s responsibility to protect the global economic value of counterfeiting (not consumers.10 including digital piracy) in 2020 is approximately $1.8 trillion.11 Online sales now represent between Certainly, Facebook’s response to the Lewis case 14-16 percent of total global retail sales during acknowledges at least a degree of responsibility the 2019-2020 time frame.12 Consequently, as and the Amsterdam Court’s view calls for greater a share of global counterfeiting, the value of responsibility. However, while many popular counterfeits purchased through online outlets websites and social media platforms provide would equal $252-288 Billion. This estimate tools for de-listing fake adverts based on IP compares reasonably to the 2018 Global Brand infringements, these measures do not address Counterfeiting Report, which estimates that the root problem. Unfortunately, even after being the losses suffered due to online counterfeiting reported and removed adverts often reappear globally amounted to $323 Billion in 2017.13 within 24 hours, with slightly different content. Fraudulent Ads have even been found appearing Sometimes the campaigns are fiercely aligned to in “Instagram Stories” which only last 24 hours. global shopping events, where criminal networks That makes it impossible for brand owners to are orchestrating the creation of hundreds of keep track of the threats and take effective action. ad accounts, websites, hosting and payment One brand owner reported taking down an infrastructures in order to maximize their return average 30 adverts every day on just one popular on investment whilst competing against the social media site. legitimate brands in the same space. Some of the fraudulent adverts for well-known brands can Taken together, the question remains whether attract a quarter of a million views in a single the platforms can and will improve preemptive day. In another example, one fraudulent advert measures to identify and block fraudulent adverts. Instagram for counterfeit goods used a domain Economic impact linked to 3,200 other rogue domains, all featuring The emerging gateway to illicit sales online is a ‘high discounts’ for branded items and no contact link from a fraudulent advert to a rogue website information. offering illicit products. Collected research Given that counterfeiting increased by 154 percent provides evidence over time indicating there are over the last decade and that online shopping hundreds of thousands of fraudulent adverts is increasing by 10-20 percent per year, if left available, backed by large networks of scam and unchecked, this problem will continue to grow.14 rogue websites ready to receive and defraud unsuspecting consumers. As highlighted in this report, the trend is to increasingly feature the realistic, but nonetheless fraudulent, adverts on social media platforms that can instantly reach millions of unsuspecting online users. 6 TRACIT.ORG
WHAT ARE THE DANGERS? 1. Consumer risks 2. Business and brand owners Fraudulent adverts give innocent consumers Today’s increasingly knowledge-based economy is a false impression of authenticity by using driven and dependent on continuous innovation. fake trademarks of popular brands and other In contrast, IP theft in the form of trademark infringements such as misrepresented images of counterfeiting and copyright piracy stifles genuine products, slogans, and corporate style. economic growth and job creation by discouraging They often use words such as “discount”, “100% innovation, reducing incentives for companies to genuine”, “Official store”, ”90% off” or other invest in R&D and inhibiting creative industries wording designed to attract attention. from realizing their full potential. For brands and consumers, the threat posed Fraud, especially involving the acquisition of by fraudulent adverts can be severe and their counterfeits, severely damages the reputation of exposure to counterfeit goods poses direct and legitimate brands, as well as taking away potential indirect health and safety risks. customers. Counterfeit goods are generally of poor quality, will not last, are not guaranteed, and may Legal manufacturers abide by regulations be dangerous. When consumers are disappointed and invest heavily in innovation and product with the purchasing experience, it diminishes development, with brands serving as guarantees legitimate sales, which has consequences for of quality and safety. In contrast, counterfeiters investment, employment, revenue, and tax make their money by sidestepping product collection. Meanwhile, it also places additional safety regulations, environmental controls, and demands on law enforcement agencies. labor laws. Consequently, counterfeit goods are often of sub-standard quality or of unknown 3. Data privacy and sometimes dubious chemical/material Most fraudulent websites show a disregard for composition.15 Even relatively innocuous goods, data privacy of any type, including customer such as watches, apparel and handbags can pose data, security, and financial information. (Figure