Facebook Hustles (continued): European Commission cracks down on Meta for letting fraudulent ads through

We welcome the action from the European Commission to open formal proceedings into Meta's Facebook and Instagram over suspected breaches of the Digital Services Act (DSA). Last June, we revealed how nefarious ads leading users into a massive scam operation could be found on the platforms, despite being against their terms of service. Almost one year later, similar ads can still easily be found on Meta's services.

The DSA was designed to prevent illegal and harmful activities online and the spread of disinformation. The legislation aims at achieving this goal through an extensive regulation of platforms such as Meta’s Facebook and Instagram, which are subject to the highest level of scrutiny under the DSA as “very large online platforms”. Last year, we uncovered a global scam operation exploiting ads on Facebook to recruit its victims, leading them to fake media websites in order to collect personal data and try to sell them fake services and induce substantial financial harm to them.

Facebook Hustles, as we dubbed the operation, has been widely publicised since the issue of our report and acknowledged by Meta. However, the scam wasn’t put to an end yet and despite numerous articles and subsequent investigations into the matter by other researchers, Meta hasn’t adequately responded to this threat. Numerous reports published by Reset.tech, AI Forensics, EU DisinfoLab, Rappler and Qurium expanded upon our investigation in detail and disclosed multiple tactics used by scammers. Qurium for instance dug into the technical infrastructure used by nefarious actors and could link several components of the organisation to companies and operatives.

It’s a sad day for… at least 3 million facebook users

In under two hours of research just yesterday, collecting fraudulent ads displayed on a Facebook user feed, and limiting our scope to just 10 Facebook pages hosting such ads, we measured that at least 3 million Facebook users were reached in 12 European countries in the last 3 weeks. The technique used is not novel and is exactly the same as what as been described previous report. All ads lead to websites impersonating famous media brands and try to lead users to share personal data. Narratives used in the ads vary slightly but always try to trigger a strong emotional connection with users… and a click.

One of such narratives used by scammers in this fresh batch revolves around the sentence “It’s a sad day for…” (FR, EN, ES, DE, NL, IT, PL) used in some fashion in the ad text content, using local context such as language, country and an event affecting a national celebrity. We recorded that the names and pictures of 69 personalities were used, including politicians and suggesting their death. Such celebrities include American actor and politician Arnold Schwarzenegger, Dutch MP Thierry Baudet, French singer Francis Cabrel, or Polish MP Sławomir Mentzen (see full list below). Each time, the celebrity used is famous in the target country of the ad and the narrative suggests that they were involved in a tragic event.

Some of the Facebook pages used to place the ads share uncommon characteristics: ads are paid for by a flurry of separate accounts and target at least a dozen countries. This being said, we observed that the campaign seems to be currently active most commonly in the following countries: Austria, Belgium, Czech Republic, Denmark, Finland, France, Germany, Ireland, Italy, Poland, Portugal, Spain and The Netherlands.

Once more, we urge Facebook users not to engage with such ads, but stronger still, exhort Meta to prevent their publication.

The real sadness is that the scam continues impunitively

The decisive steps anticipated by the European Commission to initiate formal proceedings against Meta’s platforms are both timely and essential. As we have documented, despite Meta’s awareness and acknowledgments, this pervasive scam operation continues to exploit vulnerable users. The lack of sufficient response from Meta not only undermines trust in its platforms but also highlights the necessity for rigorous regulatory oversight to ensure that large online platforms do not become conduits for fraud.

CheckFirst remain dedicated to supporting the European Commission’s and Meta’s efforts by providing further evidence and examples of illicit activities on these platforms. We encourage Meta to engage more constructively with Civil Society Organisations and regulatory bodies and take immediate, effective actions to eliminate these scams. 

We however acknowledge that the monitoring of operations such as the one described in this article are greatly facilitated by tools such as the Meta Ad Library, a direct consequence of the DSA’s requirements. Yet, as we described in our joint report together with the Mozilla Foundation, platforms must better implement such ad libraries to empower researchers.

While our focus today is on Meta, it is necessary to stress that we have strong suspicions of similar activities on other platforms, particularly X (formerly Twitter) but that poor implementation of their ad library prevents us from researching such campaigns.

Our ongoing commitment to exposing such harmful activities reinforces our resolve to protect citizens and uphold the integrity and safety of online spaces. As we move forward, we stand ready to assist in any initiatives that aim to halt these deceptive practices and promote a safer digital environment for all.

List of celebrities whose name and image was used in the ads

Mark LathamAUAntonio BanderasES
Erik Van LooyBECarlos SoberaES
Virginie EfiraBEFrancis CabrelFR
Peter MaffayDEFrançois LengletFR
Tedros TeclebrhanDEAnne SinclairFR
Tim MälzerDEAlain MincFR
Sahra WagenknechtDEHugo TraversFR
Mirjam WeichselbraunDEBarry KeoghanIE
Richard LugnerDEChiara FerragniIT
Werner HerzogDEGeppi CucciariIT
Barbara KarlichDESilvia ToffaninIT
Casper ChristensenDKGiorgio CalabreseIT
Jesper JuhlDKEnrica BonaccortiIT
Sofie LindeDKMara VenierIT
Søren PindDKVirginia RaffaeleIT
Carsten JensenDKValentino RossiIT
Mikael BertelsenDKMarco MaterazziIT
Kåre QuistDKTine EmbrechtsNL
Isabel Díaz AyusoESJeroen PauwNL
María CasadoESGeraldine KemperNL
Pedro García AguadoESHélène HendriksNL
Pablo MotosESAnnechien SteenhuizenNL
Ana Rosa QuintanaESThierry BaudetNL
Fernando GonzálezESJohan DerksenNL
Jesús CallejaESSylvana SimonsNL
Julio MaldonadoESPeter BoszNL
Carlos HerreraESHelene HendriksNL
Lorena CastelESSławomira MentzenPL
Jero GarcíaESDavid WalliamsUK
Felipe VIESBen FogleUK
Alfonso GuerraESKay BurleyUK
María CasadoESRobert PestonUK
Pablo SimónESArnold SchwarzeneggerUS

About us

Check First is a leading Finnish software and methodologies company, spearheading adversarial research techniques. We believe that everyone should be able to understand how and why content is presented to them. We advocate for online clarity and accountability, building solutions to attain this goal. Partnering with leading institutions, regulators, NGOs and educators, we aim at curbing the spread of disinformation and foreign influence manipulations.

Our story