In Lithuania, online scammers are creating copies of major news portals, fake Facebook accounts and inviting people to invest in fake investment platforms in order to extort money from citizens of Lithuania and neighbouring countries. Unidentified persons exploit the brands of LRT, LNK, Delfi, InfoTV, the Estonian national broadcaster ERR, the Estonian newspaper Eesti Päevaleht, as well as Ignitis and Orlen Lietuva, by creating fake copies of their accounts, which contain fake ads under the name of these brands.
INTRODUCTION
The main objective of the ads is to trick Facebook users into fake investment schemes through fake Facebook accounts. It should be noted that online scammers use fake or cloned accounts that lead Facebook users to web pages with articles that replicate the visual elements of well-known Lithuanian news portals (e.g., easily recognisable logos, website-specific fonts, brand-unique web page structure, etc.).
The analysis found that fake ads in the name of these brands were shown more than 5.1 million times to Lithuanian Facebook users, including other META platforms such as Instagram and Messenger, where the ads were also shown.
It is noted that the target audience of the fake ads is not only Lithuanians, but also citizens of other Central and Western European countries. The investigation found that the headlines, graphic elements and fake pages in the fake ads were published in Lithuanian, Estonian, Latvian, Polish, Czech, German, Dutch and Russian. It is also important to note that the images, persons or stories reflected in these ads are not chosen according to a universal template but are selected and adapted according to the specificities of the region or the political or criminal context of the time.
The investigation found:
93 Facebook accounts used by scammers to publish fake ads.
81 website address impersonating brands that are easily recognisable to consumers.
568 published fake ads.
7.5 million impressions.
The disinformation and scam schemes are deployed by:
1. Replicating the design and content of major portals.
In order to convince as many users as possible who click on a fake link that the webpage is actually related to one or another brand, scammers try to mimic as closely as possible the graphic elements, fonts or other visual elements of the original pages that are associated with instant brand recognition. The content is usually related to widely covered, scandalous, and socially sensitive topics in the media, such as criminal news, retirement and disability benefits, reviews of the financial situation in the country, or success stories of getting rich quick.
2. Choosing the most scandalous news in Lithuania and manipulating the content to make the scandal appear to be related to a supposed new opportunity to make a lot of money. To attract user's attention, those who promote fake investment schemes take advantage of the events that generate the most public interest. It should be noted that shocking but true stories are deliberately twisted to include one or more elements related to finances or material well-being. In this way, gullible and less financially literate users of social networks are easily drawn into fake investment schemes that promise a sudden profit, while at the same time presenting a fake adaptation to a real story that the user already knows and has heard before.
3. Acquiring domain names that sound similar to news portals. As the digital literacy of users increases, some Facebook users are paying attention to the address/domain of a web page. However, it is important to note that the techniques used by scammers to deceive users are also becoming more sophisticated. Most of the fake pages analysed were created using domain names that sound similar to news portals, pretending to be LRT, Delfi or InfoTV. Often, a combination of words is used to indicate the fact of the news or the availability of information, such as ‘news’, ‘Lithuania’, ‘info’, ‘daily newspaper’.
4. Creating fake Facebook pages using well-known brands and posting content there.
In order to increase the visibility of fake media articles, scammers create fake Facebook profiles that pretend to be the aforementioned brands. Efforts are made to mimic both the style of the content, such as text, and the visual elements, in order to give the user as little doubt as possible as to the authenticity of the accounts and the content.
5. Launching Facebook, Instagram and Messenger ads to lure people into clicking on a fake news link. During this step, the scammers take the selected fake or manipulated scandalous news and stories, which they put on fake news websites and distribute via fake Facebook profiles, and utilise META’s advertising tools to increase the visibility of the fake Facebook ads. Scammers seek to deceive users by using well-known brands, scandals and the idea of getting rich quick. Seeing these ads on META platforms makes it challenging for users to identify them as scams.
6. After viewing the news, the links lead to a fake investment platform. When tempted to click on a link offering financial returns or supposedly revealing facts unknown to the general public, the user is redirected to a fake investment platform, where success stories are personalised and presented through the prism of luck, tragedy or the unexpected, thus targeting less literate or socially vulnerable groups whose main burden is financial deprivation or debt.
7. Logging in to a fake investment platform leads to the theft of login, credit card and other personal data and money. Users who have believed fake stories about making quick money are further persuaded by fake investment projects, usually asking them to authenticate themselves using bank logins or bank card details. In this way, during the login to the investment system, users’ login, bank card and other data necessary for authentication and execution of the payment transaction are stolen. Ultimately, the user not only loses personal access to the online bank, but also has their personal funds stolen.