health risks for consumers when counterfeiters 2.) Since these websites rarely use any form use potentially harmful materials (allergenic and/ of security, consumers are often also exposed or toxic).16 Examples include the use of prohibited to credit card fraud, identify theft, and other carcinogenic dyes to color fabrics and children’s cybercrimes.20 clothing made from highly flammable fabrics that burn quickly and intensively.17 Counterfeit Another risk is linked to scam adverts concerning cosmetics and personal care products containing consumer goods. Adverts purporting to be from dangerous levels of lead, mercury, cyanide and legitimate fast-moving consumer goods (FMCG) other carcinogens can cause severe allergic companies will offer free products, such as reactions and pose a particular threat to pregnant toothbrushes, toothpaste, or laundry detergent, women and their unborn babies.18 in exchange for completing a survey or otherwise FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 7
Figure 2 19 • In some examples, the adverts actually directed users to these retailers’ websites, possibly indicating that they were initially configured to appear legitimate in order to pass Facebook’s ad review stage – and then once approved they were edited to direct consumers to the fraudulent websites. • The adverts use a series of URL redirects and utilize Facebook’s own inputting personal data. The data gathered website analytics visitor through these means may then be used to further and tracking tool, Facebook Pixel, to analyze defraud the consumer through other phishing the success of the adverts and improve the and cold-calling scams. reach of new adverts in the next fraudulent 4. Organized crime campaign. As noted by EUROPOL, “Trading in counterfeit • The ad destination URLs sometimes did not products is a relatively low risk activity, involving direct to an active website, but the destination minimal penalties whilst providing high profits, URL would have a .cn, .tw or .pw extension. and will increasingly attract [organized crime In many cases, the websites are created using groups] previously involved in other crime Chinese registrant details; however, these areas.”21 The fraudulent and infringing adverts appear to be false or incomplete. discovered on Facebook often share similar characteristics, suggesting that organized crime groups or organized illicit networks are operating these fraudulent ad campaigns. Further evidence of a sophisticated, coordinated criminal approach is found in the common application of the deceptive/misleading technological features and techniques. For example, fraudulent advertisements provide a visible URL of well-known online retailers (e.g., amazon.de, jdsports.co.uk and Zalando.co.uk) that also use Instagram to advertise. In some cases, the scams use the official URLs of the brands being counterfeited only to redirect consumers to a fraudulent website that mirrors the official one. 8 TRACIT.ORG
WHAT ARE THE CAUSES? The root cause of the problem is that most social on a popular social media site.22 They reported media platforms and e-Commerce websites accept 3,834 views, 73 clicks and 19 forwards all within advertising without proper controls over the 24 hours and for the small price of £ 15. (Figure source of the advertiser. In addition, weaknesses 3.) in the system that enable advanced technologies It appears that social media platforms, to generate and place the adverts are also a big notably Facebook and Instagram, are not part of the problem. There is also little protection implementing sufficient substantive verification from repeat offenders and the fraudulent adverts of an advertiser’s identity as they enter into a would have no purpose if it were not for larger commercial advertising relationship with such failures which allow fraudulent, infringing and platforms; often as little as a credit card and an otherwise rogue websites and domains to exist. email address is enough to create an advertising 1. Limited verification account, both of which could be stolen from other unwitting customers. This is placing consumers Without robust due diligence checks that verify at significant risk by exposing them to adverts by the identity of who is advertising on the platform, unknown parties intending the sale of counterfeit fraudulent advertisers are free to exploit the goods or other fraudulent practices. By adopting system with little risk of exposure and virtually no best practices in “know your business customer” risk of punishment or penalty. checks, platforms can mitigate against this risk. The placement of a fraudulent advert can be done in just a couple hours at very little cost. In fact 2. System weaknesses a UK-based consumer interest journal recently Research has shown that a fundamental gateway demonstrated the ease of posting a fake scam ad to fraudulent advertising is the creation of an illegitimate hosting page. In Figure 3 order to be able to advertise on Instagram or Facebook, a Facebook account and page is required. However, there are no apparent controls on such accounts, such as account history, relevance to the advert, or level of activity. FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 9
