You receive a Facebook friend request. Judging by the photos, she’s a young woman. You don’t know her, but she’s lovely, and you’re intrigued. Why not? You accept her request. You’ve just unknowingly triggered the first mechanisms of a sextortion trap.
While investigating the world of fake Facebook profiles, my colleague Marie-Eve Tremblay and I have discovered a massive network of fraudulent accounts that catfish their male victims using stolen photos of young women and adolescent girls. This is the story of the months-long investigation that allowed us to piece together the inner workings of this network of online bandits.
Before we begin, we suggest you watch this short video from the Radio-Canada web series Corde sensible, which acts as a companion piece to this investigation.
Please note that this video is available in French language audio only. To enable English subtitles, click on settings (the little cog) and select them in the menu.
There’s more than one way to lie in order to achieve success on social media. I’ve been covering fake news and online disinformation for three years now, and I thought I’d seen it all. But a Facebook profile by the name of Béatrice Boistard really gave me pause.
She was gorgeous, she was mysterious and she had created an online audience of several hundred thousand followers. The thing is, she also stole the identities of disabled or sick people to get it.
So began the strangest investigation of my career, which catapulted me into the kaleidoscopic world of fake Facebook profiles, where nothing is real.
I first got acquainted with Béatrice’s profile in February 2016. She would regularly share pictures of amputated or bald people, asking her followers to write “amen” in the comments section. Why? Because “no one loves me since I got cancer”, or “my husband left me because I lost my legs.”
These posts invariably got thousands of likes, comments and shares on Facebook. It’s no surprise, then, that Béatrice’s page has over 671,000 followers. That’s significantly more than major Canadian news outlets such as the National Post and the Toronto Star and almost as many as the Globe and Mail.
It was easy to discover that the photos were stolen, and that the people in the images didn’t have cancer or were living quite happily with their disability.
At the time, I thought it was a simple “like-farming” scheme. That’s a strategy where someone creates a Facebook page, drives up its subscribers by publishing viral content, then sells the page on the black market or uses it for publicity.
I was curious, so I decided to keep an eye on Béatrice to see what would happen to her page. I would have a nice story if she turned into, say, an energy drink company.
Then, one day, Béatrice stopped sharing pictures of disabled people and started sharing sexualized pictures of girls. Very young girls.
All the photos had the same type of message attached to them. “She’s looking for a boyfriend. Write a comment, and she’ll send you a private message. Don’t be shy, add her!” She’d then tag four or five “friends” in her post.
Her “friends” were also fake accounts, featuring pictures of attractive young women stolen from social media. Each account would in turn publish these types of pictures and tag other “friends,” which were also fake accounts.
By observing the interactions between these fake profiles, I built a database of about 40 accounts. They all operated using the same formula: publish a stolen sexy picture, encourage men to write a comment and tag other fake profiles.
I knew then that I was dealing with a complex network of fake profiles, using likes and shares to promote each other and build a substantial audience.
What’s more, the photos used often depicted young girls, sometimes minors, in sexualized poses. A few of the fake profiles claimed to belong to girls who were 15 or 16-years-old.
I haven’t managed to track down every single picture used. Of those that I did, all of them stemmed from different social media accounts belonging to adolescents and young women and had very likely been stolen by the people behind the network in order to attract men.
This is what pushed me to look into this further. At the very minimum, this network was stealing young girls’ identities and sexualizing them without their consent.
In truth, the rabbit hole went much deeper.
Looking at the fake profiles in the network one by one is a bit like picking jigsaw pieces from a bag filled with four or five different jumbled puzzles. It’s hard to determine whether what you’re looking at fits with the rest, or if it’s a random piece.
A lot of young people tag these fake accounts in their Facebook posts. This doesn’t necessarily mean that they’re part of the network. They might just be trying to piggyback on the fake accounts’ popularity to get a bit more visibility for their posts. Do they know these pictures are fake?
If this all sounds terribly complicated, it is.
To get a better understanding of what was going on, I analyzed some 200 Facebook posts from about 40 fake accounts. Every time a fake profile tagged another, I would record the source and its target.
That’s when the true nature of the network revealed itself.
By using network analysis software, I was able to create a map and organize accounts according to the relationships between them. The software considers more active accounts as “nodes,” and surrounds them with the accounts with which they interact the most.
