Direct threat to life, panic among civilians, and emotional rollercoaster that have followed us from the moment of resumed active hostilities – all of it creates a favourable background for frauds. In fact, recently, the number of headlines has increased such as “Swindlers Try to Steal Trucks Claiming They Needed Them for the Army”, “Ukrainians Are Offered Private Demining Services”, “Swindlers Try to Steak Payment Cards Data Under the Disguise of Offering Financial Aid from the UN”. So, while the Ukrainian Army are defending our state in the East and in the North, volunteers and charities provide the military and civilians with all things necessary, whereas Ukrainian diplomats are trying to get the strongest possible punishment for the russian federation, some Ukrainian people profit at the cost of their fellow citizens.

Before the invasion, fakers mostly focused on schemes to steal the money from common citizens (such as by selling the non-existent goods or services). During the war, some dishonest Ukrainian people changed the focus and expanded the scale of their action: now the rogue schemes have become more cynical and more related to people’s life and health. For example, they offer fake evacuation options from the occupied territories. The rogues are hunting for their “clients” not in a subway or by phone, as before, but rather in social media. They even advertise their services on Facebook and Instagram.

At the same time, social media may even sometimes contribute to the rogue schemes: because of imperfect content moderation mechanisms, Facebook and Instagram may accept promoted posts with fraudulent content (also the ads with large budgets).

In this report, OPORA summarizes the cases of active frauds and other ways to profit from the war in the Ukrainian segment of Facebook.

Nothing personal, just business

To find the dishonest Ukrainian people, OPORA referred to the Meta Ad Library — it saves all promoted posts published on Facebook and Instagram from June, 25, 2019, until today. We selected a time span of three months (from February, 10, to May, 20  2022), and reviewed the ads from all advertisers that launched the promotion campaigns during this time.

In general, the monitoring revealed at least 40 advertising accounts that tried to make use of the war in Ukraine to profit, to increase their popularity, or to illegally earn. At the same time, when reviewing advertisers’ profiles, we noticed that Meta blocked a large number of accounts that have shared promoted posts since the invasion, or stopped promoting posts that went against community rules. It is impossible to view these posts now, that is why it is not clear what the actual reason for blocking was, whether sharing pro-Ukrainian messages (such as photos of Ukrainian soldiers killed in combat) or any attempts to profit from the war in Ukraine.

The identified accounts include a noticeable network of pages that openly tried to profit from hostilities in Ukraine, while directly breaching the Ukrainian law. Thus, at least 5 pages were advertising their services to Ukrainians to fake their IDs to leave abroad:

 

 

These pages are not similar to most other networks earlier identified in Ukraine. Thus, despite a similar design of the ads, it is indicative that none of them had an administrator from Ukraine, and the pages were created in different time:

Most of these pages represent local businesses from different countries: Stay Warm Closet sell clothes, Enersolex Energías Renovables sell solar panels, Bilhares Carrinho sell furniture. However, all these pages are connected by similar ads offering to prepare the documents for exit referring to the Telegram channel for direct contact with frauds.

 

Most posts in this Telegram channel are calls urging “clients” to use the services of their “company” and prepare certificates to leave abroad, as well as share “success stories” of Ukrainians who received such permits. The prices for the “services” are revealing: the “white pass” is 1,400$, exit with the “volunteer” status — 2,000$, exit as a student of a Polish University — 2,400$.

In addition to this network of pages, OPORA also identified several less powerful schemes. In particular, the Ukrainian segment of Facebook and Instagram revealed another page that offered fraudulent certificates to leave abroad, and also offers to arrange the 6-months visas in one day, or even get the EU citizenship as soon as in one year.

 

In addition, we found one page (Media Inform UA) that did phishing through Facebook ads. From May, 6 to 13, 2022, it promoted links to fake guidelines how to receive help from the government on the phishing website (whereas these days, the National Bank of Ukraine  informed that frauds were trying to access data of banking cards disguising their activities with the purported humanitarian financial aid from the UN). While we were preparing this report, the page was deleted but in a week’s time it managed to post 5 ads. It spent for their promotion at least UAS 6,152 (they paid a portion in USD, and the remaining amount in Vietnamese dongs/VND). These ads were also actively reposted on Facebook. Thus, we found at least several posts that are still sharing this ad despite the blocked original page.

.

 

We also found at least two pages (ukrmarka, My Kharkiv) that offered to buy the well-known stamps with the russian warship.

Some Facebook users are also trying to profit in a similar way by offering help with preparing the documents for Ukrainian refugees abroad and for domestic Ukrainian audiences. In particular, among Facebook ads we found some offers from several organizations (Лига Информ, Регистрация бизнеса в Польше, Civito) that offer their help in preparing a journalist’s ID, in legalizing the operations of IT experts abroad, or in relocating your business to Poland.

 

Along with posts directly encouraging Ukrainians to break the law, there are also dangerous posts promoting armored vests, helmets, thermal cameras and other PPE without proper documents or quality certificates. These products may cost a life or health to Ukrainian soldiers but the pages often suggest buying them on unreliable websites and only with advance payments. Some of them even offer a service of “hanging” the products (when you pay for a product and the shop “obliges” to send them for soldiers in the frontline who need it most).

The largest group among the accounts we identified were the Facebook pages of news channels on Telegram and pages of various astrologists — the total of 20 such pages. Their activity may be considered “safest of all”: the key objective of the ads they share is to make you go to their page and/or follow them on social media. After all, such actions help gain profits or increase the audiences for the page owners but they do not pose any direct threat to consumers of this information.

What do you do no to get “hooked”?

Recently, the Ministry for Reintegration of Temporarily Occupied Territories published a memo on how not to become a fraud victim.

With regard to the frauds described above, OPORA offers several steps to help you respect the law and not be deceived by frauds:

  • If a promoted post on Facebook offers to you to subscribe to yet another news channel or listen to yet another “expert” who will tell you the precise day when the peace comes  — remember that frauds often play with emotions (they mostly try to provoke fear or hope). If you see that somebody is trying to manipulate with you by affecting your emotions, better avoid any contacts with such channel of information.
  • Avoid any posts that offer to you an easy way to prepare the documents, to bring cars in Ukraine, or to bring the call-up age men out of Ukraine. When you use the services of such organizations you risk to lose your money and also to be brought accountable under the law. Conversely, try to engage with the authorities as much as you can and use the official information sources.
  • Avoid entering your personal data and banking cards data on suspicious websites, especially to “receive the aid” from the government or from international organizations. To receive the official aid, apply to public authorities (such as through the Diya app).
  • If you want to buy the bullet-proof vests, thermal cameras, or help soldiers otherwise, work only with the verified organizations that have quality certificates for their products. If you have no idea about how the quality certificate should look like, better send a request to the verified foundations (“Come Back Alive”, Serhiy Prytula Charity) that will certainly provide the army with the high-quality personal protective equipment.

Оriginal text in Ukrainian: Українська правда