What has been observed in the accounts posting to prevent or take down such infringing sites. the fraudulent adverts is that they are often (i) However, the converse is also true that these compromised (hacked) Facebook profiles/pages websites would gain little to no traffic without or (ii) a newly created bot-generated Facebook advertising that diverts consumers to them. While “Community” page. some consumers may discover these fraudulent websites through organic search results, a • Many of the fraudulent sponsored ads are significant number will be diverted to them by the from compromised Facebook accounts of fraudulent adverts. businesses or small organizations that have been “hacked” and have no connection to the Efforts to clean up fraud online, must go hand advert that is being sponsored. For instance, a in hand, so that social media platforms are kept fraudulent advert for a (fake) Tommy Hilfiger aware of any websites being taken down which shirt, might be artificially sponsored by some are linked to an advertising account on their completely unrelated Facebook host, such as platforms, so that they might check for other “Business Insurances”, “Medisch Pedicure” potentially infringing websites connected to the or “Georgian College Benefit Concert”. With same account; where an advert is successfully multiple high-profile personal data breaches taken down, the platform should also notify the in recent years, millions of email and relevant ISP and registrar so that they can take password records have been exposed thus appropriate action against the registrant. making compromised Facebook profiles and 4. Little protection from repeat pages by cyber criminals more likely. infringers • A bot-generated account is a sophisticated It is not difficult to repeat a fraudulent advert, operation, where a computer sets up a even after being reported. This is partly because Facebook account or page which is then some adverts may avoid using IP-infringing used to post the fraudulent adverts. These brand names and keywords and partly because pages often contain unrelated, little or no adverts often reappear in slightly different information and no content. They are typically forms after being delisted—even after hundreds generated within a 6-month window of of similar adverts have been reported. The fact the advert going live, which gives the bot- that so many international brands have been generated pages a “legitimate” Facebook targeted by fraudulent adverts using the same “footprint”, which may be strengthened by modus operandi over a three year period suggest bot-generated “likes” that build up a history social media platforms must take more robust on the platform. measures on stopping recidivist activities relating to advertising or seek assistance from law 3. No controls on destination websites enforcement. When Instagram or Facebook users click on fraudulent sponsored adverts, an in-app browser 5. Deceptive practices typically directs them to an external website A fraudulent advert typically appearing on operating a web shop. These are typically rogue Instagram or Facebook targeting a well-known websites designed specifically to sell counterfeit or brand can be of very high design quality, fraudulent products. showcasing the most popular product’s images (typically taken from the original brand’s For these reasons, domain name registrars and website). They feature very high discounts, Internet Service Providers have been encouraged 10 TRACIT.ORG
usually 50% and above, and bogus logos for April 2018, another fraudulent advert appeared, payment (e.g., Visa, Mastercard, Paypal) to entice displaying to consumers the website address Love. consumers into a quick purchase. Domain name sjut1i.cn, but was actually directing consumers typically uses generic TLDs or ccTLDs (.top, to the destination website www.vote2018.site. .VIP, .tw, .pw, .online, .store, .club). Websites are The website www.vote2018.site was identical to not typically SSL secured (https); however, this both www.saletommy.com and www.clotheshe. appears to be changing. com websites shown above. It is of note that when registering domain names with a .cn extension, Figure 4 registrants are required to verify their personal or business identity. Examples of deceptive marketing 6. Online advertising supply chain “100% authentic” Given the repeated similarities of fraudulent “Free & fast delivery available” adverts identified throughout this report, it is “Official store online” evident that there is a systemic problem with the “No reason refund in 7 days” online advertising supply chain. In particular, the “Secure payment” current absence of any substantive verification ‘Factory direct price” of an advertiser’s commercial and/or personal “Satisfied or refunded” identity and the review process for submitted ads “Summer sales – only 3 day” themselves