In Lithuania, online scammers are creating copies of major news portals and fake Facebook accounts, and inviting people to invest in fake investment platforms in order to swindle money from citizens of Lithuania and neighbouring countries. In order to attract more people's attention, the advertisements offering quick financial success also use recognisable faces such as performers, journalists, politicians and influencers.
Unidentified persons are exploiting the brands of LRT, LNK, Delfi, InfoTV, the Estonian national broadcaster, ERR, the Estonian newspaper, Eesti Päevaleht, as well as Ignitis and Orlen Lietuva by creating fake copies of their accounts, which show fake ads under the name of these brands.
Part I of the investigation:
The main objective of the ads is to trick Facebook users using fake Facebook accounts into participating in fake investment schemes.
It should be noted that online scammers use fake or cloned accounts that lead Facebook users to websites with articles that replicate the visual elements of well-known Lithuanian news portals (e.g., easily recognisable logos, website-specific fonts, brand-unique website structure, etc.).
FAKE FACEBOOK ADS INCLUDE WELL-KNOWN LITHUANIAN PERSONALITIES
To grab users’ attention, besides the scandalous criminal events, scammers are also exploiting well-known Lithuanian and foreign personalities, such as journalists, politicians, athletes, influencers, etc.
Scammers are using their pictures, distorting true stories or inventing completely fictitious stories that promise supposed financial success. Fake ads are always reinforced with shocking statements, for example:
· “Anužis is in deep trouble for his statements on air”
· “Stop throwing your money at idiots! Just repeat this...”
· “Mildažytė’s reputation is done”
· “The outcome for G. Deksnys doesn’t look good...”
· “After an interview with Gitanas Nausėda, thousands of people went to ATMs and the banks were surprised”
· “Marijonas Mikutavičius spoke about his income on a show and freaked out after receiving a phone call from a bank after which he demanded to stop the show”
Criminal context is often doctored into some of the pictures used in fake articles (for example, depicting well-known persons supposedly apprehended by the police).
Doctored pictures as well as videos are being used in these ads. For example, scammers doctored in a fictitious investment ad into the speech of Mateusz Morawiecki, prime minister of Poland, using deepfake technology:
This is not the first time where scammers have abused the deepfake technology. For example, scammers are using video images generated by AI which replicate the image and voice of Martin Lewis, a well-known financial consultant from Great Britain. M. Lewis took Facebook to court in 2018 over the fake ads using his image to promote fictitious investment schemes. On that occasion Facebook settled, promised to take care of the issue and donated GBP 3 million to a non-governmental organisation that helps people who suffered from a scam attack. However, this year one Great Britain resident lost all her life savings and was mired in thousands of pounds of debt after she fell victim to a crypto-scam advertised on Facebook. The advertisement falsely claimed that it was endorsed by Martin Lewis.
Some ads are being launched from Facebook pages that are not pretending to be the news portals but the pictures in the articles they promote contain the logo of a news portal, for example:
At least 20 well-known Lithuanian and foreign personalitiesare being exploited in fake ads (listed in alphabetical order).
1. Artūras Anužis, TV3 news presenter
2. Vidas Bareikis, singer
3. Gintaras Deksnys, LNK news presenter
4. Andrzej Duda, President of Poland
5. Kaja Kallas, Prime Minister of Estonia
6. Alar Karis, President of Estonia
7. Darius Maikštėnas, CEO at Ignitis Group
8. Edita Mildažytė, journalist
9. Marijonas Mikutavičius, singer
10. Darius Mockus, CEO at MG Baltic Group
11. Mateusz Morawiecki, Prime Minister of Poland
12. Gitanas Nausėda, President of Lithuania
13. Edgars Rinkēvičs, President of Latvia
14. Viktorija Siegel, influencer
15. Deividas Šemberas, football player
16. Ingrida Šimonytė, Prime Minister of Lithuania
17. Andrius Tapinas, journalist, public figure
18. Ott Tänak, Estonian rally driver
19. Greta Thunberg, climate activist
20. Donald Tusk, former president of the European Council
FACEBOOK PAGES AND WEBSITE PRETENDING TO BE REAL MEDIA OUTLETS
Ads promoting fake articles that exploit well-known personalities are being published by Facebook accounts pretending to be media outlets. They lead to cloned websites that replicate the design of real portals.
For example, an account Lietuvos naujienos, pretending to be DELFI TV and using a Delfi logo, was first registered on 20 March 2023 and was called Distant chillax. On 25 September of the same year, it was renamed to Lietuvos naujienos.
Scammers also created copies of Info TV. Over the period of October–September 2023 16 similar Facebook pages were created: Info Žinios, Info Dienraštis, INFO 24 Naujienlaiškis, INFO Žurnalas, INFO Diena, and Info RU, which was in Russian.
Scammers also created many copies of fake LNK pages in Facebook, a part of which are already blocked, while the latest one was created on 1 September 2023 and is still accessible.
Lithuania was not the only target, there were Facebook pages created in Estonian as well: ERR 24Live, ERR Live, ERR.ee
EXAMPLES OF COPIES OF MAJOR NEWS PORTALS
EXAMPLES OF FAKE INVESTMENT PLATFORMS
Scammers are advertising the following fictitious investment platforms:
· Oil profit
· Oil trade
· Ignitis profit sense
· Pump Oil
· Oil Pump
· Kvantinė uždarbio sistema
· GPT App Definity
· Bitcoin Videx 4.0
· BitSoft360
·
A cloned Ignitis website (controlled by scammers): Ignitis profit sense
The website is proposing a supposedly exclusive deal for traders in Lithuania that promises high returns on electricity and gas trading. The website is using Ignitis name and logo. The website also depicts fake comments and a countdown clock to artificially create a sense of urgency in order to convince users to register at the website advertising the investment scheme and deposit money.
