50 ms·

I lost €4k in a Facebook scam

• londons_explore 6y ago
  Your mistake is using "Log in with Facebook" on a mobile device. Since neither iOS nor Android have any kind of trusted UI, there is no way you can be sure if you are logging into Facebook on an app, or just giving that app your credentials for them to do as they please. Until iOS or Android get trusted UI for these usecases, I suggest using browsers on windows/Mac/Linux where you can see the in the address bar which company you are giving credentials to, and can't as easily be faked. If you must use a mobile device to log into Facebook via a third party app, I suggest using a new Facebook account each time.
  • canes123456 6y ago
    iOS will redirect you to your Facebook app
    • beervirus 6y ago
      Delete the app. There’s no reason to install it.
  • xaitv 6y ago
    > If you must use a mobile device to log into Facebook via a third party app, I suggest using a new Facebook account each time. I might be wrong about this as I've not used Facebook for many years now, but doesn't Facebook require a phone number for new accounts nowadays, and requires you to use your real name as well?
    • danielhua 6y ago
      It's actually even nastier than that. If you fail their automated checks for fake accounts, they'll lock your account and require you to submit a photo of your face and ID card.
    • wolco 6y ago
      No I have an older relative who creates a new account every other week for whatever reason. Think of how many accounts are created for games reasons. Some games require friends taking action to progress. Some allow friends to send prizes like lives/money/resource.
      • Sohcahtoa82 6y ago
        > No I have an older relative who creates a new account every other week for whatever reason. Could be like my grandma who would occasionally manually log out of the app, but then the next time she loaded the app, rather than actually logging in again, she'd create a new account because that's what she did the first time she loaded the app and thought she had to do that every time.
  • gridlockd 6y ago
    It's possible to do "trusted UI" on iOS/Android by opening a browser window that shows you're actually logging into facebook-dot-com. That still wouldn't prevent these scams from working because users don't necessarily know how to tell the difference between "trusted UI" and "scam UI".
    • londons_explore 6y ago
      Except it isn't... Because the app can just show a UI that looks like a browser window, and there's no way for the user to know.
      • danielhua 6y ago
        https://news.ycombinator.com/item?id=24470530 https://news.ycombinator.com/item?id=24470530 Looks like it was a real Facebook login webview.
        • gridlockd 6y ago
          ...which is different from a browser window, running inside the actual system browser. The difference may of course be subtle, but even obviously fake logins can work on the untrained eye.
      • gridlockd 6y ago
        If you open a browser window, there is going to be some things that can't be faked 100% accurately, e.g. on iOS there will be a link back to the app at the top left, there is going to be an animation, and so on. It could be faked 95% accurately, but that's moot, because like I said, the user hasn't necessarily learned what "trusted UI" is in the first place.
      • donmcronald 6y ago
        Like this old trick. https://news.ycombinator.com/item?id=4629906 https://news.ycombinator.com/item?id=4629906
  • babuskov 6y ago
    > Your mistake is... Not mine. I just posted what Niek van der Maas wrote on his GitHub. I don't think he's even reading this HN thread.
    • NiekvdMaas 6y ago
      Actually I am ;)
      • babuskov 6y ago
        Cool :)
  • taftster 6y ago
    I don't feel comfortable tying any two logins together for any site, regardless of mobile vs. desktop. Choosing to log into any site using facebook, google, etc. is setting up for trouble. I much prefer a strong password manager and separate logins for everything.
  • NiekvdMaas 6y ago
    (OP here) While you are absolutely right, I want to highlight that this was done in a quite sophisticated way. It's actually the real login page of Facebook in a webview. I have 2FA on all my accounts including FB, so it looked very legit. Once you have logged in, they seem to grep the token and close the webview.
    • GoblinSlayer 6y ago
      You mean they extracted your primary full access token, not the generated restricted oauth token?
      • NiekvdMaas 6y ago
        Yes, pretty sure. It wasn't an oauth screen but the actual FB login screen.
      • londons_explore 6y ago
        If your app has a webview in it, on both iOS and Android, you have full access to run script inside that webview and take/set cookies for any domain. You can easily take the auth cookie. Some Google auth cookies can only be used on the same tls session that created them[1]. That means the TLS session resumption information (which can be tied to hardware platform features like the TPM) is required to make use of a stolen auth cookie. Unfortunately while that approach has big security benefits, it's pretty anti-user-privacy. [1]: https://nakedsecurity.sophos.com/2018/10/25/could-tls-session-resumption-be-another-super-cookie/ https://nakedsecurity.sophos.com/2018/10/25/could-tls-sessio...
  • ramses0 6y ago
    iOS has trusted UI via "double-tap-side-hardware-power-button". So it's a trusted trigger, and a presumably native UI. I've been very impressed by eBay/PayPal providing "very good" almost native-feeling payment integration (swipe-to-pay, UI coming up from the bottom of the screen), so it may not last forever, but interesting to hear of the depth of scamming possible on phone UI's (and probably desktop UI's too).
• commoner 6y ago
  PayPal is not very dependable when it comes to handling disputes. If you paid with a credit card through PayPal, file a chargeback via the card itself and your financial institution should be able to help. But if you paid with your PayPal balance, you're most likely at Facebook's mercy at this point. Dutch laws might offer additional consumer protections.
• phoe-krk 6y ago
  > The scammer used my Facebook auth token to remove me from the Facebook Business entity. Strangely enough this is possible without getting any emails from Facebook. I had no way to check my Business entity or Ad account on Facebook to see what's going on. This is an error on the Facebook side. Actions like this should never be possible without appropriate confirmation or re-requesting the password for 2FA confirmation.
  • marcinzm 6y ago
    I can sort of see why this is allowed. * Employee starts a Facebook business page using their personal Facebook account. * They add their boss to it. * Employee is fired. * Boss removed employee from Facebook business page. edit: Should still send a notification email but I'm guessing angry "why did you remove me from X" reactions are why they don't. Not good but there's a logic behind it.
