Four Vietnamese Sued for Running Over $36-million Unauthorized Facebook Ads

A 3D-printed Facebook logo is seen on a keyboard in this illustration taken March 25, 2020. Photo by Reuters/Dado Ruvic.

In a blog posted on June 29, Facebook said it had filed two lawsuits against those who violated the Advertising Policies. The defendant in the first lawsuit is a California-based marketing company and agents. The second lawsuit is against a group of people living in Vietnam, who employed session/cookie theft techniques to compromise the accounts of employees at advertising and marketing agencies, leveraging them to run unauthorized ads, reported Vietnamnet.

According to Facebook Director of Law Enforcement and Litigation Jessica Romero, four individuals living in Vietnam – Them Huu Nguyen, Le Khang, Nguyen Quoc Bao and Pham Huu Dung – used “cookie stealing” or “session stealing” techniques to compromise personal accounts of employees of many advertising and marketing agencies, and then they ran unauthorized ads from these accounts.

The Facebook blog claimed that victims were scammed, leading to account loss after installing an app from the Google Play Store called “Ad Manager for Facebook”. The app was installed more than 10,000 times between December 2020 and May 2021.

When the “Ad Manager for Facebook” is downloaded, the victim shares their Facebook login information and others. The hackers use the information to access the account and then run ads. In some cases, they used the accounts to commit online scams.

According to Romero, this group ran illegal ads worth more than US$ 36 million.

“The group ran over $36 million in unauthorized ads. In this case, Facebook refunded the victims and helped them secure their accounts,” the social media giant says.

Facebook’s announment in a blog post.

The defendants spent money earned from the scam, on many luxurious hobbies and posted bragging photos on social networks.

Facebook’s lawsuit cited many photos these individuals posted, from images of buying a series of Apple products, going on a cruise, buying a Mercedes-Benz, traveling in business class, using expensive watches.

“During 2020 and 2021, the defendant group used the money to organize parties, buy expensive vehicles, travel in business class, get tattoos, among others. Then they brag about their lives,” Facebook wrote in the lawsuit.

Facebook said it was trying to expose the entire behavior of the four violators, forcing them to take responsibility for writing the “Ad Manager for Facebook” application to trick users.

Evidence of the defendants’ lavish displays of life. Source: Vietnamnew/Zing

The firm also filed a lawsuit against California marketing company N&J USA Incorporated and its agents Mohit Melwani and Vishaal Melwani, for engaging in a bait-and-switch advertising scheme.

As part of the scheme, deceptive ads were placed on Facebook to promote merchandise such as clothing, watches, and toys. Upon clicking on these ads, users were redirected to third-party e-commerce websites on which they could complete the purchases.

However, those who fell for the scheme never received the merchandise they paid for, received products of a lesser quality than what had been advertised, or received something different.

According to Facebook, the defendants attempted to conceal the bait-and-switch scheme by blocking and hiding user complaints and negative reviews. The social platform previously disabled some of the defendants’ accounts and pages and is now taking an additional step against this type of abuse.

Facebook said its legal action is part of ongoing efforts to combat account takeovers on its platform.

This two lawsuits are just the most recent cases the social network has filed over the course of the past three years against entities that have abused its platform for various forms of cybercrime. However, this is the company’s second lawsuit against account hijacking.

The first lawsuit occurred in December 2019, in which the defendant tricked people into installing malicious code on the Internet. The malicious code allowed the defendant to compromise the victim’s Facebook account and run unauthorized ads to promote items such as fake and imitated goods and weight loss pills.