‘Scammers running riot on social media’

Which? has identified 50 scam profiles, pages and groups across Facebook, Twitter and Instagram with clear evidence of blatant criminal activity.

This included advertising stolen identities, credit card details, compromised Netflix and Uber Eats accounts and fake passports made to order.

With fraud cases rising by a fifth in the last year and losses to coronavirus-related scams already reaching £2m, Which? is concerned that the results of its investigation – carried out before the outbreak took hold in the UK – highlight how lax measures to prevent the trade of personal and financial information on these platforms could be exploited by criminals looking to take advantage of the crisis.

Jenny Ross, Which? Money Editor, said: “It’s astonishing that social media sites make it so easy for criminals to trade people’s personal and financial information, particularly as fraud is such a prevalent crime that can have devastating consequences.

“Social media firms must take much stronger action to prevent their sites becoming a safe haven for scammers, and should work with the financial industry and police to address serious flaws with their platforms.”

The investigation uncovered an alarming post on one illicit Facebook group, detailing the full identity of a man in Yorkshire.

His full name, date of birth, address and mobile number were all listed alongside complete financial information including his credit card number, CVV number and expiry date, sort code and the name of his bank.

The post had already been up for four months when it was spotted by Which?, and the details were even being given away for free, potentially as a tactic designed to prove the seller’s credentials for future deals.

Using the open electoral roll, a researcher was able to establish that the victim had lived at the address listed in the Facebook post at least as recently as 2018, along with individuals whose names and ages implied they were his wife and adult children – demonstrating how easy it would be for a scammer to exploit the details available in the Facebook post.

Meanwhile, one fraudster on Twitter offered full credit card details of someone with a ‘£13k+ balance’ for £100, or three sets of card details for £200. Another offered a phoney passport for £3,000, which could have potentially been used as proof of ID to open bank accounts and credit cards.

Twitter’s algorithm also made it all too easy to find criminal ID sellers. After searching for and viewing such accounts, the site suggested following ones offering similar services through its “who to follow” section.

All 50 of the groups, pages and profiles were reported to their respective social media platforms via their in-site reporting tools.

Shockingly, Facebook initially refused to remove the post containing the clearly stolen details of the Yorkshire man, on the basis that it ‘doesn’t go against one of our specific community standards’.

When Which? requested a review of the decision through the reporting tool, the post was removed, but the hacker group it was posted on remained up.

With proposed regulation of illegal and harmful content on social media platforms – such as the criminal activity exposed in this investigation – a long way from being introduced, the consumer champion is calling for the sites to take much more responsibility and be proactive in removing such content and blocking criminals.

A Facebook company spokesperson said: “Fraudulent activity is not tolerated on our platforms, and we have removed ALL the groups and profiles flagged to us by Which? Money for violating our policies.

“We continue to invest in people and technology to identify and remove fraudulent content, and we urge people to report any suspicious content to us so we can take action.”

Katy Worobec, managing director of economic crime at UK Finance, said: “Criminal gangs are continuing to exploit social media platforms to commit fraud, whether it’s selling stolen identity and card data, recruiting ‘money mules’ or targeting the public with coronavirus scams.

“Banks are taking action on all fronts to protect customers from fraud, including working closely with law enforcement to identify and take down fraudulent activity on social media where possible.

“But we cannot win this fight alone. Every part of society including social media companies must play their part in protecting innocent victims and preventing money getting into the hands of criminals.”