    • bkor 6y ago
      The additional confirmation is not from the user being removed, it's from the user doing the removal. In this example the API/oauth was enough to do this. There really should be an additional confirmation certain times. Like how Google sometimes requires you to put in your password/2fa again, despite previously authenticating or saying something like "don't ask me again".
      • marcinzm 6y ago
        I presume the scammer added a new account, made it an admin and then used that to take over. So it's not the removal that's the issue but adding a new admin on the account. Of course if you allow this type of activity through oauth I don't think there's a good way to re-authenticate.
        • jackson1442 6y ago
          In that case, adding a new admin should require re-authentication.
• fabbari 6y ago
  It seems odd that the Facebook authentication token would allow that kind of access - admin on the business pages - by default. Were you asked for particular permissions? Or did they fake the Facebook login completely?
  • jlund-molfese 6y ago
    I'm assuming the app impersonated a real login with Facebook prompt. When I use a real Facebook login in another app, it tells me which permission I want to grant to another site, and lets me edit them. But I wouldn't think twice if I was asked to enter my credentials (which happens if you don't have the Facebook app installed) and didn't receive that permissions prompt.
  • NiekvdMaas 6y ago
    It's actually the real login page of Facebook in a webview. I have 2FA on all my accounts including FB, so it looked very legit. Once you have logged in, they seem to grep the token and close the webview.
• TekMol 6y ago
  This sounds like the author typed their facebook and paypal credentials into the app.
  • matsemann 6y ago
    Thousands of apps have "Login with Facebook" (and others), and it's often impossible to know if it's a real oauth flow or just a fake login page.
    • JimDabell 6y ago
      On iOS, if you have the Facebook application installed, the Facebook Login user journey opens the actual Facebook application. If you don’t have it installed, it will open the Facebook website in Safari. In both cases, assuming you are an active user of Facebook, you will already be logged in. If it’s a fake OAuth screen? The first tip-off, assuming you use the application, is that it didn’t open the application. The second tip-off, in either case, is that it’s prompting you to log in. You can verify that you are logging directly into Facebook by going back to the home screen (which is not something an application can intercept), and re-opening Safari or the native application. If you were really in Safari / the Facebook application beforehand, it will come back to the same screen. Then you can check the URL to ensure you are on Facebook if you are in Safari. As far as I am aware, it’s never "impossible to know". However it may be difficult for the average user to know how to determine this. For the average user, the rule of thumb "never log in to Facebook if a different application opened the Facebook login screen; only log in to Facebook if you opened the native application yourself or typed the website address yourself" is adequate. It’s also worth mentioning that most password managers will pay attention to the domain, and there’s also a mechanism for this for native applications on iOS. So the password manager not auto-filling is another red flag.
      • vezycash 6y ago
        >On iOS, if you have the Facebook application installed, the Facebook Login user journey opens the actual Facebook application. If you don’t have it installed, it will open the Facebook website in Safari. Can someone else confirm this? Those authentication screens are scary. With a web browser, I can at least scrutinize the URL.
• WrtCdEvrydy 6y ago
  > the scammer used my Facebook auth token to remove me from the Facebook Business entity If you are able to use the account to purchase something in my name, I would expect the security to at least include a 2FA prompt. I'm not really big into the Facebook ecosystem but this sounds terrible.
• canes123456 6y ago
  You can make paypal charges with a Facebook oauth token? Or they keyboard log his facebook password
  • danielhua 6y ago
    He had a Facebook ads account with PayPal linked, and the hacker used his login info to run their own (apparently Vietnamese aluminum product) ad campaign and spend using his account.
    • drcongo 6y ago
      Why would anyone link those two things? That just seems insane to me.
• toxicFork 6y ago
  > Initiated a PayPal chargeback process - PayPal responded: "we’ve determined there was no unauthorized use" Just wanted to highlight this. Things like this is why I avoid PayPal as much as possible. For many years now.
  • DanBC 6y ago
    Just checking you know that many banks would take the same stance.
    • toomuchtodo 6y ago
      American Express has never denied a chargeback I've initiated. When you say "many banks", of course don't bank with someone who is going to screw you, like Paypal or Wells Fargo (and Bank of America or JP Morgan Chase, to a lesser extent). This should be common (US centric) knowledge by now.
      • tluyben2 6y ago
        Amex doesn't but visa/master/etc depend on the issuing bank and they can (and do) refuse. More in other countries vs USA as far as I understand.
        • toomuchtodo 6y ago
          Agreed, but if your time has value, (if you can) structure your financial transactions in a way and with service providers that derisks you having to spend hours chasing down your own money when you shouldn't have to (or going through the motions and being told you're SOL). And never use Paypal!
    • klmadfejno 6y ago
      On some services. You would almost certainly be able to recoup the money if it was paid for via credit card.
    • starfox64_ 6y ago
• except 6y ago
  The app looks poorly made and there are clear spelling mistakes plus the fact that it was not offered by TikTok which should have made you suspicious. It sucks this happened but maybe you should have done some research and checked if this app actually did belong to TikTok. I assume the app also asked you to login to Facebook directly rather than OAuth which should also made you suspicious.
  • klmadfejno 6y ago
    I've often heard the argument that scams add spelling mistakes to only catch the idiots that have a high conversion rate for the scam. That doesn't feel like it makes sense on something like this which is highly sophisticated. Is it just bad quality?
    • except 6y ago
      My point was that official applications rarely ever include them, not that it was intentionally placed there.
  • Avamander 6y ago
    Very American opinion. You are aware that there's a lot of non-native English speakers who can absolutely miss a few typos?
    • except 6y ago
      My apologies, I missed that possibility. The app still looks poorly put together regardless.
  • babuskov 6y ago
    > you should have done some research Just to be clear, this didn't happen to me. I just posted what Niek van der Maas wrote on his GitHub. I don't think he's even reading this HN thread, so no use giving him advice.
• sjroot 6y ago
  As someone who also takes all the right account security precautions, I too have been fooled by a scam Facebook ad. It seems like this is an increasingly-common attack vector that FB needs to address. Specifically, I think it would help for them to verify ads, as they do people / pages.