appears to be insufficient in tackling the scale of the deception and fraud occurring on “Black Friday” social media platforms. “Stock Clearance Sale” “Warehouse Clearance Sale” This is a problem that has been identified by many brand owners, operating in various “90% discount” sectors, and with numerous websites. It therefore requires a concerted, industry-wide solution. At present, brand owners are carrying the bulk of In October 2017, an advert was identified with responsibility by taking down fraudulent websites Facebook’s Commerce & Ads IP Tool, which and the adverts that link to them. But this is not used images of counterfeit products. The URL going to solve the problem, as it is too big and displayed to consumers was “ebay.com” and the fast-moving. advertisement was sponsored by a “Community” While it is appreciated that there is a need for page that appeared to be compromised with no a degree of anonymity for social media users affiliation or connection to the subject brand. The in many situations, when use of a platform actual destination was www.saletommy.com, a changes from personal use (social interaction and fraudulent website, which made unauthorized use connection) to a commercial use (advertising of of Tommy Hilfiger copyright protected imagery goods/services), there should be enhanced checks and logos. The website did not have a “contact and transparency for potential customers into the us” page or contact form, or any information to identity of those commercial actors. identify the entity responsible for its operation. On 10 November 2017, an advert by a Facebook Platforms need to confirm that any data provided page called XZ Fancy Bread was identified with to an advertiser is complete, correct and not bot- over 18,000 “Likes”. This ad directed users to the generated and enhanced verification needs to be website www.clotheshe.com which was identical made of the external websites that adverts direct to www.saletommy.com. Six months later, on 18 to in order to achieve this. FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 11
WHAT IS BEING DONE? Despite its prevalence and harm, very little is who do not have skills to police fraudulent being done to rid the Internet of fraudulent adverts. It will also be essential that the program advertisements. Nonetheless, very little is move swiftly. As presented the program will give being done to rid the Internet of fraudulent feedback or provide approval within three to five advertisements. In particular, the current absence business days, using a combination of human and of any substantive verification of an advertiser’s tech reviews. Currently, Google policy is to make commercial and/or personal identity along with every effort to ensure that adverts which may a weak review process for submitted adverts violate their policies do not run prior to review, are major vulnerabilities illicit traders exploit but that some may run on Google before the to deceive and defraud consumers online and Google Ads Specialists check them.24 particularly on social media platforms. With regard to its popular YouTube In response to mounting evidence—such as that platform, Google has ad policies that address contained in this report—along with pressure misrepresentation and misleading content, from brand owners and consumer groups and copyright infringement, and trademark complaints from social media users, the platforms infringement. However, IP owners report have recently promised improvements. that enforcement largely falls to them and the ability to monitor for such activity is limited For example, Google has announced that it will by deceptive techniques employed by the require advertisers to verify their identity to infringers. Consequently, Google must consider prevent them from misrepresenting themselves.23 taking proactive actions against fraudulent ad Key elements of the program (as indicated) will campaigns.25 be the requirement of personal legal information (like a W9 or IRS document showing the In the case of Facebook, in the aftermath of a organization’s name, address and employer fraudulent Facebook ad for a company selling face identification number). There will also be a 30- masks, which claimed all but one member of a day verification process, after which Google said Los Angeles family died from COVID-19, Facebook it will suspend the account and the advertiser’s pulled all versions of the advert. Furthermore, ability to serve ads until verification is provided. the company says in order to crack down on Google also stated that advertising agencies will businesses taking advantage of fear during the need to complete verification on behalf of each of coronavirus pandemic, it has banned all ads their advertiser clients. And where businesses like having to do with hand sanitizer, face masks, pharmacies already must go through certification wipes, and COVID-19 tests.26 processes, they will still need to take the new, In some countries, Facebook also requires proof additional verification steps. of identification for any user wishing to post While the elements of this program are in the advertisements relating to politics, elections, or right direction, it will be important to evaluate its social issues.27 This is not, however, a global policy, effectiveness to ensure that Google puts in place nor does it extend to forms fraudulent advertising pre-emptive measures to block fraudulent adverts, delineated in this report. (Figure 5.) such that burdens are not placed on consumers 12 TRACIT.ORG
