Fake ads; real problems: how easy is it to post scam adverts on Facebook and Google?

It's no secret that social media and other online platforms have made it easier than ever before to reach highly targeted audiences with the information you want them to see.

In many cases, this works to the advantage of both advertiser and casual internet scroller - they can fine-tune their marketing to make sure it's relevant and you'll see listings for products you're more likely to want. But what happens if someone with unscrupulous aims tries to get fake ads and information under your nose?

Not only could you be misled into buying something dodgy or unsafe, but it could also result in you falling victim to a financial scam.

You'd be forgiven for thinking that the adverts you see displayed on high profile sites such as Facebook or Google must have been through a stringent vetting process, but unfortunately this isn't always the case. To find out how easy it is to push fake content online, we launched a fake brand of bottled water and attempted to promote it to thousands of Facebook and Google users, with accompanying pseudo health advice.

Read on to see what we found out about the world of online advertising, and for advice on how to reduce ad targeting and spot a fake or misleading advert while online.

Stamp out scams: scammers steal hundreds of millions of pounds from victims every year. Sign up to our scams campaign to get banks and businesses to do more to protect us.

Video: Fake ads on Google and Facebook

Find out how we put together our investigation into online advertising and what we found:

How easy is it to publish fake adverts?

Facebook and Google dominate the £14bn UK digital advertising market. According to data from the Competition and Markets Authority (CMA), Google earned around £6bn in 2019, while Facebook added more than £2bn to its coffers after booking nearly half of all display ads. In the same year, Google banked more than 90% of the revenue from advertising around the UK's online searches.

To investigate the digital advertising market, we created a fake water brand, Remedii, and an accompanying online service offering pseudo health and hydration advice called Natural Hydration. We then advertised both using Facebook and Google.

With barely any checking, Google promoted ads for our website and fake mineral water to users who searched for popular terms, such as 'bottled water'. Our ads gained nearly 100,000 impressions over a month.

On Facebook, we were able to create a page for 'Natural Hydration' - filled with pseudo advice posts on 'health and hydration', and plugs for the fake brand - and pay for it to be promoted. In just a week, we gained more than 500 likes to our page, giving us a ready-made audience to reach with fake messages and promotions. 

Just Google it

When you type a search term into Google, some of the results will surface naturally because their content is deemed to be useful. Other results, labelled as ads, are in a high position because their owner has paid Google to promote them, in a form of advertising called pay-per-click (PPC).

Although PPC is a common - and often essential - practice for legitimate businesses, it can be misused. All we needed to start buying PPC adverts to promote our fake water company was a Gmail address, which are quick and easy to create with no identification or vetting.

Google put our ads, including the one below, into a review process before they were published. However, we didn't need to provide any proof that our business actually existed. In fact, it took barely an hour for our fake advert applications to be approved by Google, with no further input required from our fake company.

Thanks to the ad money we paid Google for our fake brand, our NaturalHydration.co.uk ad was presented above official NHS Scotland pages when you searched Google for the words 'hydration advice'. And our Remedii advert, above, claiming to help you 'lose weight, improve your mood and feel better', was presented prominently when you searched for 'bottled water'.

We purposefully chose to target search terms we didn't think would cause too much undue harm to those who stumbled across them, but scammers may not be so discerning. 

Google has recently announced plans to improve advertising transparency by expanding its 'identity verification' scheme, introduced for political ads in 2018, to all advertisers. In theory, this means you'll soon need more than just a Gmail account to buy advertising.

Google has said that all advertisers will have to complete the programme, providing proof of their identity and/or business incorporation documents. There are some potential caveats, though.

We believe that a valid UK passport may be sufficient to pass verification, and advertisers will have 30 days from setting up their account before they need to complete the scheme.

All approved ads will remain up and active during that time, meaning fleet-of-foot scammers could still game the system. Plus, the new rules aren't launching in the UK until early in 2021. 

Facebook advertising

Following a string of controversies, including the 2018 Cambridge Analytica scandal, Facebook is more restrictive than many online companies when it comes to advertising that could, in theory at least, risk harm to its 2.6 billion worldwide users.

Facebook bans fitness and health ads that use 'before and after' images. It also blocks slogans that could make implications about someone's personal appearance. It banned one of our ads that carried the line 'Feeling sluggish and tired?', for example.

