Facebook Has A Thriving Black Market Of Fraudulent Ad Accounts, Passports And Driver’s Licenses

By Sarah Emerson and Emily Baker-White

Facebook plays host to a massive black market for selling business manager accounts that could allow buyers to run political ad campaigns in the U.S., Brazil and other countries, according to new research published by the Tech Transparency Project on Monday.

These alleged business manager accounts are often sold with photo IDs, passports, and other seemingly stolen or fraudulent information that can be used to link the accounts to real people. Some sellers claim the accounts can be used to run ads — including political ads — on the platform without going through the company’s identity verification process. At worst, the elaborate scheme, which violates Facebook’s terms and conditions, could directly facilitate election interference.

In one such group, called “VERIFIED / UNVERIFIED BM BUY+SELL,” there were numerous posts selling Brazilian account access throughout the months of August and October ahead of the country’s contentious presidential race. At the time, human rights groups sounded the alarm that Facebook was approving ads meant to disrupt the election between Luiz Inácio Lula da Silva and the incumbent Jair Bolsonaro (Lula da Silva won despite Brazil’s own “Stop the Steal” movement).

A post in a different group, “Verified bm trusted market,” promised access to an account approved for running ads about “social issues, elections or politics” in Germany last October, one month after the country’s federal election. (Disclosure: in a previous life, Emily Baker-White — a reporter on this story — held policy positions at Facebook and Spotify.)

Tech Transparency Project director Katie Paul discovered more than 100 Facebook groups, collectively numbering over 530,000 members, that offered to sell accounts which the sellers claim are already approved to run ads, enabling a purchaser to avoid Facebook’s verification process. Paul discovered the black market by searching Facebook for phrases such as “ad approved account,” “buy and sell business accounts,” and “verified ad account.”

In an email, Meta spokesperson Erin McPike said, “We’ve removed these groups for violating our policies. We are always improving how we detect and take action against violating activity and encourage people to report this behavior when they see it.”

Through WhatsApp, Meta’s encrypted messaging platform, Forbes contacted five Facebook users who moderated groups flagged by Paul, and said they had Business Manager accounts for sale. One seller offered a Bangladeshi account, which he said was verified to run political ads in Bangladesh, for $100. Four other sellers offered U.S.-based accounts, ranging in price between $35 and $300. Forbes eventually obtained a Business Manager account from one seller, and connected it to a test page which then appeared capable of running ads through the illicit account. (No ads were run.)

More than 24 hours after Forbes provided Meta with the unique Business Manager ID of the purchased account, the account remained live on the platform.

Business manager accounts allow users to deploy multiple ad campaigns across Facebook and Instagram. In the past, hackers have been able to charge thousands of dollars in ad spends to credit cards associated with compromised accounts. Many alleged accounts for sale in the groups flagged by Paul were advertised as having high prepaid balances and credit cards on file.

Business manager accounts also come with special features, including access to business APIs on Facebook and WhatsApp. To qualify for these features, companies must go through a process called business verification, where they must prove that their company is legally registered and that the person representing it on Facebook is an authorized representative of the company. Similarly, to run political ads on Facebook, advertisers must become verified as an advertiser by submitting a government ID and receiving a piece of mail at an address within the country where they'll be running ads. But buying an account that has already gone through these verification procedures enables people who cannot meet Facebook's verification requirements to evade them.

Some groups also advertised passports and other forms of identification that sellers claimed could be used to verify a business for the purpose of running ads — a process that can require a person to submit a photo ID and documents like utility bills. Forbes easily located several passports and driver's licenses that appeared to belong to real individuals in states like Texas, Maryland, and Florida. One belonged toTom Swiss, who had no idea his passport was for sale as part of a package of more than 10,000 alleged IDs in a Facebook group devoted to buying and selling Facebook business manager accounts.

“That is indeed my passport,” Swiss told Forbes, which located him from the details exposed online. Swiss recalled, five years earlier, accidentally posting a photo of the passport to his Facebook page before removing it hours later, “but not quickly enough it seems.” It’s unclear how his ID wound up on the illicit marketplace.

According to Paul, many sellers offered accounts in bulk and demanded payment in cryptocurrency, most often transacting on the exchange Binance. Two sellers told Forbes that they would accept payment in the cryptocurrency USDT; two also said they accepted payment through the payment processor Wise (formerly called TransferWise). The seller of Swiss’ passport photo asked that buyers interact through remote viewing software AnyDesk, suggesting a different scam altogether.

Outside of buying one account and confirming that it could run ads without additional verification, Forbes was unable to independently check whether any of the accounts for sale ran ads after being marketed in these groups. The numerical page IDs listed for a handful of accounts did not connect to existing pages or match the information provided for the businesses, so it’s unclear who sellers ultimately intended to defraud: the supposed victims of identity theft, account managers, or Facebook. The Tech Transparency Project observed in its report that some of the accounts were previously restricted from running ads but had their privileges restored, perhaps using illicitly obtained IDs to obtain approval.

Paul noted that “a lot of the posts we were seeing would get deleted by a seller once they found buyers,” and that “the practice of deleting posts once a sale or request has been satisfied is common in Facebook black market groups for other things I have studied,” such as antiquities trafficking.

After Forbes alerted Swiss to the post selling a photo of his passport, he claimed to have reported it. The post was still up the following week but has since been removed.

MORE FROM FORBES

MORE FROM FORBESCrypto Darling Helium Promised A 'People's Network.' Instead, Its Executives Got Rich.By Sarah Emerson

© Provided by Forbes 

MORE FROM FORBESAhead Of Midterms, Researchers Say Facebook Can't Reliably Identify Political AdsBy Emily Baker-White

© Provided by Forbes 

MORE FROM FORBESFacebook Gave Nebraska Cops A Teen's DMs. They Used Them To Prosecute Her For Having An Abortion.By Emily Baker-White

© Provided by Forbes