I also used a network-detecting algorithm. This tool determines which profiles interact with each other more than with the rest of the network. The algorithm identifies these as subnetworks, and colours them in yellow and blue in this graphic. This could mean that what we’re seeing are different networks which cooperate by linking to each other’s profiles for publicity. It might also mean that these parts of the network are operated by different people or groups of people.
As you can see, all accounts are interrelated, but certain profiles act as poles. These are the accounts that usually have the most followers and promote the other accounts in the network.
Which raises the question: why go through all that trouble? On top of cross-promoting posts, the fake accounts in the network often have conversations in the comments section to give the illusion of being real people. No one would do all this work just for fun.
Surely, this must be about money, I thought. In fact, certain posts within the network send links to fraudulent websites, where you are asked to enter your credit card information. But I also believed that these fake accounts were used in sextortion schemes. The report by Corde sensible confirmed this.
This all suggests that this massive network is used primarily to attract men online and send them careening towards different fraudulent schemes. But by analyzing the network, I was able to determine that different accounts play different roles. All of them co-operate to create a huge trap that filters potential victims in order to find the most vulnerable targets.
It’s very unlikely that this whole network and its myriad of fake accounts are all managed by a single person. In fact, what we’re seeing is probably many interconnected networks that co-operate and cross-promote each other in order to create mutually beneficial hunting grounds.
From what I’ve been able to determine, one part of the network is based in northern France and Belgium. Another seems to be based in Spain. But the largest one comes from the south of France, near the city of Marseille.
This is how it functions.
Fake profiles can be put into one of three categories: feeder accounts, bait accounts and hunter accounts.
Feeder accounts act as a gateway into the network. These profiles often have hundreds of thousands of followers, but don’t share sexy images. Rather, they publish clickbait material, like phony contests, dummy I.Q. tests and useless lifehacks. These posts often get hundreds, even thousands of likes, shares and comments.
In their posts, feeder accounts tag a few other fake accounts, from the bait account category. These highly popular posts serve as advertising for the bait accounts. Curious men will click on the tagged accounts, and, seeing that they seem to belong to beautiful women, start following them.
Already, the network is filtering out people who have no interest in following the Facebook profiles of highly sexualized young women and girls.
Bait accounts also try to accrue as many followers as possible. Some of these have tens of thousands of followers.
A minimum of effort is put in place to make these accounts seem real. Many pictures of the same woman are used, and the profile includes certain details, like a birth date and a hometown.
These accounts aren’t interactive. They don’t accept friend requests and never answer messages.
Bait accounts often share links that they claim will let users watch a pornographic video. These links invariably lead to fraudulent sites where the user is asked to enter his credit card information, but bait accounts don’t participate in direct sextortion.
Certain bait accounts try to lure men by publishing links to what are supposedly pornographic videos featuring underage participants.
For legal reasons, Radio-Canada did not click on any link stemming from accounts presenting themselves as being under the age of 18, and was therefore unable to verify whether it indeed led to this type of material. Please note that none of the accounts presented as minors published pornographic material directly on Facebook.
Sometimes bait accounts disappear. They are either flagged by Facebook users or deactivated by the people running the network to make flagging more difficult.
Even if these accounts are deleted by Facebook, the structure of the network remains intact. The feeder accounts, which act as gateways, are not affected, since they never share suspicious material. In this way, the network protects itself.
The main function of bait accounts is to publish enticing photos and tag other fake accounts.
The posts always encourage men to write comments, either by asking them a question (“do you think I’m hot?”) or by promising to send private pictures to every man who writes his age in the comments. This is an important part of the process, which serves to feed the third category of accounts.
This is where the fraud happens.
In the classic set-up, a fraudster poses as an attractive woman and encourages a man to masturbate in front of a webcam. The victim is then asked for a large sum of money. If the victim does not comply, the fraudster threatens to publish screengrabs or video recordings of the exchange on social media. Certain fraudsters go so far as to say they will imply that the victim was masturbating in front of a minor.
Bait accounts have created a perfect environment for sextortion to happen. The users who have commented aren’t afraid of publicly signaling their interest in young girls and, moreover, don’t have the wherewithal to realise that they’re dealing with fake accounts. They are perfect targets for the hunter accounts. These users receive, by the dozen, friend requests from the hunter accounts.
When a user accepts a hunter account’s friend request, they receive a private message. The fake account either tries to send them a link towards a fraudulent pornographic or dating website, or tries to start a conversation.
In these conversations, the account tries within seconds to send the conversation to a video chat service, such as Google Hangouts or Skype.
