Facebook purged millions of those fake accounts from USA TODAY and other publishers three weeks ago, the latest salvo in the social giant’s battle against scammers and spammers seeking access to its platform and its 1.94 billion users.
Those axed accounts included more than a third of USA TODAY’s approximately 15.2 million Facebook "likes" at the time. Executives of Gannett Co., parent of USA TODAY and 109 local news properties, said Thursday millions of its remaining followers also were fake, and it continued to accumulate a thousand phony followers a day.
Facebook on Friday said it's detected additional suspicious activity since its April fake-account crackdown, some of which look similar to the campaign it disrupted in April. Others more closely resemble common fake profiles that post spam comments and attempt to look legitimate by engaging with businesses' Facebook pages.
"After we identified the additional set of violating accounts, we notified our partners at USA Today, and are taking action against these accounts," said Shabnam Shaik, technical program manager on Facebook's protect and care team, in a statement. She declined to reveal how many fake accounts Facebook had discovered.
Facebook has said in filings with the Securities and Exchange commission that it estimates about 1% of its monthly worldwide active users are "misclassified" accounts, which it says includes both fake accounts and those that don't abide by its terms of service, such as people creating accounts for their pets. The company believes the majority of these are outside of the United States. The company declined to say what the ratio between these types of misclassified accounts was.
The continued presence of phony accounts hasn't checked the social network's user growth, but they can cause confusion and havoc for individual users and companies. Fake profiles that masquerade as real people have also caused tragedy, such as the torture and killing of a university student in Pakistan after someone set up a fake Facebook account in his name that allegedly contained blasphemous content.
In USA TODAY's case, it's not clear why spam operators have targeted the media company's Facebook pages in droves.
"We don’t know why the scope of impact on USA Today’s Facebook Page appears greater than any other publisher," said Shaik.
Facebook suggested three weeks ago that a "major spam operation" had set up the accounts as a way to access and potentially spam and scam its users. These fake accounts follow and comment on publishers’ pages to lend a veneer of credibility that might help the account operators connect with real users while veiling them from Facebook's automatic fake account detectors.
USA TODAY appears to have been the main target of this operation. Gannett contacted the FBI late Wednesday because the barrage was “not stopping,” and the company is no closer to identifying its source, said Maribel Wadsworth, the publisher’s chief transformation officer. The FBI declined to comment.
While creating fake accounts violates Facebook's terms of service, it probably isn't a crime. But a proliferation of such accounts risks damaging a publisher's brand at a time when the social network is one of the key ways news organizations reach their readers.
When Facebook purged the fake accounts in April, it cut 200 million fake likes from the pages of major publishers, including 20,000 from the U.K.'s Guardian. Some 12 million were from USA TODAY and affiliates, the single largest group, Wadsworth said. The discovery comes after Gannett had touted the extent of its reach on the social platform, including in a Feb. 22 report to its shareholders. Gannett said it has not seen a drop in Facebook referrals to its own properties since Facebook said it was tackling the spam operation.
Fake account trait: Worked for the Yankees
Wadsworth said Gannett has taken steps to prevent its Facebook pages from attracting more fake followers, including blocking new followers from Bangladesh, one of the countries the company thinks is the source of a significant proportion of the spam accounts.
One batch of fake accounts featured posters who appeared to be in countries such as Bangladesh, India, Egypt and Pakistan, often with comments written in Bengali, Hindi, Urdu and Arabic. These appear to be manually created accounts, as opposed to accounts created by software, suggesting somewhere in the world humans are busy setting up these profiles.
These are made to look more realistic by adding likes and friends, though their comments can look like spam and are often just copied text from random sources. The spam operation Facebook tried to purge in mid-April appeared to come from accounts located in Bangladesh, Indonesia, Saudi Arabia, and other countries, the social network said at the time. The company said it had been targeting that operation for six months.
“We saw one of these accounts post gibberish, it was literally just “13459u2 34ltijsre” and then it had 4,000 “likes” because there were 4,000 fake accounts and they were all liking each other,” said Dan Nadir, vice president for digital risk at Proofpoint, a security company that provides social media protection and compliance for USA TODAY.
Another batch of fake accounts featured a female name that would be common in the United States and with a photo of an attractive young woman.
“They’re always students, they’re always single and they tend to say they work for popular sports teams. We’ve seen thousands of them that say they work for the New York Yankees,” said Nadir.
Almost immediately after they are created, the profile holder goes to the USA TODAY page on Facebook and follows it. Users who visit USA TODAY's Facebook page actually won’t see many of these accounts because they’re the easiest to spot and the ones Proofpoint's software can immediately delete, said Nadir
'Numbers game'
In one way or another, fake Facebook accounts are usually designed to make money. Operators of a scam can use the fake followers to send links to malware or to sell questionable weight loss products or send messages asking for money from someone who claims to be a friend stranded in a foreign country who’s lost their password, said Dennis Yu, chief technology officer with BlitzMetrics.
The true money-making opportunity is getting a real Facebook user to “friend” one of the fake accounts. The average Facebook user has 350 to 400 friends. So even if only one real person accepts the fake account's friend request, it can then attempt to spam all their friends, said Yu.
"It's a numbers game. These fake accounts are cheap to create and if they can get just one person to click on the link they can make enough to cover the cost," he said.
Wadsworth said there was no indication of a security risk to legitimate followers of USA TODAY's Facebook page.
Media company pages are especially enticing to the spammers because they post articles frequently, giving the fake accounts many opportunities to “like” the posts and therefore seem more like real accounts.
The April purge of fake accounts reduced USA TODAY’s Facebook likesby 6 million, from 15.2 million to 9.5 million as of Thursday night. Wadsworth said Facebook told Gannett it planned to purge another 3 million accounts soon, which could reduce overall followers to as low as 6.5 million.
Merely creating accounts – even a lot of them – that violate Facebook’s terms probably wouldn’t be a crime, said Orin Kerr, a George Washington University law professor and director of the school’s Cybersecurity Law Initiative. “Beyond that, it would depend on what they did with the fake accounts.”
Facebook said in mid-April it didn't appear the spam operation had been activated yet. It didn't involve any paid ads. Still, Gannett had halted marketing efforts meant to attract new readers until it gets the issue under control, Wadsworth said. She said an internal investigation had found no evidence that Gannett or its marketing campaigns had deliberately attracted fake accounts.
