WPP's Choreograph contains remnants of data unit that facilitated fraud in US

A data unit within WPP was sued by the U.S. Justice Department in 2021 for facilitating fraud schemes that affected mostly vulnerable Americans for seven years — in some cases in full knowledge it was supplying data to scammers — according to court documents.

The lawsuit, filed in June 2021, alleged that KBM Group, a now defunct data broker formerly operating as part of Wunderman Thompson, sold the personal data of millions of Americans to more than a dozen perpetrators of fraudulent mass-mailing schemes. The sales took place from around January 2012 until December 2018, the lawsuit states.

KBM admitted to the offences in June last year and entered into a deferred prosecution agreement, a settlement that allows it to avoid prosecution on a charge of conspiracy to commit mail and wire fraud — provided it meets certain criteria. These criteria include a requirement to put in place an “effective” compliance program and to report to the government annually on its measures to protect consumer data, the agreement states. 

The data broker agreed to pay $42 million in penalties, of which $33.5 million was allocated to compensate victims, according to court documents. 

It’s unclear exactly how many victims fell prey to the scams, but the Justice Department’s lawsuit states that several of the schemes each impacted “thousands of consumers.”

The elderly and vulnerable were “disproportionately affected” by the scams, the lawsuit states, which asked consumers to send money in order to claim cash prizes or receive government grants, personalised astrology predictions, dietary supplements or auto warranties.

KBM ceased operating following the investigation, WPP confirmed to Campaign US. Its website was shut down in March 2022, according to internet archives, and replaced with a holding statement that reads: “KBMG no longer maintains the former IBehavior database,” which powered its services.

It is from the IBehavior database that KBM pulled personal information sent to the fraudulent clients, according to the Justice Department suit.

That database, and at least two former KBM senior staffers, now sit within Choreograph, a new global data company launched by WPP in April after KBM Group and other Wunderman data units were merged with data assets from GroupM, including MPlatform.

Senior KBM employees listed anonymously in the lawsuit as knowingly facilitating the fraud schemes were fired, according to legal documents.

At least two former members of KBM’s leadership team have moved over to Choreograph in senior roles: Bret Harper, who was chief operating officer at KBM, and is now chief data services officer at Choreograph, and Martin Smith, formerly GM of data products, who now holds an SVP title at Choreograph. 

The IBehavior co-operative database was also transferred into Choreograph, according to Choreograph’s global privacy policy. 

WPP did not provide information on data assets or staffers that were transferred from KBM into Choreograph. The holding company said it has developed a robust compliance program within Choreograph that adheres to the terms of the Justice Department settlement agreement.

A WPP spokesperson said: “The agreement in June 2021 related to the actions of a small number of KBM employees who are no longer with the company. There was no impact on any ongoing business or clients and KBM itself has now ceased operating. The agreement recognised that KBM had cooperated fully with the DoJ’s enquiries, remediated all issues and put in place a new compliance program to ensure there could be no recurrence.”

There was no mention of the lawsuit or transfer of the database in WPP’s 2021 annual report, released March 31.

Campaign learned this week that WPP plans to shut down the IBehavior database by September 30. Choreograph employees have reportedly alerted clients of the news over the past few weeks. WPP confirmed the IBehavior shut down and said it forms part of an evolution of its data sourcing strategy.

KBM’s role in the schemes

Emails between KBM employees that were used as evidence in the ‘United States vs. KBM Group, LLC’ case indicate that, in some cases, the company handed over data in full knowledge it was to be used to distribute scams, according to the case documents.

The schemes advertised false sweepstakes, astrology services, auto warranty, dietary supplement and government grant offers, according to the lawsuit. Consumers were asked to pay a “processing fee” to receive a prize or offer. Examples of what they would be offered include $3.9 million in cash, a $45,000 bank check, personalised astrological services, “unique supernatural objects” and “powerful good luck talismans.” Rather than receiving what was advertised, they would often be barraged with additional scams.

KBM employees would, at times, review the advertising copy used in the schemes before they would be distributed. In some examples listed in the lawsuit, they would acknowledge the clients were likely to be scams.

