A few days ago, content from a new J.K. Rowling Facebook page began appearing in the News Feeds of people around the world, causing a wave of confusion. Though it had more than 1 million fans, users swore they’d never liked the page.
“There's something sketchy about this whole page. It was created yesterday, and I definitely never ‘liked’ it or followed it, yet it shows that I did. Wtf?” wrote one person.
They were even more puzzled when the page uploaded a profile picture of former Disney actor Bella Thorne rather than the author of the Harry Potter books. “PLOT TWIST: JK Rowling was Bella Thorne all along!” said one commenter.
But the page doesn't belong to Bella Thorne, or J.K. Rowling. Instead, it's the work of a spammer who essentially hijacked a Facebook page to harvest advertising dollars.
The fake J.K. Rowling page sprang to life April 29, complete with more than 1 million fans, thanks to a deviously clever technique used by spammers to steal unclaimed Facebook interest pages and use them to make money. At one point, a reporter from BuzzFeed News was shown a video ad for a major Canadian bank, RBC, on a stolen interest page for actor and entrepreneur Jessica Alba.
Interest pages are auto-generated by Facebook from interests that users list in their profiles. They typically have no formal connection to the person or thing they’re about and don't have humans managing them. But even though no one is actively managing them, popular interests can still attract millions of fans.
In total, BuzzFeed News found more than 100 stolen pages for celebrities, books, films, religions, and generic interests such as “love” that were taken over through this technique. These pages have more than 55 million likes. As of this writing, Facebook has removed 21 of the pages.
The existence of this scam, and its ability to steal pages with millions of fans without being detected by Facebook for weeks, shows how the world’s biggest social network continues to be exploited by bad actors. In this case, they were able to steal pages that had been auto-generated by Facebook itself without the company realizing it.
A Facebook spokesperson initially told BuzzFeed News it had "identified a bug" and was investigating the issue, but declined to comment further. Hours later, the company said it had fixed the bug, removed the pages, and "demoted" the admins who had managed to steal the pages. This prevents them from creating new pages.
Facebook would not say what the bug was or how it worked. It would only say the bug was not related to a feature that enables a user to claim an existing page, which BuzzFeed News previously said may have been how the pages were stolen.
What is clear is that Facebook somehow allowed these spammers to merge large interest pages with other pages they controlled, thereby taking ownership of millions of fans.
The new owners of these stolen interest pages then used them to reshare content to generate additional engagement, or to promote links to sites in order to drive traffic and earn ad revenue.
Stolen pages included one for “love” with more than 6 million fans, a Johnny Depp fan page with over 4 million fans, a page for the film The Hangover: Part II with 1.4 million fans, a page for Christianity with close to half a million fans, and one for the New York Times with more than 30,000 fans. There were pages for notable historical figures such as the Prophet Muhammad and Mozart; many pages for languages, including Spanish, Korean, Hindi, and even American English; and some for basic ideas or concepts, such as walking, fighting, and money.
The page for Islam, which had more than 2 million likes, was stolen and then quickly infested with anti-Muslim comments, including one that alleged President Barack Obama is Muslim and is leading the “infiltration” of America by jihadists.
The Johnny Depp page shared links to hotelsreviews24.com, a junk-news website registered in Gujarat, India, in December 2018, as well as lajmeakt.info, a site registered in Turkey on March 22, 2019, just a few weeks before the stolen pages began to appear.
The hijackers also earned money directly from Facebook, which helps place video ads for some pages. BuzzFeed News spotted video ads from a major Canadian bank and a milk brand on a stolen Jessica Alba page. The dairy ad appeared during a seven-minute excerpt of the film The Mummy that was scraped from a TV channel and then uploaded and reshared to the stolen Alba page — at which point the company’s ad tools helped the spammer earn money from video ads. (Facebook did not comment on why or how the ads were shown in this instance.)
The Mummy video was originally uploaded to a page called Cats Planet, which has 202,000 followers and contains other content that has been reshared by multiple stolen interest pages, such as those for The Hangover: Part II, Jessica Alba, and Quentin Tarantino.
In another example, a Facebook page called Gospel Music, which has a cover image that includes the branding of Universal Music, contains content that has been reshared by many stolen interest pages, including ones for Marley & Me and The Da Vinci Code.
Both the Cats Planet page (which did not share any cat content) and the Gospel Music page (which didn’t share anything related to gospel music) were managed by people in Pakistan, according to page-transparency details shown by Facebook. BuzzFeed News found at least seven other spammy pages whose content was reshared to stolen pages.
BuzzFeed News messaged several of these pages but did not receive a reply. Facebook subsequently removed the Gospel Music and Cats Planet pages.
While they waited for Facebook to remove the stolen pages, some users took it upon themselves to warn others by leaving negative reviews and cautionary comments. A page for comedian Daniel Tosh was showered with one-star reviews from people angry about seeing its spammy, copyright-infringing videos all over their News Feeds.
“Who is Daniel Tosh and why is he vomiting all over my Facebook feed?” wrote one person.
“This page ruins my newsfeed. I wouldn’t recommend to anyone. Whoever is running this page eats paint chips to excess and it can’t be healthy for their brain,” said another.
One woman in Serbia who discovered the stolen J.K. Rowling page in her News Feed told BuzzFeed News that some people started unliking the page after she and others left negative comments.
“I noticed that about 4,000 people disliked the page from yesterday to now, actually from the moment they started posting,” she said in a Facebook message.
UPDATE
Added new information from Facebook about it fixing the "bug" and the removal of stolen pages.