Hunter accounts are disposable, and often disappear within minutes of having established contact with a victim. By adding so many friends in such a short period of time, hunter accounts most likely trigger Facebook’s algorithms, which seek out and delete fake accounts. This is why hunter accounts are desperate to switch the conversation over to another platform.
Screengrab of a Skype conversation we had with a hunter account, mere minutes after accepting its Facebook friend request. Note that the person is already asking us to turn on our webcam to engage in sexual activity.
Once the conversation has been re-established on a video platform, hunter accounts ask the user to remove their clothes and masturbate in front of the camera, in order to obtain the images they need to defraud the victim.
This procedure protects the rest of the network. Since the accounts that defrauded the victim have disappeared, nothing ties them to the network. It then becomes very difficult for the victim to flag the account that defrauded them.
That, in summation, is the three-tiered industrial process that allows the network to find, filter and defraud victims, all the while protecting itself.
Wednesday, Sept. 6, 2017, around 3 p.m. (France local time).
I’ve just uncovered the most important element of the entire investigation. It’s a photo of a group of friends on Facebook, really nothing special. However, this photo, and the comments under it, allow me to finally confirm the identity of one of the men behind the network.
Then, like in a movie, a few seconds after having taken a few screengrabs, everything disappears. A dozen of the most popular fake accounts in the network go offline.
It’s a total blackout, as if someone knows I’m getting closer to the truth.
Let’s call him “Mehdi.” His name has been popping up in my notes for months. He’s the moderator of a private Facebook group that has more than 600,000 members, and which is often used by the network’s fake profiles to drive traffic. The other moderators of the group are all fake profiles. Everything points to Mehdi.
Then, one day, I find this picture from September 2016, where he made a serious mistake.
One of Mehdi’s friends publishes a group photo and tags her friends, including Mehdi. I recognize him in the picture. But when I put my mouse cursor on Mehdi’s face, I see that he’s not tagged using his name. His face is tagged to Amandine Ponticaud, one of the biggest fake profiles in the network.
In the comments, a guy started making fun of Mehdi. Mehdi answered back. But he did so with Amandine’s profile, not his own.
What follows is a flurry of insults between the guy and Mehdi. Mehdi finds a picture of the guy’s mother on his Facebook profile and says he’s going to use it “in his next porno post.” Remember that bait accounts use fake porno links to trap its victims.
Tired of the abuse, the guy blocks Amandine’s profile. But then Mehdi jumps back into the fray, this time under the name Léa Pierné – another fake account in the network. The guy blocks this account, and Mehdi comes back again with yet another of the network’s fake profiles, Isabelle Bekaert.
It’s clear, then, that Mehdi had, in September 2016 at least, access to these three fake profiles, which are some of the keystones of the network. He even admits to publishing “porno links.”
In fact, in the comment section of a July 2017 post by the network, these three same fake profiles were used to give the illusion that people had watched a supposed porno video.
Where things become interesting is when we search for Mehdi’s name on Google. Because, you see, he seems to have been doing this for quite some time. His name pops up on video game forums in France.
Since 2012, forum users have wanted to get him kicked off Facebook. Why? They said he shares “fake accounts” that publish “pictures stolen from chicks’ accounts.” In July 2012, some users banded together in a systematic campaign to flag Mehdi’s Facebook profile.
In these old forum posts, another man is also named, purported to be Mehdi’s partner. We’ll call him “Pablo.” He does seem to be Facebook friends with other people involved in the network. Mehdi and Pablo seem to come from southern France, around the city of Marseille.
By snooping a bit, I found two ads – one published by Pablo, the other by Mehdi – published on the listings website Webfrance in April 2015. In both ads, Mehdi and Pablo try to sell the same Facebook page, now defunct, which had, at the time, 280,000 subscribers. A person writes in the comments that they were scammed “three times” by Pablo, who had tried to sell him “fake accounts.”
In another ad, Pablo says he wants to “quit social media to concentrate on real life.” He says he’s selling three Facebook pages, with 280,000, 129,000 and 70,000 active subscribers. He uses an email address that includes Mehdi’s name in his ad.
Here’s where the story takes an unexpected turn. By searching for Pablo’s name on Facebook, I stumble upon a very strange page. It’s in Pablo’s name and uses his face as a profile picture.