  • spzb 6y ago
    But then they’d lose that sweet revenue
  • Avamander 6y ago
    Yet another scenario where we're collectively being bitten in the ass because most of the world is still lacking a proper digital identity system. If you're thinking that sending pictures of identity documents or bills is going to fix it no, it's clown-tier identity verification and will just postpone the issue a tiny bit with massive human resource cost and false negatives.
    • donmcronald 6y ago
      > it's clown-tier identity verification I remember learning this when I got my first code signing certificate. I had to jump through a TON of hoops including sending notarized copies of my ID to Comodo. After all that, they asked ME to send them a list of notaries for my jurisdiction. They also wanted a direct line to call the notary I used which is basically impossible to provide. The verification is outsourced to the cheapest English speaking 3rd world country they can find and there's ZERO localized knowledge. I don't think you could build a system that's worse if you tried. The whole think is just a process of checking boxes which is very similar to most of the 2FA systems in existence.
  • Nextgrid 6y ago
    Is there any evidence that the people/pages verification is safe? I've seen plenty of fake accounts and the existence of misinformation or outright criminal (card fraud, etc) pages suggests the opposite.
  • prox 6y ago
• spzb 6y ago
  So this basically amounts to “sign in with Facebook and the app gets a token with which it can control your whole account”?
• tobyhinloopen 6y ago
  I think the trick here was to prompt the user with a fake oauth screen. Many legit apps show the oauth screen using a web frame inside that app. It is absolutely stupid that it is still a common occurrence. If you need to enter your credentials when using sign-in-using-xxx, be VERY cautious. Even if you have 2FA enabled, the fake oauth screen can just ask you for the 2FA code. You have no way of knowing whether the login page is keylogged or hijacked.
  • dragonwriter 6y ago
    > Even if you have 2FA enabled, the fake oauth screen can just ask you for the 2FA code. Not all 2FA is “enter a code”; it's a lot harder for a fake oauth screen to send a request to your registered authentication device. EDIT: this doesn't really help, as a reply points out. OTOH, separate side channel verification of logon from unexpected devices does.
    • snazz 6y ago
      Is it? Couldn't the backend (or even a human attacker) just type the credentials you provide into the real login page, giving you the "tap yes" push notification just the same?
      • dragonwriter 6y ago
        Come to think of it, you're right. I was mentally combining that 2FA method with “new device attempted login” detection, but the latter is usually separate from 2FA. If a login system uses that and provides notice and requires confirmation through a side channel, rather than merely providing informational notice, it will stop (or at least, make it easier to stop; a second user mistake or preexisting side-channel compromise is still possible) the attack. If it's just notice, it at may limit the impact or streamline recovery from the attack. But now that I think about it, it would make sense to combine new device notification with push-notice 2FA for exactly that reason, since you've got a push channel that takes a confirmation already, flag unexpected devices in that channel as well and it becomes much more secure.
      • 6y ago
• noisy_boy 6y ago
  Not sure if Facebook allow some sort of max-spend cap that can only be increased with a 2FA together with an alert from the Facebook app itself. That should atleast alert someone in the sense that "why am I getting a confirmation message to debit for a voucher credit" and worse case scenario even if they don't realize it, should limit the damage.
• jariel 6y ago
  Can someone explain what happened here? 1) His FB credentials were hacked? 2) All to force 'spend' on some odd Vietnamese add? How does that benefit the scammer? 3) If the money went to FB for clearly scummy purposes, how on earth does FB not simply refund the ad spend? There's not cost of goods sold here for them, usually they should be pretty easy on giving you the money - or at very least giving you credits?
  • OJFord 6y ago
    3 - yeah my reaction too, I imagine it will no problem, just OP's case hasn't yet reached someone who can refund that figure.
  • fsaintjacques 6y ago
    Let me introduce you to the underworld of affiliate marketing https://www.investopedia.com/terms/a/affiliate-fraud.asp https://www.investopedia.com/terms/a/affiliate-fraud.asp There's always money to be made if you can generate significant legitimate traffic to a given destination.
  • alphager 6y ago
    1) Yes, they either outright stole the credentials or stole an oauth-token. 2) The scammer either actually has a vietnamese metallurgy business ore (more likely) sold ad space on facebook to a vietnamese metallurgy business. 3) yes
• redleggedfrog 6y ago
  "...and I'm generally very cautious with account security." "Two days ago, I spotted an ad while browsing Facebook..." Those two statements are mutually exclusive.
  • TillE 6y ago
    I'm constantly baffled by the number of tech-literate people who don't use ad blockers. I don't know how they can stand it.
    • Avamander 6y ago
      You're acting like Facebook isn't hostile to adblockers, Facebook is making it very difficult to block their ads continuously.
      • drcongo 6y ago
        It's easy, I have every single Facebook owned domain blocked at the network level and I never see a Facebook ad. Or Facebook.
    • jacquesm 6y ago
      Unless you're in ad-tech there is no reason why you would.
    • zerr 6y ago
      fwiw Facebook has a dedicated team for adblocker circumvention.
    • GoblinSlayer 6y ago
      He literally buys ads and fell for this scam because it proposed ad credit. Oh, wait, he got what he deserved.
      • jlarocco 6y ago
        I wouldn't go quite that far, but the sense of schadenfreude on reading the article was through the roof. Spam and web advertising have always been underhanded, and if a person with "15+ years in adtech" can't avoid an ad scam, what does that mean for everybody else?
• s_dev 6y ago
  Scams like this are why walled gardens like the App Store exist. Theres no way a scam app like Tik Tok Business would be able to stay on the App Store for a sustained period of time. Even still the Dev admits himself he could have been more on guard with an Android Developer name like "Develop App".
  • kzrdude 6y ago
    And why we have adblockers - because it's an as-if-unmoderated stream of invasive and untrustworthy links.
    • thrownaway954 6y ago
      i don't get how an adblocker would have help in this case. the victim could easily be conned into downloading this app through a marketing email or some other way. the real issue is that an app like this is even allowed on the play store at all.
  • behringer 6y ago
    The Google App store is a walled garden. How come this scam app operated long enough to get so many high reviews?
