Scam bitcoin ads trading off unauthorised images of Dick Smith, Andrew Forrest and other celebrities, which have taken in tens of thousands of Australians, are part of a highly organised global business that uses five addresses in the centre of Moscow, a Guardian investigation has found.
The sheer scale of the scam has made it difficult for Google to block them, and for Australian regulators to take action.
The fake celebrity ads have run on news websites since at least 2018, but with people stuck at home during the Covid-19 pandemic, many more have been caught out by the scams.
In the most common form of the scam, the unwitting user who clicks on an ad is taken to a fake news story that includes a link purporting to be a cryptocurrency investment scheme. If they enter their details to register for the scheme, they receive a phone call typically asking them to invest a small sum, such as US$250, and then increasingly large amounts.
IDCare, a registered charity that offers support to people scammed online, has been hearing from a victim every business hour since March, its managing director told Guardian Australia.
“This is becoming increasingly common. For some of these people they have lost their entire life savings,” Prof David Lacey said.
‘How could it hurt?’
Janice*, a 77-year-old grandmother from Queensland’s Sunshine Coast, saw an ad on Facebook earlier this year featuring Forrest promoting a bitcoin investment scheme. She clicked through to find out more and was presented with a story on a fake news site that also referred to The Project host Waleed Aly.
After entering her details, she received a call from a man with an English accent who encouraged her to invest in the scheme, so she transferred $5,000 via her bank to Jubiter, a cryptocurrency exchange.
Janice eventually handed over $80,000 to the scammers, her entire life savings, before her daughter told her it was a scam. Despite contacting her bank, the police and the Australian Competition and Consumer Commission’s Scamwatch website, she was unable to get the money back.
Scam celebrity endorsements are a “common deceptive technique”, Lacey says.
“In Germany, Boris Becker is promoting cryptocurrency fraud investments. He, of course, doesn’t, but the crooks know his celebrity attracts and assists with the deception. For an initial US$250 investment, people think, ‘Why not? How could it hurt? It’s not a lot of money.’”
Lacey says the initial investment is a ploy to bait people.
“In fact the real value for the scammers is not the initial US$250, but the harvesting of contact details from someone they know is primed and ready to explore the cryptocurrency investment world.”
How does the scam work?
Guardian Australia began the process of signing up for the scam to determine how people were duped into paying.
The site I signed up to purported to be a bitcoin trading service called bitcoin-Up, but I was ultimately directed to another site called Gtlot, which purports to be a cryptocurrency trading platform. It operates from St Vincent and the Grenadines in the Caribbean, which does not regulate foreign exchange trading platforms.
About five minutes after signing up for the service, I received a call from the Netherlands. The man on the line attempted to walk me through the process of signing up, claiming that from an initial investment of US$250 I could make between $500 and $3,000 a month.
He claimed governments were looking to phase out paper money because of Covid-19, so now was the right time to get on board.
When I told him I was a reporter, he denied any links to scam ads, and still attempted to get me to put in my credit card details and invest money.
At best, these services encourage people to invest in highly risky, often unregulated forex trading platforms where they are likely to lose most, if not all, of their money, with little recourse to get their money back.
At worst they are scams, designed to encourage people to hand over more and more money in an attempt to get their initial investment back.
An international investigation by the Organized Crime and Corruption Reporting Project reported that contact details of people who signed up for such services were also passed on to brokers offering other risky or illegitimate investments.
How do the ads evade detection?
Google says it removed 5,000 bad ads per minute in 2019 – 2.7bn in total – but “scammers are constantly evolving their efforts, while we evolve our policies and enforcement to address this”.
The scammers buy millions of ads in Google’s ad market places, using the names of local celebrities in each country, without their knowledge or endorsement. Dick Smith, Chris Hemsworth, David Koch and Waleed Aly are among those whose profiles have been used in Australia.
The scammers have increasingly sought to get past Google’s detection by making repeated minor changes to the text of the ads in what Google calls a “cat and mouse” game.
Media outlets and other websites that take Google’s ads cannot easily control whether the scam ads appear on their website.
Guardian Australia managed to prevent the ads appearing on its site by blocking a specific marketplace where the ads were being sold. A typical marketplace has tens of thousands of ads – this one had millions.
The scammers purchase hundreds of domain names every month, using a variety of domain registration companies, to host the pages that users are directed to when they click on the ads. The URLs are a jumble of letters, typically only around 10 characters long.
The source code of one of these sites reveals that from Australia it looks like the fake news sites promoting the scam investment, but viewed from outside the target region, it appears to be a website discussing mandarins.
Australian cybersecurity expert Gabor Szathmari found similar dummy websites about plants, swimming and gardening appeared when visited from outside Australia.
When a person is visiting from a targeted location, the site pulls up the fake news website from another domain, meaning it is very easy for the scammers to run the same fake story across multiple sites at once.
When one gets blocked, many more are waiting to be used. The websites do not stay active for long. Some sites Guardian Australia found in late November had ceased working less than two weeks later.
Who is behind the scam?
Websites are often registered to third party companies to hide their true owners.
However, Guardian Australia found five names of people who had registered hundreds of the sites, all with addresses in the centre of Moscow,.
None of those listed on the registration forms responded to a request for comment. Two of the email addresses linked to the account were Gmail accounts. A spokesman for Google said the information would be provided to the company’s security team for investigation.
Other information suggests the operation may have links to Ukraine. Szathmari points out that the sites’ registration form prevents people from registering a Ukrainian phone number. A previous OCCRP investigation found a call centre running similar celebrity-based investment scams operating from the Ukraine capital, Kiev.
What are Australian regulators doing?
Google and Facebook have admitted they are struggling to prevent the ads appearing through their services, and Australian regulators have suggested there is little action they can take.
An spokeswoman for the Australian Securities and Investments Commission told Guardian Australia it was difficult to trace scammers based overseas.
“In some cases, we’ve been able to trace these ads, the majority of which seem to be based overseas, despite creating the impression that they’re operating from Australia by using local addresses and phone numbers on their websites. Any data we have gathered we don’t make this public.”
In the UK, the National Cyber Security Centre has blocked or taken down more than 300,000 websites associated with the scams. Asic has the power to do the same in Australia, but has indicated that it would be impractical due to the large number of websites involved and the overseas hosting.
The ACCC has had some limited success in tackling the sites. Guardian Australia understands at least four have been removed after requests were sent to the web hosts or domain registration service providers, but the ACCC lacks the resources to make greater inroads.
An ACCC spokesman also said it would consider whether the digital platforms were taking enough action to stop scams as part of its current review of ad tech.
“The Ad Tech Inquiry’s scope includes considering the extent to which ad tech services may facilitate, or fail to adequately protect against, the digital distribution of scam ads,” the spokesman said.
*Name has been changed