On July 10, 2013, the page simultaneously published 373 pictures in the same public album, accessible to all. These images seem to be screengrabs from computers and mobile phones. In these screengrabs, we can see the inner workings of a sextortion ring of fake accounts.
In this album, we can see pictures of young women, some more explicit than others; anything one would need to, say, create a fake profile to scam men.
We can also see statistics of the engagement created by several Facebook pages supposedly belonging to pretty young girls.
What’s more, we see a screengrab of a Facebook chat window, where Mehdi asks a friend to make him administrator of a page. “I’m gonna scam a dude and I just told him that I was admin,” he writes. Mehdi gloats a few minutes later that the scam worked.
There’s also a screengrab of a PayPal transfer worth 500 euros ($740 CDN).
Then come a series of four incriminating screengrabs where we see – beyond doubt – a person carrying out a sextortion scam.
It’s the classic setup: make a man believe that he’s talking to a woman so that he gets naked in front of the camera, then take screengrabs of the exchange to blackmail him.
n the image, we see a Skype video conversation. The owner of the computer is chatting with a man. This man is naked and masturbating. In the small window which usually shows a Skype user what his chat partner is seeing, we see a nude woman masturbating on a bed.
However, behind the Skype window, we can also see that this user is using a computer program to display pornographic videos on Skype, to give his victim the illusion that he is interacting with a woman. In the background, we can see that this user has at least two videos of the same nude woman, which he can display in his Skype window.
I can’t be absolutely certain where these screengrabs come from. It would be very unlikely that someone could manage to fake 373 images to try and make Pablo look bad. Were these screengrabs obtained through a hack? Were they uploaded by mistake by someone working for the network? It’s impossible to know.
Still, it would be a curiously improbable coincidence that screengrabs showing the inner workings of a sextortion ring would be published to a Facebook page bearing Pablo’s name, when he seems to be at the center of a network which does exactly that type of activity.
Pablo and Mehdi both ignored multiple attempts to contact them. However, my colleague Marie-Eve talked to two (real) young women who had participated in the network’s activities by sharing posts from fake profiles. Both confirmed that the network is used to make money. One of them said that she made 10,000 euros ($14,800 CDN) in a single month by “sharing links on Facebook.” She also claimed that the network was based in France, Spain and Italy. Both women abruptly ended all communication with us after initially agreeing to an interview.
Shortly after this, the fake profiles started disappearing. It’s probably no coincidence that the profiles to which Mehdi had access in 2016 disappeared as well.
To me, it’s clear that Pablo and Mehdi are not running this network by themselves. What we’re seeing is most likely several different interconnected networks that co-operate to attract a mutually beneficial audience. Another part of the network, based in northern France and Belgium, seems to run a slightly different scheme, using fake profiles to attract men towards Snapchat accounts. These accounts seem to be running a cyberprostitution ring. But that’s a story for another day.
With regards to the network run by Pablo and Mehdi, its disappearance – which is probably only temporary – allowed me to better understand its scope. The profiles seem to have been deactivated rather than deleted outright. What’s more, Snapchat accounts related to some of the fake Facebook profiles run by the network have continued sharing fake pornography links, using the same tactic as on Facebook.
After having analyzed the HTML code of the webpages from which these links stem, I was able to determine that the network uses a CPA (Cost Per Action) marketing service. By entering a script on a webpage, the network automatically redirects its victims towards fraudulent dating sites, where they’re asked to enter their personal details, including their credit card numbers.
From what I’ve been able to see on the CPA company’s webpage, the network can make up to 28 euros every time someone they sent to the dating site signs up. When we know some of these links can generate thousands of likes and comments on Facebook and that their potential audience can be in the tens or even hundreds of thousands of people, the money that can be made this way is substantial. If we believe what we see on his Snapchat and Instagram accounts, Mehdi seems to be living the life of a globetrotter these days – an expensive hobby.
Are Mehdi and Pablo behind everything that goes on in the network, from A to Z? It would be impossible to tell. Perhaps the network “rents” its audience to fraudsters in exchange for a cut of the profits. Or maybe fraudsters have found out that the network’s posts are perfect hunting grounds. What we know, though, is that the entire process is in place, and it seems to be working well.
And what about Béatrice in all of this?
She seems well, but I never managed to find out who’s behind her profile. She recently stopped sharing sexy pictures.
She started her old scheme again, sharing pictures of sick or disabled people.
Writing and research
with Marie-Eve Tremblay and Julien D. Proulx
Project lead, digital development
Director of online content strategy