Figure 5 card details, scammers may attempt to use multiple different stolen cards before finding one which allows a payment transaction. This behavior should be an immediate red flag to any website or platform which hosts advertising to manually review the legitimacy of the advert and advertiser profile. In addition to these voluntary efforts by platforms to put in place more effective “know- your-business-customer” measures, there are some useful programs that could be applied to better defend platforms against fraudulent advertising. These programs draw on experience from programs that address the placement of “good” adverts on “bad” websites, where a legitimate company pays While some progress is being made, platforms, advertising revenues to operators of rogue sites. notably Facebook and Instagram, are not implementing sufficient verification of an Two examples are: advertiser’s identify when they enter a commercial • TAG (the Trustworthy Accountability Group) advertising relationship with such platforms. has a “Certified Against Fraud” certification At the minimum, all platforms should program, by which actors in the advertising be implementing measures at least supply chain can show they are taking action equal to the system Google is putting against fraudulent, invalid ad traffic. The in place. primary focus of this programs is to tackle issues such as “click-fraud”, where automated It should be incumbent on websites and social computer programs mimic legitimate web media platforms that offer and host advertising to users to generate pay-per-click on an advert. make simple checks such as these before accepting Measures that could be applied to fraudulent advertising. Doing so could be done manually advertising include Payment ID system to or, with appropriate software, automatically. ensure payments track where payments Further to this, proactive checks should be made are going, lists identifying of common IP into the behavior of the advertisers at the point addresses from which it is unlikely to expect of registering ads; for example, since many of legitimate ad traffic, disclosure requirements these adverts are registered using stolen credit FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 13
for publishers to show how much traffic is However, the problem with fraudulent advertising from paid sources, and a public record of is that the advertisements are of such professional authorized digital sellers. quality that they easily deceive consumers, and when they are directed to a site from an advert • The EU MOU on Online Advertising and on well-known and familiar website or app, they Intellectual Property Rights aims to minimize are more likely to regard the destination site as the placement of legitimate adverts by IP legitimate and trustworthy than if they had found owners or other advertisers on websites it via a search engine or accidentally. This places which sell counterfeit goods or provide access extra responsibility on sites that host and provide to pirated content. While the MOU is non- optimization for advertising and/or receive binding, it suggests that signatories involved payment for doing so. in both the buying and selling of ad space adopt IPR policies and use (or require the use of) tools to prevent their advertising being placed on IPR infringing sites.28 This MOU could be extended to include measures to defend platforms from fraudulent advertising. Generally, consumers are becoming more aware and experienced at avoiding rogue websites that sell counterfeits and other fraudulent, substandard, or unsafe products. EUROPOL, for example, promotes Red Flags to help consumers detect fraudulent websites. 14 TRACIT.ORG
CONCLUSIONS Given the findings of this report, there is a Facebook, Shopify, and PayPal profit from systemic problem with the online advertising fraudulent ads, and make it very complicated supply chain and an urgent need to improve to lodge complaints or get refunds. The group controls over it. For starters, governments must offers to help people learn how to research a begin the process of establishing guidelines and site and make sure that it is legit before buying standards. Several examples already exist and products online.30 could be modified or expanded to include the • Facebook (ProtectOthers) Ad Scams group challenge of eliminating fraudulent advertising: was created to alert people of the vast amount • In the UK, new powers have been given to of scam ads that Facebook is allowing to the communication watchdog Ofcom to force circulate. The group encourages people