    • moneywoes 6y ago
      It's possible they bought the reviews
    • s_dev 6y ago
      Play Store is much more flexible than the App Store regarding what it will allow published -- also how much attention it places on its gatekeeping activity. It is a walled garden but the walls simply aren't as high.
    • vezycash 6y ago
      You can buy reviews. Same would be possible in any other store.
• marcinzm 6y ago
  Facebook ads seem to be an ocean of scams. If I click the comments of half the ads I see there's nothing but complaints about products not shipping, fake closeout sales, cloning another store and then not shipping, etc, etc. I'm guessing they delete the bad comments so you can only imagine how many people must be upset to not be able to handle the flood of bad comments. At this point I just assume any Facebook ad is a scam of some kind.
  • behringer 6y ago
    I reported one such scam business and it's still operating months later. Best to just block all facebook ads and ignore any that slip through.
    • moneywoes 6y ago
      I have Unlock origin and still get Facebook ads, any idea?
      • behringer 6y ago
        F.B. Purity should do the trick.
      • deleted 6y ago
        [deleted]
      • deleted 6y ago
        [deleted]
    • pbhjpbhj 6y ago
      Perhaps a 'truth in forums' regulation should require all comments to be accessible, with the reason for their removal from standard view being indicated? That way removal of all negative comments could be monitored and consumers would have sufficient information to moderate their trust in companies advertising. I reported one of the 'miracle showerheads' to UK Trading Standards [it was possibly ASA?] as it clearly gave false (physically impossible) claims. I was seeing lots of their ads on FB and people were clearly falling for it. They reported back that it was a foreign company and so they couldn't do anything. Which is weird because they're allowed to advertise to me, so they should have to follow the rules. Also, they had a UK Trademark, which seems a major flaw - protect the trade of scammers but don't hold them to account.
• homero 6y ago
  Wow I saw that same ad for the tiktok ads a couple of days ago, I almost clicked it but something seemed off with the colors
• muststopmyths 6y ago
  >Sure, the developer name "Develop App" sounds strange and should I have looked better, the developgameonline@gmail.com developer email and com.acazira.tforbusiness package name would have definitely raised some concerns. Come on, dude. I will say that even the most experienced techies among us sometimes become complacent and let our guard down. It's exhausting having to constantly second-guess every application you want to run. (Not interested in starting another platform flame war, but this is the main reason I don't use Android. I deal with enough paranoia running Windows daily. Maybe I'm misinformed, but I'm also probably not unique in this respect) I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ?
  • actionowl 6y ago
    Not being an android user and not being familiar with the Play story I might have glanced over "Develop App" having internally misread it as "Developer App" and thinking it was a category, not the developer's name.
    • NiekvdMaas 6y ago
      Exactly this, it doesn't really stand out. Obviously I wouldn't have installed the app if I would have noticed.
      • muststopmyths 6y ago
        I wasn't trying to excoriate you for your mistake, so I apologize if that's how it comes across. I did try to modulate the harshness of "Come on, dude" with the rest of my comment. Like I said, sometimes we let our guard down. So it's understandable if you got fooled. In hindsight there are more red flags in just that screenshot ("More by Develop App", obviously fake reviews to point out just two), but God knows I've clicked through installs for shit apps on iOS many times.
        • ShroudedNight 6y ago
• IAmNotAFix 6y ago
  I don't understand the step where the author is logging in with Facebook. Was that a legit OAuth 2.0/OpenID Connect log in? (In this case this must have been OAuth 2.0 with a scope giving the application write access to business stuff.) Or was it a phishing page in which the author gave his facebook password?
  • admn2 6y ago
    I believe it was actually OAuth or else FB would have likely blocked the login from another country or at the bare minimum sent OP a suspicious login email.
• stiray 6y ago
  (My moral compass is still up and running while some call disabling it "running bussiness") I wonder why something like this never happens to me? - I am not paying a dime for advertising as it is completely inappropriate to spam more users with ads (Zillions of ads and you are one of them? And this works? Really? Not for my users and my reputation.) - I dont use facebook as I have real friends to go to a beer with - I dont open any ads (but ad nauseum [1] does) - I dont use TikTok and I dont see anything positive in it so even if I would be advertising I surely wouldn't spam kids with ads -- ... (I could call this whole event a "poetic justice") [1] https://adnauseam.io/ https://adnauseam.io/ (edit: fixed wrong wording as suggested - anyway I dont attack op - in same manner I dont attack drug dealers. I am just explaining why I dont do that. Or sell drugs. Someone might learn something from it.)
  • elwell 6y ago
    > unappropriate "inappropriate", as in: "Your attack on OP is inappropriate."
  • deleted 6y ago
    [deleted]
• danielhua 6y ago
  As someone who's fairly involved with the e-commerce/digital marketing space, let me just say I'm amazed by how brazenly nasty this scam is. The TikTok promotional program is actually a real thing that does give around that amount of ad credit, and they have been promoting it very aggressively on Facebook with for a long while now, so it makes sense that OP would've not had any mental red flags triggered by the designs and creatives used by the scammers. The real killer is that PayPal is actually well within their rights to process this transaction (as part of the billing agreement generated when you link PayPal to Facebook Ads Manager: there actually was real ad spend in a real Facebook ad auction), so it's down to Facebook itself to refund the ad spend. (As an aside, I'm actually impressed that OP managed to reach Facebook support at all, and that they acknowledged or even understood what the problem was. I have had worse experiences in the past with FB...). What's really amazing to me is that the scammers managed to get on Google Play with thousands of obviously fake reviews, and get through Facebook ad review at all. The scammer silently removing OP as an admin from their own ad account, preventing them from noticing or stopping the fraudulent ad campaign is just icing. I suppose the real lesson to be learned is to simply avoid installing native applications when you can help it. OP didn't screenshot the login screen in app, so I can only assume it was a real Facebook oauth flow, but honestly at that point it's already too late. If anything OP should be grateful that the native app running on what was presumably his personal device didn't do anything worse.
