Facebook sues Hong Kong-based company over alleged ad fraud scheme

Facebook has filed a lawsuit against a Hong Kong-based company and two of its staffers, alleging that it operated a fraudulent scheme to dupe Facebook users into installing malware, allowing it to control accounts and run ads through them that circumvented the platform's review processes.

The lawsuit, filed Thursday in a California court, accuses ILikeAd Media International Company Ltd and two Chinese nationals, Chen Xiao Cong and Huang Tao, of involvement in the scheme.

The alleged scheme involved the perpetrators "baiting" Facebook users to click on images of celebrities or bogus advertising links so it could install malware on their accounts. The conspirators would then use hacked accounts to run ads for counterfeit goods, diet pills and male enhancement supplements, according to the lawsuit.

In some instances, the defendants also engaged in a practice known as "cloaking", which involves disguising the true destination of the link in the ad by displaying one version of an ad’s landing page to Facebook’s systems and a different version to Facebook users. The "cloaker" will know when a Facebook reviewer is clicking on the link, and call up an approved site instead of the one it shows users, thereby circumventing Facebook's review processes. The practice is banned on Facebook.

Legal action against perpetrators of cloaking schemes are rare, Facebook said, since the schemes are "often sophisticated and well organized, making the individuals and organizations behind them difficult to identify and hold accountable".

Facebook has been notifying hundreds of thousands of users that their accounts may have been compromised by the scheme and instructing them to change their passwords since April, according to the complaint.

It has also refunded victims whose accounts were used to run unauthorised ads.

The social-media giant now is asking the court for injunctive relief to stop the defendants’ use of the platform. It is also asking the court to recognise damages allegedly caused by their violation of state and federal hacking laws.

In a blog post announcing the lawsuit Facebook director of platform enforcement and litigation Jessica Romero and director of product management, business integrity Rob Leathern wrote: “Creating real-world consequences for those who deceive users and engage in cloaking schemes is important in maintaining the integrity of our platform."