What Facebook does like is content that will keep users engaging with its services for as long as possible. For our investigation, we created a Facebook page - like a business shopfront - for Natural Hydration and produced a range of pseudo health advice posts.

We paid Facebook to promote Natural Hydration and in just a week gained more than 500 'likes'. This gave us an audience ready to receive posts with titles such as 'How do I know if I am severely dehydrated?', who could then recieve frequent, surreptitious promotions for our Remedii water brand. We were able to post the advert images that Facebook's system had blocked on our promoted page, so they could still be seen by our audience.

When we contacted Facebook about our findings, it told us: 'The Facebook page set up by Which? does not violate our Community Standards and is not currently selling products.

'We remove harmful misinformation that could contribute to physical harm, such as false health claims, and have strict policies against deceptive advertising and scams.' 

Advertising targeting

Unless you've turned off ad targeting, your Facebook account will have a curated list of 'interests' that it has predicted you to be interested in, based on your past internet data history. Targeting adverts based on this data isn't necessarily a bad thing - it might help create more tailored promotions of things you actually like. However, we found that some targeting options can feel overly personal and inappropriate for use as marketing tools.

Our first Facebook ad targeted accounts that Facebook had deemed to be UK females aged 18-65 with interests including 'health and wellbeing' and 'water'. That may seem fairly reasonable. However, we were also able to target those with the associated terms 'extreme weight loss' and 'defeat depression'. Our second ad targeted US women, with interests including 'insomnia', 'suicide prevention' and 'panic'.

It doesn't take a great leap of imagination to see how having these sorts of 'interests' attached to individual accounts could lead to people whose search history shows them to be in a vulnerable position being hand-picked by scammers wishing to prey on those vulnerabilities. 

Alongside 'best bottled water', Google let us target a range of search terms including 'eczema treatment', 'high blood pressure' and 'suicide'. Google prioritises ad success, though, so most of our adverts were displayed around the more popular terms involving bottled water.

Find out how to turn off ad targeting below.

Fake advertising 'should be an online harm'

Which? has called for fake adverts and content to be considered as an 'online harm', and brought into scope for possible regulation.

This would require platforms such as Facebook and Google to proactively monitor and take down fake content, while also working to tighten control so that such content is not presented to consumers in the first place.

Harry Rose, Which? magazine editor, said: 'Tech giants earn billions from advertising and should be putting more resources into preventing fraudsters from abusing their platforms, so consumers can trust that the adverts they see are legitimate.

'The government should widen its definition of “online harmsu201d to include fake adverts and content, which would mean future regulation would require more action from tech companies to tackle false advertising.'

How to turn off ad targeting

FacebookFacebook ad targeting is turned on by default. You can turn it off by clicking Settings on your Facebook profile, and then Ads (on the mobile app, it's Privacy > Ad Preferences). You can then see individual controls for ads based on data from Facebook's partners and are able to set these to 'not allowed' if you like. You can't entirely opt out of seeing ads on Facebook, though.

GoogleYou can't completely opt out of ads on Google, either, but you can stop personalisation on the ad settings dashboard of your Google account. Sign in to your Google account, click Settings, then Data & personalisation > Ad personalisation > Ad settings and turn it off. You'll also be able to see what Google thinks it knows about you, such as your job, education level and interests, and turn these aspects off individually.

How to spot a fake ad

1. Find out who posted itAlways look into whether an advertiser appears legitimate. Is it a limited company? Does it have a business address or contact details beyond a generic email? Is its website incomplete or lacking in detail?
2. Avoid anything with errors If an ad has odd formatting, strange or poor-quality images, or spelling/grammar mistakes, don't click on it.
3. Preview the true URL You can see where a web link is heading without clicking it by hovering over it with your mouse. Avoid those that look dodgy - a long jumble of numbers or letters is a clear giveaway.
4. The claim gameBe wary of ads making eye-catching financial or health claims, from products that will supposedly reduce your risk of getting coronavirus to schemes that will help you get rich.
5. Report itIf you think you've seen a fake ad, report it using the tools provided by Facebook, Google and other platforms. You can also complain about online advertising to the Advertising Standards Authority.