This is one of my favorite columns. It tells the story of a social experiment I conducted in 2011 regarding social media and fraud. That’s a long time ago in terms of the proliferation and influence of social media in the world. But I think what I accomplished a decade ago is even more concerning today.
Numerous studies have shown that young people, who have grown up with smartphones, are quite willing to share their personal information with the world at large. That’s a finding we should all find concerning. At the same time, a suspected fraudster may allow an investigator to join their social media sites without knowing who they have let into their orbit.
Please Like Me
In 2011, I conducted a small experiment on Facebook. It was unscientific but very revealing about how easy it is to gain personal information and potentially use that information to commit fraud.
I created a profile using a false name and the picture of a then-popular TV star. The name I chose was Michael Duarf — fraud spelled backwards. I uploaded a headshot of Wentworth Miller, the star of the then-popular TV drama, Prison Break, as my picture.
At random, I sent out a request to 20 people I didn’t have any connection with to be their friend. Within 20 minutes, five accepted me. One woman, whom I’ll call Nancy, noted my picture was that of Miller, but this was not said in a negative tone. Many people use photos of famous people as their profile image, so it’s normal on the site to see a celebrity (or cartoon image) as a person’s way of presenting themselves.
Now accepted as a friend, I had access to important information about this very trusting woman. I knew Nancy’s married name and her exact date of birth, which she unwisely listed on her profile. Her husband, understandably, was one of her friends, and he had an unusual first name, which made it easy to find out where they lived using an online telephone directory. She also had her brother as a friend. Their relationship was easy to identify based on communications between them (“Happy birthday, bro!”).
I now had her maiden name, which is golden to a fraudster. Many people still use this information as a critical security question when opening a credit card, among other transactions. As an added bonus, I found the name of her dog (people often use a pet’s name as a security question) and that of her children (tagged in several pictures, and also a common security question).
Within five minutes, I had enough personal data on Nancy to use her identity to open credit cards in her name (giving an address that sent the cards to me) and possibly even obtain a mortgage. I could create false identification documents in her husband’s name and hers using pictures, for example, of myself and a female accomplice. If required, I could create ID using their photographs. To an experienced fraudster, either production would be child’s play.
Dangerous Fun
The skyrocketing popularity of social media sites has many benefits, especially bringing people together. New and old friends, and also distant acquaintances and strangers, eagerly share personal information ranging from birth dates to news about an upcoming vacation or attendance at an event on a specific evening. That can be fun but also dangerous.
Christie Alderman, vice-president of new products at Chubb Personal Insurance, told forbes.com that she knew of a $200,000 theft in New Hampshire that resulted from the victim posting on Facebook that he was away on holiday.
Facebook, of course, is the Goliath of social media sites with almost 2.5 billion members in 2020. But the business networking site LinkedIn, with more than half a billion members as of 2019, arguably provides more valuable demographic information for a fraudster as the majority of its members list their jobs and often a work history. Classmates have more than 70 million members. Older users might have forgotten the name of someone claiming to have been in high school with them decades ago. It would not be hard to convince them that you went to school together.
The willingness, or need of people, to connect with others can obviously have a dark side. By readily sharing personal information that in previous generations might never be revealed even to friends (or portioned out appropriately), social media users can make themselves — and, in some instances, their employers — vulnerable to fraud, reputational damage and even corporate espionage.
Identity theft, like social media sites, is also growing. According to the 2019 Identity Fraud Study by Javelin Strategy & Research, a U.S. firm that provides research to the financial services industry, the number of consumers who were victims of identity fraud hit a record high of 16.7 million in 2017.
Fraud, in general, is also increasing. In its 2019 Report to the Nations, the Association of Certified Fraud Examiners estimated the cost of fraud to the global economy in the previous year was several trillion dollars.
“Fraud knows no boundaries, and anti-fraud professionals worldwide face more challenges than ever in detecting and combating it,” said the association’s president, James Ratley.
That truism applies to social media fraud. People sending requests to connect on a social media site could be located anywhere, just hoping that some are accepted, and the door to the acceptor’s personal information opened.
There are other ways to obtain users’ information, such as setting up a fraudulent site in the name of a celebrity.
In 2009 Tony La Russa, manager of the St. Louis Cardinals baseball team at the time, settled a lawsuit with Twitter, which had more than 320 million users in 2019 after he discovered an account had been opened in his name. The unidentified fraudsters posted comments that made light of the death of two Cardinals’ players and drunk driving. MSNBC’s Keith Olbermann and several professional athletes, including NFL players Asante Samuels of the Philadelphia Eagles and DeMarcus Ware of the Dallas Cowboys, also had false comments posted under their names on Twitter.
Most of the fake Twitter postings are pranks. “We shouldn’t be surprised by this,” Frank Farley, a psychologist at Temple University, said in a newspaper interview. “I’m frankly surprised we haven’t seen more of it. Through social media, we have created the capacity or opportunities for people to take such actions. It’s the old ‘if you build it, they will come.’”
Apple Cored
However, the potential for false information to cause severe problems for a company is no joke. Just look at what happened to Apple in May 2007 when an erroneous story was posted on the blog Engadget. It said that the launch of the iPhone and the Leopard operating system was severely delayed. This sent Apple’s stock from $107.89 to $103.42 in six minutes, wiping out about $4 billion of market capitalization and costing a lot of investors a lot of money.
