Boostly calls for better prevention of Facebook “cloning scams”

UK: Boostly, an online training platform for hospitality owners, is calling on social networking company Facebook to remove what it claims to be “cloning scams” targeting struggling holiday accommodation operators, creating competitions for their customers.

Credit card details are believed to have been requested from competition entrants and followers of small accommodation businesses, in a large-scale operation targeting typical Facebook competitions, Boostly has revealed.

Mark Simpson, the founder and owner of Boostly and the Boostly hospitality podcast, said he was “inundated with pleas for help” from businesses who had had their pages cloned on Facebook. Scam pages were set up to message competition entrants of the original, genuine business to tell them that they had won a competition and had to give a deposit or their credit card details in order to claim the ‘prize’ [typically a couple of nights’ accommodation].

According to Simpson, the evidence suggests that Facebook is failing to use its sophisticated technology to “prevent scammers from inundating the platform on a huge scale to target their victims”.

He claims that when fraudulent and illegal activity is reported, Facebook gives a standard response:

“We’ve reviewed the profile reported and found that it isn’t pretending to be you and doesn’t go against our Community Standards.

“If you think we should take another look, please reply to this message and let us know.

“Note: If you see something on someone’s profile that shouldn’t be on Facebook, make sure that you report the content (e.g. a photo or video), not the entire profile.

“For more information about our policies, please read the Facebook Community Standards.”

Simpson said the cloning “clearly goes against Facebook’s guidelines for pages“.

Joanne Carroll ran a competition on 16 April to win a one-night stay at Winchcombe Farm with a distillery tour and a bottle of rum as prizes in collaboration with another local business. They found out that a fictitious account had impersonated their page and she posted to warn customers and competition entrants of the scam on 20 April.

Carroll said: “Police seemed unconcerned. Action Fraud told us to fill in a form, but we haven’t heard back since. Had about 70 messages and calls from followers alerting us that a new clone page directed people to a website which asked for their bank details. Facebook only took the page down after we appealed!!”

Simpson was made aware of the potentially fraudulent activity when he ran the ‘Get Booked Up’ Challenge on Facebook in March, when accommodation business owners across the world took part in the challenge.

He said: “We take accommodation hosts through an intense week utilising Facebook to get thousands of new eyes on their business, and teach them how to turn these lookers into bookers. Hosts ran a legitimate Facebook competition as part of the challenge, giving their followers a chance to win a short stay at their holiday accommodation.”

Emma Khan, host of Riviera Guesthouse Whitby, was targeted when she ran a giveaway as part of a previous challenge in December. Simpson expected cases to follow and prepared to advise businesses if it happened, but he said that the volume of scams from Facebook competitions in the March challenge was “shocking”.

He said: “It’s really sophisticated, it’s all automated. It’s an absolutely shocking operation.

“What’s even worse is that Facebook fails to prevent it. I was shocked it was allowed to happen, and Facebook did nothing in some cases. Better rules and verification are needed to prevent this kind of scam in the first place,” he added.

Holiday accommodation businesses targeted include:

Eileen Pratt, Old Ginn House Inn, said: “We were targeted in November 2020. The other profile had a slightly different name and logo, but most people wouldn’t notice the difference. I followed the Facebook profile and it changed back – to the original? A number of people reported the profile, but Facebook said it didn’t contravene their rules.”

Georgina Bearman, Sea Croft Bed, Breakfast and Bar, said: “I had people report that my competition post had been scammed and people received messages saying they had won. Had to reply to all concerned explaining the winner had already been picked some days ago and it wasn’t them!

“It discredits us as a business! We have worked hard to build what we have, so it makes me think twice about using Facebook for business,” she added.

Ciara Tiernan, Willowtree Glamping Mournes, said: “My page was cloned. I reported it and so did others then it was taken down.”

Charlotte Lovelock, Rock Cottage nr Padstow, who ran a competition to win a two-night stay and a Cornish Cream Tea, said: “My page was cloned and the scammer sent friend requests to my followers / entrants. I reported it but Facebook said it didn’t go against their privacy policy. I didn’t hear from them again after I complained.”

Claudia Hodgson, Cheverton Farm Holidays, said: “I began to get dozens of messages from people saying they had been messaged saying they had won and asking for card details.

“Horrendous! So stressful. I didn’t know what was happening! It feels terrible,” she added.

Emma Louise Khan, Riviera Guesthouse Whitby, said: “Ours was scammed and we had so many people report it to Facebook. Every single time, they told us that it didn’t contravene their rules.

“They made about four different clone pages and took all our posts and photos and shared them onto the scam pages so it looked real then started messaging guests from our page and taking money. It caused us an awful lot of admin during the week we ran it.

“In all honesty, it’s put us off Facebook competitions. The last thing we want is our guests scammed. It doesn’t make our business look hugely professional when there are about five pages with similar names and photos of our faces,” she added.

Simpson said that as a result of scammers not facing repercussions from Facebook or authorities, business owners were being disproportionately with bans for harmless activities by the social media network in the last month alone, including:

  • A warning was given for posting a YouTube link for a website tutorial

  • A 24-hour ban was imposed for calling someone “an absolute potato”

  • A 30-day ban was applied for a “non-violent image of a recorded historic fact”

Tereza Szalai, Foxy Fitness personal trainer, said: “Facebook should upgrade their security instead of picking on words in our posts to penalise us.”

Social SOS director Meredith Hicks, who manages Facebook competitions for small businesses, said: “Businesses are really struggling with this. Food and hospitality businesses everywhere experience this and it causes huge issues. I’ve received a lot of messages from obvious scammers.

“Sadly, Facebook has made it hard now to actually get anything done about fake accounts. Business owners ask customers to support and help; they post on the real business page asking customers to be careful, and we warn people to never give out credit card details,” she added.

Catherine Knibbs, Trauma Adult Psychotherapist and Online Harms and Cybertrauma advisor, said: “Cybercriminals targeting competition entrants pose as businesses to entice the ‘winners’ by hacking into their joy rather than their fear. In doing so, they target people who ‘win a small break’, who are desperate to get away post-lockdown.

“A double blow for small businesses as they have their online page copied – they also have to explain to people that they did not win, have been scammed and hope that the targeted ‘winner’ hasn’t given their details to cybercriminals.

“But why should this responsibility fall to the business, why is Facebook not removing cloned accounts? Why is Facebook not creating a business account process where unverified accounts can be deleted to protect users?” she added.

Simpson explained the latest tactics used by scammers in this video and advised small businesses to follow the process below:

  1. Report the scam to Facebook

  2. Comment on the competition post to warn entrants

  3. Write a new post to inform followers

In March, Boostly uncovered reports from hosts across the UK who said that they were having to defend their accommodation reserved for emergency workers during lockdown against increasing numbers of people “dishonestly” posing as key workers, in order to get a holiday.