  • user5994461 6y ago
    > The scammer silently removing OP as an admin from their own ad account, preventing them from noticing or stopping the fraudulent ad campaign is just icing. This hints of not having 2 factor authentication anywhere in the chain? Would definitely advise to setup 2 factor authentication on anything managing 5 figure sums.
    • danielhua 6y ago
      I was surprised too since OP's writeup indicates that he has 2FA on everything. You would think that you'd at least get an email or push notification if you get removed from an ad account/notification settings get changed, so it seems like an oversight by FB.
• 0xbkt 6y ago
  I can't stress this enough. Please always check for the correct spelling, punctuation and stylizations of words/brands in a suspected ad. It's written as "TikTok" everywhere, not "Tiktok". I almost always see this kind of stylization errors in fraud ads.
  • bluedino 6y ago
    They spelled 'voucher' two different ways (vocher), and the poor grammar should be a sign of trouble.
    • pbhjpbhj 6y ago
      On the other hand, I spot errors in major brands copy pretty regularly. Verification of origin is something companies need to put more effort into in general.
  • segfaultbuserr 6y ago
    Good advice, and I'm generally pay attention to correct brand stylizations, but I do have to acknowledge that the large "TikTop" icon in the ad and the app description was attractive enough for me to let my guard down (I'm not the author), I didn't notice the incorrect "Tiktok" text in the app screen until I saw your comment.
• bjarneh 6y ago
  So someone payed €8,235.82 for 2,126 clicks? Clicks are getting expensive these days...
  • zurfer 6y ago
    well, someone payed 8k to show an ad to 2.6 million people it was just not a good ad
    • 9HZZRfNlpR 6y ago
      They probably want to run the budget as fast as possible because sooner or later you get caught and care little how effective it is or how much to optimize it.
    • bjarneh 6y ago
      I wonder what the average is, i.e, how many people have to see an ad to click it. Only time I seem to click those ads seem by mistake
• sova 6y ago
  Astonishing that people with such creativity would resort to theft and deception -- you cannot steal as much as you could earn legally, making something useful for everyone!
  • crispyporkbites 6y ago
    Not in Vietnam
  • bserge 6y ago
    If only it were true
    • sova 6y ago
      https://opengovasia.com/vietnamese-it-sector-posted-six-month-revenue-of-over-43-billion/ https://opengovasia.com/vietnamese-it-sector-posted-six-mont...
• tinus_hn 6y ago
  The moral of the story: if you use your Facebook account for anything concerning money, do not enter its credentials into any app or site that asks for it.
  • coldcode 6y ago
    Or don't use Facebook at all for anything. Facebook makes money off of selling real people's information to anyone who pays; if some of them are fake, or the purchaser is fake, it's still money to Facebook. If the Facebook data customer is getting ripped off, what incentive does Facebook have to police the situation as long as they still get their cut?
    • tinus_hn 6y ago
      You can’t stop Facebook from collecting information about you by just not having an account.
• drchiu 6y ago
  I’d say that the prevalence of marketing hacks out there have made people let their guard down. We assume businesses will lose money on purpose to gain traction to the degree that when we see deals like these, we jump at it without a second thought. No doubt there’s technical engineering that went into this scam, but the social engineering and manipulation of the target’s psychology is the real secret sauce.
• tnolet 6y ago
  I’m clueless about mobile stores and reviews. How does such an app get so many positive (obviously fake) reviews?
  • squeaky-clean 6y ago
    It's really easy to find services like this just by googling the right thing. I've never used one, but just from a quick search $630 can get you 200 five-star reviews. I don't know if the site I found will let you repeatedly purchase for even more reviews, but several of these sites came up when I googled so it would also be pretty easy to just use 5 different fake review sites to get up to 1000 fake reviews. If the price is consistent across them, that means 1000 reviews costs about $3.1k. Expensive, but it apparently only takes 1 tricked user to become a profitable scam. Not saying a similar scam would not have fooled me, as I'm looking at the screenshot in the article with the knowledge that it's a scam, so it's an unfair comparison. However the first thing that immediately stands out to me is there are no 2,3,4 star reviews on this app. The reviewer comments are also very generic and have many grammatical errors in each featured one in the screenshot, and the featured reviews are all from Sept 1.
  • rasz 6y ago
    Want a $1? download and like 5 of our apps! works great in countries with $1/hr wages.
• z3t4 6y ago
  How could Facebook charge the Paypal account without authorization nor second factor??
  • GoblinSlayer 6y ago
    American convenience "shut up and take my money".
  • commoner 6y ago
    If you accept a billing agreement with a merchant on your PayPal account, that merchant becomes able to charge your PayPal account without confirmation. https://www.paypal.com/uk/smarthelp/article/what-is-a-billing-agreement-and-how-does-it-work-faq1848 https://www.paypal.com/uk/smarthelp/article/what-is-a-billin... To cancel the billing agreement, follow these instructions: https://www.paypal.com/us/smarthelp/article/how-do-i-cancel-a-billing-agreement,-automatic-recurring-payment-or-subscription-on-paypal-faq2254 https://www.paypal.com/us/smarthelp/article/how-do-i-cancel-... Some merchants encourage or force a billing agreement before the customer can make a purchase. The PayPal UI does not make a strong distinction between entering into a billing agreement and making a standard purchase. For users who are not familiar with the PayPal checkout process, the billing agreement UI looks just like a normal step in the process.
    • koyote 6y ago
      I actually happened to be going through the Paypal settings yesterday as I couldn't get it to make a purchase on ebay and thought something might be wrong there. I had around a dozen merchants who were listed in the automatic billing payment list and only one of them was a subscription I remember setting up. (the others were all legit and large businesses and none of them have charged me, but they could have!). I have since 'deactivated' all of them. I really do hate Paypal but I often choose them when I buy something from a smaller web shop as I do not trust the web shop to keep my card details safe...
• tehlike 6y ago
  Initiate a charge back through the bank
• jacquesm 6y ago
  Red flag missed: all reviews are of the same date. (Sept. 1st).