to social media firms to act over harmful content, report fraudulent ads and warn others by including violence, terrorism, cyber-bullying sharing the advert’s link to their page.31 and child abuse. Ofcom will have the power In the meantime, however, it is imperative that to make tech firms responsible for protecting the websites and platforms which are making people from such content, including ensuring revenue from the provision of advertising services that the content is removed quickly and to to criminal networks take action to identify and minimizing the risks of it appearing at all. block them – for good. By immediately adopting • Germany introduced the NetzDG Law in 2018, best practices in “know your business customer” which states that social media platforms with checks, platforms can mitigate against the risks more than two million registered German right away. This problem is already at least five users have to review and remove illegal years in the making, so it is imperative to address content within 24 hours of being posted or the root causes that enable such profitable face fines of up to €50 million. opportunities. • Australia passed the Sharing of Abhorrent Consumers are entitled to an online browsing Violent Material Act in April 2019, introducing and shopping experience that is safe and secure criminal penalties for social media companies, from fraud. Online platforms connecting people possible jail sentences for tech executives for and those that profit on commerce over their up to three years and financial penalties worth sites should be responsible, comply with the law up to 10% of a company's global turnover.29 and recognize the ethical/moral responsibility to assure consumers a safe and trusted environment. Some groups have been formed on Facebook to This paper suggests that the fraudulent online help raise consumer awareness about fraudulent advertising can be considerably reduced by the adverts: following measures: • Facebook Ad Scambusters! was created to 1. Enhanced “Know Your Business raise awareness of the many fraudulent ads Customer” protocols on Facebook. The group states that many of these ads look legitimate and have professional It is imperative that websites and social media videos, images etc. It also explains that platforms know who they are working with when FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 15
accepting paid advertising. By gathering and advertising, all adverts published on a site or verifying an appropriate amount of data on who platform should be reviewed for infringing is utilizing their advertising services, they will be content, both algorithmically and where high better able to risk has been flagged, manually. In addition, the external sites to which such adverts link should • assess risk levels and proactively identify bad also be reviewed to determine their legality and actors authenticity. • avoid recidivist infringing activity from previously removed accounts 3. Effective reactive measures against fraudulent advertisers • provide data on infringers to affected To act as an effective deterrent to illegal consumers, rights holders, and law advertising activities, sites and platforms must enforcement establish strong, effective, and enforced measures Data collected could include individual/business against advertisers who have been found to name and street address (proven with recognized infringe their terms of service. This should go ID), phone number, email, and a proof of business beyond termination of the advertising agreement registration. and include removal of the infringer’s account For example, Facebook (and Instagram) could and blocking the advertiser from the website or make it mandatory to participate in two-factor platform. authentication for any profile or page. For For its part, Facebook is aware of the issue and online shopping, and in particular sponsored recently pointed to its anti-counterfeiting tools advertising, transparency and being able to and efforts. In a recent post, Facebook recognized definitively attribute an advertiser is essential that the issue of fake goods is especially top-of- for consumer trust and safety. This means being mind for advertisers in the lead up to the holiday able to have confidence that whoever is selling season, and pledged that the company has “strict a particular product or service can be identified, policies against counterfeit goods and other kinds contacted, and held to account if things go wrong. of IP violations.”33 To prove that point, it revealed Being proactive and socially responsible to ensure that in the first half of 2019, it removed 359,000 market integrity and that shoppers are safe pieces of content on Instagram in response to should be standard to companies worth billions.32 39,200 counterfeit reports submitted by brand Ultimately, when jointly targeted by sustained owners. Furthermore, it claimed to be investing criminal activity, there should be a determined in machine learning and artificial intelligence “to willingness to work together