Cryptocurrency scammers flood Facebook users with ads for fake articles

A Facebook page about Cookies advertising cryptocurrencies. Suspicious? Photo by, used with permission.

This story is based on reporting by Global Voices’ content partner News Agency, a project of Metamorphosis Foundation

Scammers using fake Forbes articles and anti-EU disinformation as bait continue to target Facebook users across Europe, the Skopje-based Metamorphosis Foundation has warned.

Metamorphosis is a civil society organization from North Macedonia promoting digital rights and media literacy.

Its monitoring of social networks has revealed that scammers continue to use Facebook advertisements masked as links to articles from the respectable, continuing disinformation trends involving not only China, but also European Union members like Sweden.

Sample of the Facebook ads promoting a fake article, actually leading to website run by scammers. Photo by

Sample of the Facebook ads promoting a fake article, actually leading to website run by scammers. Photo by

On May 19, the Ministry of Interior Affairs of North Macedonia warned citizens that scammers use social networks and e-mail to distribute links misrepresented as articles from to promote the purchase of a supposed new Chinese cryptocurrency.

Citizens who click on the links and provide personal data to the scammers are then targeted by phone calls persuading them to start ‘investing’ by paying instalments of $250 dollars.

Other manipulation techniques are then deployed to make users increase the fee.

The anti cyber-crime unit of the Macedonian police claimed the malicious links lead to a website hosted in Ukraine, allegedly run by a Russian citizen in a manner similar to the debunked OneCoin Ponzi scheme run by Bulgarian fraudster Ruja Ignatova, which inflicted damage worldwide of over $4 billion.

Data publicly provided by Facebook about the geographic reach of the advertisements promoting these links suggest they go far beyond the borders of North Macedonia, activists warn.

Manipulative ads help scammers gather personal data from victims

Metamorphosis identified several similar ads that are active on social networks. Users who click on these ads are redirected to addresses such as instead of pages on the website.

Bardhyl Jashari, Executive Director of Metamorphosis, explained:

Преку манипулативни огласи, измамници продолжуваат да допираат до корисниците на социјалните мрежи низ целиот свет. Користејќи ги податоците кои „Фејсбук“ ги прави јавно достапни како почетна точка на истражувањата, тимот на „Метаморфозис“ откри дека истите огласи им се покажуваат на корисници во скоро сите европски земји, како и во земји од Блискиот Исток и други региони. Измамниците користат Фејсбук-страници навидум на теми од културата, дури и за колачиња, како платформа за пуштање огласи кои ги водат корисниците до веб-страници или блогови што изгледаат исто како оние за кои предупреди МВР

Misleading advertisements continue to target social network users across the world. Using the public data provided by Facebook about the ads targeting the audience based in North Macedonia as a starting point, the Metamorphosis team revealed that the same ads are served in almost all European countries, as well as countries in the Middle East. Scammers use pages about culture, even about cookies, to launch ads that lead the users to web pages and blogs that look almost the same as the ones the Macedonian police warned about.

Metamorphosis, a member of the European Digital Rights – EDRI network, has been working on promoting human rights online, including child safety online since its founding in 2004.

Jashari also noted:

Многу загрижувачка карактиристика на овие групи на организиран криминал е што исто така користат страници кои тематски се наменети за деца и тинејџери за да ги камуфлираат своите злонамерни содржини. На пример страница претставена како заедница за популарната игра „МајнКрафт“ (со име напишано малку поинаку „Минекравт“) објавува огласи што продолжуваат да шират дезинформации за Шведска, насочени кон корисници во десетици земји – од Русија, Австрија и Белгија, до Сингапур, Катар и Обединетите Арапски Емирати.

A very worrisome development is that these organized crime networks also use pages aimed at children and teenagers to camouflage their malicious content. For instance a page branded as community for the popular game MineCraft (titled Minecravt) had been running ads that continue to disseminate disinformation about Sweden, aimed at users in Russia, Austria, Belgium, but also in Singapore, Qatar and United Arab Emirates, and dozens of other countries.

Facebook transparency tools reveal that a MineCraft themed page is used as platform for ads by scammers.

Facebook transparency tools reveal that a MineCraft themed page is used as platform for ads by scammers.

Users clicking on these ads are taken to a page providing an incentive for them to leave their personal data. In the case of Sweden this was disguised as a discount coupon.

Content of a page set by suspected scammers promoted through Facebook ads.

While MineCraft has a huge adult following, it is a particularly popular game among children aged between 9 and 11. This practice helps condition future audiences particularly susceptible to both disinformation and scamming.

Scammers exploiting the impact of political disinformation 

Facebook ad from November 2019 promoting a scam page and amplifying disinformation about Sweden and the EU.

In November 2019, Metamorphosis’ Critical Thinking for Mediawise Citizens – CriThink project warned that scammers benefit from established disinformation narratives about Sweden.

Sponsored Facebook posts lure people who had been previously primed, through right-wing populist propaganda media networks based in North Macedonia, to believe media manipulations about unrest in the country and the European Union (EU), originally published by pro-Kremlin media.

In the same manner, these articles promoted fake news that Sweden has introduced a cryptocurrency opposing the Euro.

To launch these geo-targeted ads, scammers used series of pages with general interest topics, including some branded as unofficial fan clubs of Western celebrities like actors Liam Neeson and Anthony Michael Hall.

CriThink, which is an initiative supported by the EU Delegation in North Macedonia, educated local social media users on how to use the transparency features of Facebook pages used by the scammers, in order to flag and report the suspicious pages using the mechanisms provided by the platform.

In order to boost citizen engagement in raising media literacy levels, CriThink articles related to social networks provide instructions on how users can use reporting features to alert administrators about harmful content, ranging from hate speech to scams.

Notification from Facebook about removal of ads by scam pages targeting users in North Macedonia.

Several weeks later, in December 2019, Facebook informed some of its users who participated in the online action that they had removed the ads reported as scams.

Background: Using the Forbes brand in RNM

Since Forbes magazine enjoys a good reputation as a source of credible business information, it has also become the subject of various media manipulations in North Macedonia.

The government that ruled the country from 2006 to 2017 used taxpayers’ money to publish advertisements or sponsored content in Forbes magazine and other Western media.

These articles mainly concerned the advantages offered by the country to foreign investors.

However, the pieces also had a domestic propaganda use. The media close to the populist ruling party misrepresented the paid-for-content as articles written by economic experts or Forbes staff praising the economic policies of the then-government.

This media swindle was repeated periodically, and was debunked several times in2014 by the Media Fact-Checking Service, established by Metamorphosis with USAID support.

Start the conversation

Authors, please log in »


  • All comments are reviewed by a moderator. Do not submit your comment more than once or it may be identified as spam.
  • Please treat others with respect. Comments containing hate speech, obscenity, and personal attacks will not be approved.