• tluyben2 6y ago
  Browsers / webviews must have a special visual state for OAUTH requests. As it is very easy to mimic.
• bluedino 6y ago
  Most fraud starts with people thinking they are getting something for free.
  • sukilot 6y ago
    It's hard to con an honest person unless they are mentally impaired.
    • pbhjpbhj 6y ago
      I think it's relatively easy to con honest people because they tend to think other people have similar moral standards. 'we're inspecting your home on behalf of the government' [steal your jewelry] 'we're calling from your bank as there's been a problem with your account; we need you to read an access code from your phone' (steals savings) 'we're calling from your pension advisor as you appear to have been missold payment protection' (steals pension) They're doesn't appear to be any need for dishonesty on the part of the conned. It's possibly easier to con a greedy person?
• fokinsean 6y ago
  The app reviews are your first dead give away > Tik Tok ads business is best application. It's very awesome application. And every other review is similar
• saos 6y ago
  Wow all that an OP still won’t delete Facebook business account.
• chatmasta 6y ago
  > Unfortunately I don't have a screenshot of the ad in question FYI I believe there is a way you can see the ads you've clicked on in the last 3 months from within Facebook settings somewhere.
• vezycash 6y ago
  One more reason why adblockers are a must install for everyone especially non technical people.
• dmix 6y ago
  The misspelling of Voucher as Vocher on the big FB call to action (to connect your business FB account) was the biggest red flag to me.
• PerilousD 6y ago
  sorry for your loss - but you are STILL using Facebook? Any future problems look and hard in a mirror.
• zenexer 6y ago
  Perhaps the most interesting part is the final line of the document: > Initiated a PayPal chargeback process - PayPal responded: "we’ve determined there was no unauthorized use" While I get the impression that the user had authorized Facebook to charge via PayPal in the past, I find this conclusion rather silly. If I give my credit card number to Amazon, and someone hacks my Amazon account and starts making random purchases, chances are I'd have no trouble filing a chargeback.
  • donmcronald 6y ago
    Yep. Authentication is being used as an excuse to blame the user. It's because Facebook's a big company. If it was a small website where a user got phished PayPal would have charged it back IMO.
• jrockway 6y ago
  I read things like this and keep thinking about the "web of trust" from the 90s. There is no way to visit some random app store, or read an email or website, and trust that it's actually officially what it says it is. The author of this article relies on some heuristics; good spelling, reasonable-sounding developer email, reasonable Java package name, etc. but these things can go either way. It is possible for a scammer to be good at spelling, and it is possible for a big company to contract out some app they don't care about to the lowest bidder and be perfectly running their ads program through the "FooCorp Develop App; ru.definitelynotascam.dumbcodename". It has historically been an okay data point, but in the future scammers are going to be good at English -- it's only a matter of time. Where I'm going with this is that there needs to be some sort of mandatory linkage between something you trust and this random app you see on the app store. You trust Google. You trust TikTok. So why doesn't Google generate some sort of code that TikTok can stick in their DNS (or website) to create a linkage? By default, an app on the store could say "not trusted by any company", but then TikTok could add that record on their website and it would say "Trusted by TikTok" or something. There are some problems with this, of course. Anyone could claim any app, and then you'd see incorrect information. DNS and web servers can be hacked, TLS roots of trust aren't trustworthy, etc. But there has to be some way to create this linkage safely, so that people aren't misled again and again and again in the same way.
  • GoblinSlayer 6y ago
    Just go to tiktok site and download whatever you want there. But if you go to app store, you can barely tell what is what in this grey faceless pile of garbage.
• tuankiet65 6y ago
  It might look like aluminium but the description says it's just tape.
• justmyname 6y ago
  Thank you, Niek, for sharing that story. Such cases should be maximally open and transparent for people to learn the real risks.
• Tade0 6y ago
  Wasn't PSD2[0] created for the purpose of preventing such scams? [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
• rvnx 6y ago
  TL;DR: guy clicked on a link promising him 3000 usd out of thin air if he gives access to his account linked to PayPal. Malicious user used his account to buy digital items (ads).
• JAlexoid 6y ago
  Facebook Ads are the worst ones. Full of scams! Never click on them
• VonGuard 6y ago
  I'm completely unsurprised. I cannot be the only sucker in here who bought something off of a Facebook ad, and got a token piece of China-shipped junk instead. Mine was a video of a steel light saber being disassembled and put together, with all working parts. I was stupid, I paid $30 for it, and a month later, a box from China shows up with a $1 plastic sword. After that, I started commenting on every Facebook scam ad I saw, and guess what? That just got me into the queue for MORE scam ads! Facebook sees me commenting "SCAM" on ads about cheap Legos, and it says "Hey, this guy likes cheap Lego scam ads!" Plus, these ads go to different sites, have different company names, and different images every time, but they are the EXACT same scam, guaranteed. It's like Facebook is incapable of having a legitimate and ethical advertising business at some genetic level, and all the money from these obvious scam ads is just too good. This shit is so prevalent and so brazen, I've considered setting up my own scam ad, maybe sell a Qanon book that's blank and say "Fuck you, idiot" inside... I mean, why not? It seems like people are getting rich by fucking over Facebook users, and Facebook LOVES it! They have such utter contempt for their users. And here I am still using it because it's the only platform I can see pictures of my family members on, as they are non-technical users. Am I supposed to run some kind of internal family campaign to get them all to move to some non-existent alternative? I hate this so much. I feel trapped by Zuck's heartless machine.
  • Nextgrid 6y ago
    > That just got me into the queue for MORE scam ads! I once created a Facebook account to test something and for some reason it decided I was some sort of gambling addict (that e-mail was registered on a legitimate gambling website and I guess they leaked it) and the "people you may know" was full of fake accounts all related to some kind of scummy mobile casino game (I guess the game requires login with FB or maybe gives new people free tokens so they just register tons of fake accounts?). I've spent a good 20 minutes reporting every single one of them (up to actually hitting the rate limit on the report endpoint) and not only did the algorithm not take the hint that maybe it wasn't a good idea to recommend me more accounts out of that category but their support didn't deem the majority of them as violating the community guidelines despite them being obviously fake (and I couldn't notice any difference between those that were deemed as violating their guidelines and those that don't).