In one example, KBM’s finance department flagged a client as likely to be fraudulent and denied the licensing of data. The client provided samples of what it intended to mail to consumers, which advertised a $3.9 million “cash prize” in exchange for a one-time processing fee. An employee said of the client: “They are scams and likely don’t have websites.” According to the lawsuit, the GM of merchant services, Joe Bank, and a VP, stepped in and persuaded the finance controller to approve the client. Campaign was unable to reach Bank for this story.

Furthermore, KBM employees continued to sell data to some clients even after they were made aware those clients had been arrested or convicted of fraud, the lawsuit states. After a Justice Department action against perpetrators of elder fraud, a KBM employee emailed colleagues and said “We know some of these guys!”.

Data from a range of businesses that had many elderly customers was used in the schemes, including non-profit and charitable organisations, according to the lawsuit.

KBM also onboarded data from the fraudulent clients into its data co-op to build insights on consumers that could be licensed to other co-op members. That data was deleted as part of the deferral of prosecution agreement. The lawsuit states the acquisition of data as one of the reasons why some KBM employees did not weed out scammers, along with hitting sales targets.

A data list broker who has licensed data from IBehavior for more than two decades estimates that it would have cost smaller clients around $60 to $70 to license 1,000 names from the database during the period that was investigated. Each client negotiates different prices with data co-ops.

Separately, data company Epsilon was sued by the Justice Department for the same charges in January 2021, and admitted in a deferral of prosecution agreement to selling data from more than 30 million consumers to perpetrators of elder fraud schemes. Epsilon agreed to pay a total of $150 million in charges, $127.5 million of which was assigned to compensate victims of the fraud schemes. The transgression was prior to Epsilon’s acquisition by Publicis, which has indemnified itself against any charges related to the case.

22 years of data

WPP inherited KBM Group from its acquisition of Young & Rubicam (now VMLY&R) in 2000. Young & Rubicam bought the database marketing company, originally known as KnowledgeBase Marketing, for approximately $175 million a year prior. KBM Group was formed in 1999 as a merger of three marketing services companies — I Rent America, Dynamic Marketing and Customer Management Services — and was headquartered in Chapel Hill, North Carolina.

At WPP, KBM Group was housed under Wunderman and in 2008, Wunderman merged its global data practice with KBM Group. The firm changed its name on its website to Wunderman Data Products in late 2018. From 2019, it also operated as Wunderman Thompson Data, following Wunderman’s merger with J Walter Thompson.

KBM Group was incorporated in the UK in 2017 but was subsequently dormant, according to Companies House, and dissolved in the UK in 2019.

Clients listed on the data firm’s website up until March 2022 included Shell, Novartis, Gerber Life, Pernod Ricard and Microsoft.

WPP bolstered KBM’s data assets by acquiring several data brokers including retail transaction database IBehavior in 2010, and Predictys SAS in 2012. 

IBehavior is a co-operative database, a model in which a cohort of companies — thousands in some cases — pool data to build a richer dataset on consumers that they can then license for targeting.

At the time of purchase, IBehavior’s database included information on purchases by 171 million consumers from 110 million households, according to a press release. It also had information generated by 103 million online shoppers and 35 million B2B purchasers.

IBehavior contained data on more than 100 million households in the U.S. during the period the Justice Department investigated it, according to the lawsuit. 

KBM collected a vast variety of data. A company pitch deck that, according to Google’s search index, is from more than 10 years ago, purports to break down KBM’s data segments.

Screenshot of a KBM Group pitch deck.

Databases of this depth and size are extremely valuable — they are the foundation of the $285 billion ad industry in the U.S, per Zenith estimates. Holding companies have shelled out billions of dollars to purchase such databases to power their marketing products. Publicis paid $4.4 billion to acquire Epsilon in 2019, Interpublic Group paid $2.3 billion to purchase Acxiom in 2018, and Dentsu reportedly paid $1.5 billion for data marketing firm Merkle in 2016. 

Omnicom Group has built its data unit, Omni, through licensing data services rather than acquiring them. 

Havas Media Group has acquired several data agencies to build its in-house data capabilities, including Spanish data analytics firm ElisaDBI in 2013 and digital agency Search Laboratory in April this year.