and hold those help block or reduce the distribution of potentially ultimately responsible to account, and make counterfeit content on both Facebook and it as difficult as possible for counterfeiters to Instagram.”34 continue to operate and infiltrate genuine buyer 4. Ensure consumers and rights holders experiences. can report and share information 2. Rigorous review of advertisement about fraudulent advertisers prior to publication Until such time that advertising on websites To ensure that their terms of service are being and social media platforms have a robust adhered to, and that no innocent consumers system to prevent bad actors, there needs to be are being defrauded by fraudulent, scam avenues for consumers and rights holders to 16 TRACIT.ORG
share information that can be used to dismantle criminal networks currently operating on their platforms. Currently, while adverts can be reported and removed, platforms appear unreceptive to receiving trends and data-sharing initiatives that could assist them in blocking bad actors accessing advertising. 5. Establish requirements for an e-business license for advertisers Such a license would require verification of (i) financial disclosures that can be corroborated by third parties (e.g., bank statements), and (ii) physical location information that can be supported by government records or trusted third parties.35 Such a system could be accompanied by a central registry ideally, managed by a highly secure, disinterested party or industry group to maintain the licenses.36 FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 17
NOTES 1 Azcuenaga, M. L. (1997). The Role of Advertising and which would tackle these adverts. In De Mol’s case on the Advertising Regulation in the Free Market. Washington, other hand, Amsterdam district court ruled that Facebook DC: Federal Trade Commission. Available at: https://www. must pay 10,000 euros each time fraudulent ads using the ftc.gov/public-statements/1997/04/role-advertising-and- image of John de Mol appear, up to a maximum of 1 million advertising-regulation-free-market euros. Sources: Klaassen, N. (2019, November 11). De Mol wint van Facebook: bitcoin-vonnis zet platform voor het 2 US Department of Homeland Security. (2019). Combating blok. AD. Available at: https://www.ad.nl/tech/de-mol- Trafficking in Counterfeit and Pirated Goods, https://www. wint-van-facebook-bitcoin-vonnis-zet-platform-voor-het- dhs.gov/sites/default/files/publications/20_0124_plcy_ blok~a72ebabb/ ; Proper, E. (2019, November 11). Facebook counterfeit-pirated-goods-report_01.pdf, p24 Ordered to Ban Scam Ads Using Big Brother Founder. 3 Lince, T. (2020). Kasper VPN scam: YouTube urged to Bloomberg. Available at: https://www.bloomberg.com/ combat fraudulent ads featuring third-party brands. World news/articles/2019-11-11/facebook-ordered-to-ban-scam- Trademark Review, 23 January 2020. Retreieved from: ads-using-big-brother-founder https://www.worldtrademarkreview.com/kasper-vpn-scam- 11 International Chamber of Commerce. (2016) Available youtube-urged-combat-fraudulent-ads-featuring-third- at: https://iccwbo.org/media-wall/news-speeches/global- party-brands impacts-counterfeiting-piracy-reach-us4-2-trillion-2022/ Leskin, P. (2020, April 2). Scammers and grifters are 4 12 Statista. (2020). E-commerce share of total global retail hawking face masks and fake coronavirus vaccines on sales from 2015 to 2023. n.p.: Statista. Available at: https:// YouTube as the platform fails to moderate its content www.statista.com/statistics/534123/e-commerce-share-of- yet again. Business Insider. Available at: https:// retail-sales-worldwide/ www.businessinsider.com/youtube-videos-ads-face- masks-coronavirus-vaccines-misinformation-content- Global Brand Counterfeiting Report 2018-2020. See 13 moderation-2020-4 https://apnews.com/ef15478fa38649b5ba29b434c8e87c94 5 13abc. (2020, April 15). Mother finds fake Facebook ad 14 US Department of Homeland Security. (2019). Combating claiming her family died from coronavirus. 13abc. https:// Trafficking in Counterfeit and Pirated Goods, https://www. www.13abc.com/content/news/Mother-finds-fake-Facebook- dhs.gov/sites/default/files/publications/20_0124_plcy_ ad-claiming-her-family-died-from-coronavirus-569652591. counterfeit-pirated-goods-report_01.pdf html 15 WIPO. (2017). The Environmentally Safe Disposal and 6 Screenshot captures of the identified fraudulent ads and the Destruction of Intellectual Property Infringing Goods. destination websites are available upon request. Geneva: WIPO. Retrieved from: http://www.wipo.int/edocs/ mdocs/enforcement/en/wipo_ace_12/wipo_ace_12_3_ppt. 7 Primary research conducted by TRACIT and AAFA member pdf brands, Elipe Limited and unassociated brands (i.e., those that supplied examples). 