• rbrtl 6y ago
  I shortened the TLDR: TL;DR: don't click ads
• tscolari 6y ago
  Very shitty attitude from Paypal.
• crispyporkbites 6y ago
  You didn’t lose 4k- Facebook have the money, it’s in their account. They sold virtual space at an almost infinite margin to a hacked account. The account was hacked on their system, the ad that facilitated the attack was ran on their platform and they allowed the whole thing to perpetuate. If this was in meatspace, Facebook would be an accessory to fraud.
• newsbinator 6y ago
  > Contacting Facebook about such scams/hacks is a challenge on its own: there is a support page but in all my attempts I was unable to click the "email" icon. The "chat" icon always says "chat unavailable" This is both incredibly frustrating and incredibly unsurprising.
• aurelien 6y ago
  You lost your life with facebook and that do not disturb you ... so thanks for the 4K ;-)
• heavyset_go 6y ago
  And people chastise those who use ad blockers when ad networks refuse to police their own content for malicious ads and code.
• cbluth 6y ago
  here is the apk, if anyone is interested: https://apkpure.com/tiktok-ads-business/com.acazira.tforbusiness https://apkpure.com/tiktok-ads-business/com.acazira.tforbusi...
• lxe 6y ago
  > Sure, the developer name "Develop App" sounds strange and should I have looked better, the developgameonline@gmail.com developer email and com.acazira.tforbusiness package name would have definitely raised some concerns. Sorry that you have to deal with this, and well done on actually flagging all these things as suspicious. I also sometime make these tradeoffs, when something sounds 'not quite right' I would still sometimes make a judgement to ignore it.
• atum47 6y ago
  I'm getting tired of flagging false ADs on Facebook platform (in my case Instagram). [https://imgur.com/a/1MUuST4 https://imgur.com/a/1MUuST4] The image above is a confirmation that they removed a false AD I flagged and thaking me for it. Yeah, ok, but as I said, I'm getting tired of flagging this kind of ads. I sent an email to Instagram not so long ago, complaining that is hard to know a official AD from a fake one in Instagram, cause they use that ridiculous thing of opening a webpage inside their own browser (?!) hiding the address. I'm sorry that this happened to you. I usually deal with low effort scams (but they usually get my parent's attention) but maybe it's time for Facebook to be held accountable for this kind of stuff. Did you bought a TV from an AD you saw on Instagram and turned out to be a scam?! Well, let's have Facebook accountable. Maybe they'll improve their ADs platform.
• mikorym 6y ago
  I don't know whether this is relevant for fact checking, but the add logo in the first image with the bullseye image uses an image (the bullseye itself with the arrow) that is available as a logo/icon on MS Office exactly as is.
• catchmeifyoucan 6y ago
  Voucher was spelled as "Vocher" in multiple places. At first I thought it was localization, but then I realized that the author was spells it as "Voucher". That was the red-flag for me.
• ed25519FUUU 6y ago
  > the app asked me to log in with Facebook to get the credits. These places (facebook, google, etc) really need to separate the "login with ____" button with a "authorized ___" button. Several times I've tried to login using google only be greeted with a permission request, such as READING ALL OF MY EMAILS. Even Dropbox requires you to give them permission to your contacts if you want to login with google. When you're not paying attention it's really easy to miss this kind of thing. So much so that now I prefer creating an account traditionally using a generated password.
• nojvek 6y ago
  There's many things that stand out 1) Google Playstore allowing someone to impede on the TikTok brand. 2) The app getting 10k+ fake reviews. At this point can you trust the review system if it can be so easily manipulated? 3) "Strangely enough this is possible without getting any emails from Facebook." Facebook security is weak here. You shouldn't be able to change ownership without explicit 2fa verification. oauth tokens can be easily phished. password + 2fa device is much much harder. In general the trend I see is that Facebook and Google are driven to making ad purchasing as frictionless as possible. Having scammers, click-farms, fake reviews on their platform is good for them, it helps them make more money. They'll happily tradeoff human oversight/support and security for automated algorithms that optimize $$$ growth. Apple AppStore is polarizing. Some feel it has too much control, but on the other hand I find a lot less scammy apps in Apple AppStore than Google Playstore.
• fortran77 6y ago
  If Facebook ran that ad, you should at least try to hold them accountable.
• jrochkind1 6y ago
  If I understand right, the scam was a phishing attempt, that succesfully got their facebook credentials (or an Oauth token? they might not be sure?) and used them to buy ads on facebook in that amount?
• negamax 6y ago
  Android has become a serious security risk
• bo1024 6y ago
  I think single-sign-on stuff and "Sign In with X" are a cancer. They encourage you to type in your sensitive credentials all over the place and hope it's safe.
• gm 6y ago
  I was scammed through PayPal, PayPal did the same thing to me, basically gave me a "Looks good to us, case closed, go fuck yourself." The negation of my case was automated, too. I received the "resolution" a few seconds after submitting the case. Thankfully, I had paid with a credit card as the PayPal funding source for that transaction, and I disputed the charge with my CC company, which found in my favor, and did a chargeback to PayPal. After that, I immediately unlinked all of my funding sources from PayPal and closed my decade+ account. Never again. Not as a buyer, and certainly not as a seller.
• thrownaway954 6y ago
  just saying... As much as everyone hates on Apple cause of their review process, you have to admit that an app like this would have been caught.
• jakub_g 6y ago
  Is it just me, or the screenshots just scream "scam"? 1. Inconsistent spelling TikTok vs Tiktok, business vs Business in app names and logos 2. Inconsistent font in Tiktok logo (Times New Roman like font in Android app, wut) 3. Typos and clumsiness: "vocher" instead of "voucher"; space between $ and 3000 on confirmation screen. 4. As mentioned, the app developer not being TikTok I'd not be surprised for random person to fall for this, but an experienced techie should have seen many red signs. (Having said that, as some other comment said, logging with FB on mobile is inherently unsafe because you can't really tell if it's FB or impostor site. Plus the way the ads markets work, which is just built for scams like this. Modern web sucks).