Imagine what a fraudster who has created a false Twitter account in the name of a prominent businessperson or financial guru could do with an evil tweet. The message on a social site wouldn’t just have to concern a company’s financial health. It could attack the reputation of a key senior employee. A false posting accusing a senior executive of sexual harassment, for example, might force a valuable employee to resign because of the notoriety associated with the allegation.
Another concern involves social engineering, the process by which fraudsters use information about employees and a company to commit a variety of fraudulent scams, particularly gaining access to a company’s computer systems. Several years ago, Todd Snapp, president of RocketReady, a Tampa-based security firm that specializes in finding human security weaknesses, said he believed there is not a company of any size right now that is not being attacked by social engineers trying to obtain some kind of information.
By acquiring personal information on employees through social media sites, a clever fraudster could call a company and use that information to gain the confidence of someone who can hook the conman into the firm’s network. A typical ruse, Snapp explained, could begin with the fraudster pretending to be an employee working from home. He calls someone whose name and details he gleaned from a site: “How are the kids? I remember that Johnny was crazy about hockey. He still playing?” Then the fraudster asks specific questions. Sometimes the person pretends to be from the IT department. “We’re having trouble with the system, and we just need you to log in so we can check the status because we think there’s been a breach. What password are you using?”
Does social engineering work? Snapp said that his company’s success rate at obtaining sensitive information on a company when it conducted a mock social engineering assault, including passwords, was 30% to 35%. And that was before the explosion of social media sites.
Social media has also made corporate intelligence much easier to conduct, says Scott Koegler, a former chief information officer who has been writing about technology for two decades.
One of the most closely guarded trade secrets in most enterprises is the customer list. While getting a customer list may not be as simple as this example, consumer electronics retailer Best Buy is an excellent place to examine. Best Buy’s Twelpforce was, at one time, the company’s online service presence, made available through Twitter. Within 30 seconds, you could find that Twelpforce has more than 30,000 followers. These were presumably Best Buy’s customers. This list could be viewed directly within the Twitter interface, and with a little programming ability, the list could be extracted using Twitter’s application programming interface and messaged.
To obtain what he calls more nefarious information-gathering, Koegler says it’s a matter of using any of several data-mining applications that can sift through Twitter feeds, Facebook, LinkedIn, and other conversational arenas to extract seemingly unrelated information from casual conversations.
When those comments are fed through semantic processing systems to provide some contextualizing, it’s easy to imagine how information an organization may not want to be disseminated could be gleaned from thousands of unrelated comments, he says.
Companies should also be aware of the potential for overly zealous employees posting false information about their company in an attempt to bolster the firm’s reputation or revenue.
For a few years leading up to 2006, the CEO of Whole Foods Market, John Mackey, posted messages on Yahoo Finance Forums under the pseudonym Rahodeb, an anagram of his wife’s first name, Deborah. In his posts, he criticized the management of rival Wild Oats Market and wondered why any company would consider buying it. In truth, Whole Foods was considering doing just that.
When the Wall Street Journal outed Mackey in June 2007, it prompted the Federal Trade Commission to seek a temporary restraining order and court injunction that halted Whole Foods’ pending $670-million acquisition of Wild Oats. The Securities and Exchange Commission also investigated Mackey to see if he had been attempting to manipulate the stock price of Wild Oats before the acquisition.
Although Mackey was cleared of all charges and the deal went through, the damage to his personal reputation and that of his company was considerable. He resigned from his position in 2009.
In another case in 2009, a low-level Honda employee posted comments on Facebook that focused on Honda’s new Accord Crosstour. Most of the reaction on Facebook to the car’s design was negative, so Eddie Okubo, a product-planning manager, added a positive spin without declaring his relationship to the company.
When Okubo was exposed, the outrage against Honda was visceral. A bad public relations problem became an even worse one. It also meant potential customers who did an Internet search on the Crosstour might come across the misrepresentation.
With such potential dangers lurking in the social media landscape, what can companies and individuals do to protect themselves from clever fraudsters?
The answer, as always, starts with education. Employees need to know that making comments about the workplace can be potentially damaging, no matter how innocuous they might seem.
A casual and kind message on Facebook from one colleague to another, such as “Congratulations on your new position as IT manager,” should not be shared with the world.
An educational initiative can be presented to a company through seminars on how to use social media at work and home, and by the creation, distribution and mandatory signing of a formal policy on social media usage. It should clearly spell out what information can be revealed on these sites and explain how fraudsters and social engineers can use it to adversely affect the company.
Employees should be advised not to provide details in their profiles, including dates of birth, relationship status, hometown, names of pets, hobbies, children or anything that fraudsters could use to decode passwords.
It is possible some employees will resist such restrictions. It is unlikely the usage rules can be mandated (except for those that take place at work). Make sure staff knows any policy on social media does not mean the positive aspects of it can’t be enjoyed. Emphasize that by following these guidelines staff and the company are being protected. Most of all, share these insights with employees in a manner that a friend would.
From Uncovering Fraud: True Stories About Fraud, Fraudsters & How They Got Caught by David Malamed, edited by Paul McLaughlin. This column was first published in March 2011.