16 Federation of the Swiss Watch Industry. (2018). Thinking of buying a counterfeit product? Shame! n.p.: Federation of the 8 Mason, C. (2019, January 23). Martin Lewis settles lawsuit Swiss Watch Industry. Accessed 16 October 2018. Available as Facebook agrees to donate £3m to anti-scam charity at: http://www.fhs.swiss/eng/buy_counterfeit.html and launch new scam ads reporting button. Money Savings Expert. Available at: https://www.moneysavingexpert.com/ 17 ITV. (2015, November 4). UK’s first Fake Shop reveals news/2019/01/martin-lewis-drops-lawsuit-as-facebook- danger of counterfeit goods. ITV. Available at: http://www. agreed-to-donate-p3m-to-a/ itv.com/news/westcountry/2015-11-04/rat-droppings-in- cigarettes-and-urine-in-perfume-fake-shop-reveals-danger- 9 Sterling, T. (2019, June 5). Dutch ‘Big Brother’ creator sues of-counterfeit-goods/ Facebook over fake Bitcoin ads. Reuters. Available at: https:// www.reuters.com/article/us-facebook-ads-netherlands/ 18 Greenwood, C. (2015, May 17). Warning on fake make- dutch-big-brother-creator-sues-facebook-over-fake-bitcoin- up tainted by CYANIDE and other dangerous chemicals: ads-idUSKCN1T61N5 Counterfeit versions of leading brands are being cooked up by criminals in squalid underground labs. Daily 10 In both of these cases, the affected parties took legal Mail. Available at: http://www.dailymail.co.uk/news/ action against Facebook as the platform they were seeing article-3085665/Warning-fake-make-tainted-cyanide- the most adverts on. For Lewis, a settlement was reached dangerous-chemicals-Counterfeit-versions-leading-brands- in which Facebook agreed to launch a new scam reporting cooked-criminals-squalid-underground-labs.html tool for consumers in the UK and donate £3m to a project 18 TRACIT.ORG
MarkMonitor. (2019). Global Consumer Survey Social 19 27 See https://www.facebook.com/business/help/2089495765 media: Insights into consumer shopping behaviour. n.p.: 50051?id=288762101909005 MarkMonitor. 28 European Commission. (2018). Memorandum of 20 Muncaster, P. (2017, September 26). Police: Buying Fake Understanding on online advertising and IPR. Brussels: Goods Online Can Lead to ID Theft. Info Security. Avaialble European Commission. Retrieved from: https://ec.europa.eu/ at: https://www.infosecurity-magazine.com/news/uk-police- growth/industry/policy/intellectual-property/enforcement/ buying-fake-goods-online/ memorandum-of-understanding-online-advertising-ipr_en 21 SOCTA. (2013). EU serious and organised crime threat 29 BBC. (2020, February 12). Regulator Ofcom to have more assessment (SOCTA 2013). The Hague: European Police powers over UK social media. BBC. Available at: https:// Office. Available at: https://www.europol.europa.eu/ www.bbc.com/news/technology-51446665 activities-services/main-reports/eu-serious-and-organised- 30 See https://www.facebook.com/groups/stopfraudads/ crime-threat-assessment-socta-2013 31 See https://www.facebook.com/protectothers/ 22 Research by the consumer rights and reviews organisation which found that with just an email address, name, a few 32 Bradford, D. S. (2019, December 6). Facebook Ad Scams stock images and a credit card, it is possible to have an Are Hitting Users Hard, What Can We Do? Buzzfeed. https:// advertising account up and potentially defrauding consumers www.buzzfeed.com/davidsbradford/facebook-ad-scams-are- within 24 hours: Stanaway, C. (2019, June 27). How our hitting-users-hard-what-can-cbr58l7wiq?fbclid=IwAR1mRg fake ‘scam’ ad breezed through Facebook’s approvals ZntRfZmqQqvhhmV4-9X3rwMnQqqer79bG0hiP3MVOMrxb process. Which?. Avaialble at: https://www.which.co.uk/ S4jxEnng news/2019/06/how-our-fake-scam-ad-breezed-through- facebooks-approvals-process/ 33 Facebook Business. (2019). Good Questions, Real Answers: Protecting Brands Against Counterfeits. Available at: https:// 23 Graham, M. (2020, April 23). Google will make all www.facebook.com/business/news/good-questions-real- advertisers prove their identities, so people can see who they answers-how-facebook-helps-brands-protect-against- are and which country they’re in. CNBC. Available at: https:// counterfeits/ www.cnbc.com/2020/04/23/google-advertiser-verification- process-now-required.html Facebook for Business, at https://www.facebook.com/ 34 business/news/good-questions-real-answers-how-facebook- 24 Google. (n.d.). Google Ads Help: Report an ad. helps-brands-protect-against-counterfeits Accessed from: https://support.google.com/google-ads/ troubleshooter/4578507?hl=en 35 This recommended by the American Apparel and Footwear Association (AAFA) in response to the US Memorandum on 25 Lince, T. (2020). Kasper VPN scam: YouTube urged to Combating Trafficking in Counterfeit and Pirated Goods. combat fraudulent ads featuring third-party brands. World Trademark Review, 23 January 2020. Retreieved from: 36 FINRA's Central Registration Depository could be a model https://www.worldtrademarkreview.com/kasper-vpn-scam- for this. youtube-urged-combat-fraudulent-ads-featuring-third-party- brands 26 13abc. (2020, April 15). Mother finds fake Facebook ad claiming her family died from coronavirus. 13abc. https:// www.13abc.com/content/news/Mother-finds-fake-Facebook- ad-claiming-her-family-died-from-coronavirus-569652591. html FRAUDULENT ADVERTISING ONLINE: EMERGING RISKS AND CONSUMER FRAUD 19
You can also read