  • josefresco 6y ago
    Aren't those small mistakes on purpose? To ensnare users who miss obvious signs of fraud? I know that's a proven tactic for phishing/email scams.
• disillusioned 6y ago
  I lost $2k in a Facebook scam that I'm really not proud of. A company spoofed BitMain's FB page and ran ads for their newest AntMiner models saying they had a batch that was ready to ship in limited supply. The BitMain FB account looked legit. The website itself obviously had an SSL cert (and was a pixel for pixel clone of their real site, except the product was in stock), but what I didn't notice was the microscopically small presence of a dot over one of the characters. It was an IDN homograph attack, and looking at the website and not noticing the unicode character, everything else looked right. The fact that they took BTC as payment didn't raise any red flags either, because, you know, BitMain does. I'm mostly infuriated at Facebook for not validating the company name or doing anything resembling protecting their audience. I lent them too much credibility because it looked like they were ads from the real company's page, and so I let down my guard elsewhere. I've never otherwise been hacked or scammed, and I know allllll of the basics to look out for, but this one still infuriates me for making a fool of myself.
  • jankeymeulen 6y ago
    What browser are you using that is displaying IDN unaltered?
  • colejohnson66 6y ago
    Not blaming you at all, but a good tip is to look at the number of “likes” a page has and see if it sounds reasonable. Definitely not foolproof though.
    • searchableguy 6y ago
      Nope. Easily faked. There are centres where people get paid $5-10/day to like, follow, comment, etc here. They use bots too. You can purchase an official ID under $10. Many Indian marketing firms use them.
      • colejohnson66 6y ago
        Oh absolutely. I admit it’s not foolproof, but if a page named “Amazon” only had 100,000 likes, I’d be a bit suspicious. For comparison, the actual Amazon FB page has 19 million likes IIRC.
• junon 6y ago
  > Initiated a PayPal chargeback process - PayPal responded: "we’ve determined there was no unauthorized use" Yep. This is why I avoid PayPal like the plague. I've never heard good things about them.
• rdiddly 6y ago
  HN loves to downvote any comment about grammar & spelling, but now we see it in its proper context as a cybersecurity measure. If I'd seen "vocher" (i.e. voucher) on a big blue button I would've applied the brakes on my clicking finger. Whether one of these little mistakes is unintentional (indicating incomplete mastery of English and perhaps foreign scammery), or intentional (indicating a purposeful screening device to make sure only rushed, inattentive and stupid people respond), take advantage of the warnings they leave for you.
• Exuma 6y ago
  How does simply connecting/logging in with an app give the FB application to spend on your business manager ad account...?
• dvcrn 6y ago
  Most ads I see these days on Instagram are scam. They usually lead to sites that have been built with a quick template and always offer 50-80% discount on little things I want, for example lamps. They all offer PayPal so I took the bait once. The scam was clever: they ship something that isn’t what you ordered. Like a jump rope for $1 instead of the $30 lamp (discounted from $200) or drone. To get a 60% refund, you have to send it back on your own cost. Now it gets more tricky: the parcel might not even be delivered to your address. Mine never arrived but got delivered to a zip code close to mine, but not mine. There are lots of reports of people that receive things without ordering anything and people who never get their stuff. There is also no guarantee what you ship back arrives back at them. If it doesn’t, the company doesn’t refund anything. I quickly realized this is an obvious scam and asked them to cancel, and opened a PayPal claim before anything got shipped. The company said they are processing my refund and it will take 3 days for my money to be back (which is not how PayPal works). Guess what? In the 3 days, they just shipped something which threw the PayPal claim off because now they have to wait until the shipment arrived and gets sent back (info from PayPal cs). It’s been over a month and I am still trying to get my money from PayPal back. It’s difficult because I haven’t received anything but the shipping number says it arrived. The site no longer exists and the email I previously used to reach out is gone too. It’s crazy to me that PayPal enables all of these scammers. They clearly know how to play PayPal to get around the buyer protection. These days I can’t trust any ads because of this unless I do a lot of research on the site. It’s very likely all scam. I saw similar sites on google shopping (the price comparison product), so it’s not just Facebook.
  • babaganoosh89 6y ago
    It's better to use credit cards when you can, chargebacks are way easier than that.
    • dvcrn 6y ago
      Luckily I paid with credit card through PayPal and will use that option if the claim doesn't progress in the next few days
  • wishinghand 6y ago
• StillBored 6y ago
  Wow, I guess people really do random app installs on their phones. I've never installed an app after being redirected to the app store... never. I've always considered that the equivalent of .exe's in emails. Just don't do it! The fact that just about every damn site (reddit, etc) all desperately try and force the issue makes me think that if apple/google had ones best interests at heart they would disable the functionality.
• ACow_Adonis 6y ago
  A lot of comments, and I gave them all a quick browse, but I can't see anyone say it, but it's so obvious it has to be said: What tech-savvy person is not only SEEING ads, but would actually deliberately click on one? I feel like I'm taking crazy pills. You don't click on ads! Why would you click on an ad! What's wrong with you people!? As user beefield points out, another good rule of thumbs is to just never buy or take anything from anyone who approaches you or communicates to you if you are not the originator of that communication/request. Just don't do it, and you save yourself a lot of pain (and don't worry, you're not missing out on anything).
• gbraad 6y ago
  Red flags everywhere and missed? And why would TikTok use Facebook to login?
• magma17 6y ago
  nothing to worry about with your six figures salary.
• efoto 6y ago
  I'm surprised that OP didn't notice misspelled vocher prominently visible on multiple screenshots.
• msravi 6y ago
  How exactly did they get around the 2FA? I'm guessing the app he installed stole his password when he entered it, but he does say that he had 2FA enabled. How did they get around this and log in to his account? Or did the app somehow siphon off the 2FA code also?
• Androsec 6y ago
  here is a technical that explain exactly what happened https://news.ycombinator.com/item?id=24483028 https://news.ycombinator.com/item?id=24483028