Scammers use the following fake investment platforms:
Oil profit
Oil trade
Ignitis profit sense
Pump Oil
Oil Pump
Kvantinė uždarbio sistema
PART 1: FACEBOOK PROFILES PRETENDING TO BE MEDIA CHANNELS/COMPANIES
The dissemination of fake ads has been detected on Facebook, where fake profiles claiming to be the Lithuanian energy company Ignitis use the platform’s advertising features to deceive Lithuanians into fake investment schemes.
Between 28 May 2023 and 13 June 2023, the scammers created more than 30 fake Delfi Plus, Delfi+ and Delfi +Plus Facebook profiles, some of which were used to run ads that led to copied and distorted scandalous articles.
After the report was delivered to the Chancellery of the Government of Lithuania on 20 July 2023, representatives of the Government contacted META representatives to have these fake profiles removed. However, META representatives refused to do so. In October, 28 out of 31 fake profiles were removed.
Visos Žinios, Teisybės Vartai, Tiesos Kelias, Delfi-Kriminalas, News Delfi, News Invest/DELFI, Lietuvos naujienos/DELFI TV, Naujiena.lt: all of these accounts pretend to be Delfi.lt. Most of them were created in July–October, this year.
For example, News Delfi’s Facebook profile was created on 31 July 2022 and was previously called Ivanna Grachova (Іванна Грачова) but changed its name to News Delfi on 26 August 2022.
Similarly, Naujiena.lt profile was registered on 26 August 2020 under the name Jcarlos. It was renamed to Vay Nhanh Toàn Quốc 15 on 16 December 2022, and only on 15 September 2023 was renamed to Naujiena.lt.
Lietuvos Naujienos, which pretends to be DELFI TV and uses the Delfi logo, was first registered on 20 March 2023 under the name Distant chillax, and on 25 September of the same year was renamed to Lietuvos Naujienos.
The scammers also created copies of Info TV, with a total of 16 Facebook profiles between October and September 2023. Info Žinios, Info Dienraštis, INFO 24 Naujienlaiškis, INFO Žurnalas, INFO Diena and, in Russian, Info RU.
There are also fake LNK Facebook profiles, some of which have already been blocked, while the latest one, created on 1 September 2023, is still accessible.
To make fake news look convincing, scammers started creating fake Ignitis accounts: Ignitis Groups, Ignitis Energija, Ignitis ECO, Ignitis Energija, Ignitis – Naujienų Portalas, Ignitis – Žurnalas, Ignitis – Laikraštis, Ignitis – Naujienos ir Media, Ignitis – Portalas, Ignitis – Žurnalistas. In total, the scammers created 14 fake Ignitis accounts.
There are not just Lithuanian, but also Estonian Facebook profiles: ERR 24Live, ERR Live, ERR.ee
PART 2: FACEBOOK PROFILES THAT PRETEND TO BE MEDIA CHANNELS/COMPANIES AND RUN FACEBOOK ADS
The dissemination of fake ads has been detected on Facebook, where fake pages claiming to be Delfi, InfoTV, LNK, LRT and the Lithuanian energy company Ignitis use the platform’s advertising features to deceive Lithuanians into fake investment schemes.
500+ fake ads have been recorded under the brand names of the aforementioned brands, which lead to websites pretending to be news portals and publishing fake scandalous news.
To get the maximum engagement, online scammers use Lithuania’s most notorious criminal events and scandalous news stories. The study found that almost all the major events of the last six months were used to generate clicks:
Elements of the widely publicised story of the disappearance and mysterious death of the 15-year-old Mykolas Davidonis were used actively. Users are presented with possible suspects, their images and quotes. Images of the parents and their reactions to the confession of the alleged killers are shown.
Identical attempts to generate as many clicks as possible on ads are used to exploit another story, that of the murder of Rolandas Skripkaitis-Rūlė. The headlines promise to reveal previously unheard details and expose the real culprits behind the man’s death.
A particularly widely used story concerns the murder of two little girls. Users are informed about the allegedly true facts of the murder and the reasons that prompted the girls’ mother to commit the crime. Again, the story is presented through the perspective of financial gain, with the promise of revealing the truth about the money allegedly earned by the mother.
Messages used in ads:
‘The woman who drowned her daughters did it for one reason...’
‘These facts will shock you.’
‘Death of two children in the Neris river: How is the father involved in the tragedy?’
‘Things are gradually becoming clearer. The woman who drowned her daughters did it for one reason...’
‘Forensic investigators uncovered the facts behind the murder of Rūlė.’
‘The woman who drowned her children in the Neris river finally questioned after intense specialist care.’
‘New developments in this year’s most notorious case...’
It should be noted that the aim of attracting the attention of Facebook users in Lithuania was not only to distort real stories, but also to use absolutely fake stories related to financial success:
‘Surprising details of Andrius Tapinas’ secret income revealed.’
‘New economic support for citizens. The government has confirmed. Everyone in Lithuania can receive income from the state.’
‘Find out the secret of my income after I quit sport.’
‘Why did the news presenter keep quiet about the Tesla X project while on air?’
‘A new development in the world of finance! This platform has been viewed by all the world’s portals as well as by our journalists. More than 102,400 Lithuanians are already participating in this project!’
‘The new billionaire’s platform: Marijonas Mikutavičius talks about his testing experience.’
Between September and October 2023, 14 fake Facebook accounts related to Ignitis were detected. Signs of trademark infringement are visible on all accounts that use graphic elements of the Ignitis brand and images of company representatives.
The following phrases are used to generate clicks:
● ‘New developments in the drowning of two children: the largest electricity company, Ignitis, is involved in the case.’
● ‘Do you think that our reckless corporate strategy led to this terrible disaster? We have an explanation.’
● ‘It became clear why the mother drowned her two children.’
● ‘Our company is not to blame for this tragedy.’
In order to attract the attention of more Facebook users, the image of a cheque for €250,000.53 is used in some ads.
Examples of ads:
It should be noted that the President of the Republic of Lithuania, Gitanas Nausėda, is also mentioned in the ads related to Ignitis. The ads are linked to several fake Info Dienraštis accounts falsely linking the President of the country to an investment scam allegedly organised by Ignitis.
These phrases are used to generate clicks:
‘The country’s Excellency lied to the public.’
‘His Excellency withheld the truth about Ignitis from the public.’
Scammers advertise that the Lithuanian Government and the Lithuanian Parliament (Seimas) have approved a new investment scheme, where everyone in Lithuania can make money:
PART 3: COPIES OF THE WEBSITES OF MAJOR BRANDS
Many of the images accompanying the fake ads relate to a recent story where a police officer allegedly drowned her two young daughters in Vilnius. Photos from the crime scene are used to draw the attention of Facebook users, showing images of the children’s bodies and the medics and police officers at the scene.
Fake lrt-televizija.com pretended to be LTR.lt on 08 06 2023
Fake delfilietuvoje.com pretended to be Delfi on 12 06 2023
Fake delfimums.com pretended to be Delfi on 14 06 2023
Fake delfiplus.com pretended to be Delfi on 15 06 2023
Fake delfisiandien.github.io pretended to be Delfi on 26 09 2023
Fake kriminalams.com pretended to be Delfi on 29 09 2023
Fake delfinaujausi.com pretended to be Delfi on 11 10 2023
Fake bobbintheree.com pretended to be the Estonian newspaper of the Delfi group Eesti Päevaleht on 11 10 2023
Fake mostol.shop pretended to be Delfi on 16 10 2023
Fake lt.delfi-news.uno pretended to be Delfi on 03 10 2023
Fake delfi-news.site pretended to be Delfi on 17 10 2023
EXAMPLES OF COPIES OF MAJOR PORTALS
The article describes the story of a criminal whose boyfriend allegedly stole an investment cheque for Ignitis Profit Sense worth €250,000. This fact is cited as the main reason for the crime. Readers are also told the story of a woman who allegedly earned a large sum of money by investing through the Ignitis Profit Sense platform. The woman is said to have invested only €200, while the platform paid out €15,000 a month into her account. Darius Maikštėnas, CEO of UAB "Ignitis grupė", is named as one of the persons responsible for ensuring the authenticity and effectiveness of the Ignitis Profit Sense platform. Readers are provided with excerpts from interviews where Mr Maikštėnas allegedly confirms the fact of the woman’s earnings and the cheque he issued for that amount.
FAKE IGNITIS PROFIT SENSE INVESTMENT PLATFORM
Redirect pages pretending to be Ignitis (wewillredirectyou.com): https://wewillredirectyou.com/igns/
Screen grab: https://nimb.ws/Dog6Gh
Cloned Ignitis website (operated by scammers):
The website claims to offer an exclusive deal for Lithuanian traders, promising high returns on electricity and gas trading. The website uses the name and logo of Ignitis. The website also displays fake reviews and a countdown timer to artificially create a sense of urgency in order to persuade users to sign up and deposit money on the page advertising the investment scheme.
FAKE ORLEN LIETUVA INVESTMENT SCHEME
