Beauty giant Mecca becomes latest brand hit by fake scam ads on Facebook, Instagram

Earlier this month, Julia was scrolling through Instagram when she saw an advertisement that seemed too good to be true.

The Meta-owned platform served the makeup fan an ad promoting an online sale from Mecca, the popular Australian cosmetics retailer.

Clicking the “Shop Now” button took her to a website showing 80% discounts off products, banners that offered free shipping on orders more than $59, and dozens of detailed descriptions for face masks, lipstick and other products.

It was, in fact, too good to be true. The advertisement from “MECCA AU” — which used the real Mecca logo and styling — was promoting posts from an otherwise blank Facebook page with three followers. The “Shop Now” button led to a convincing but fake website at meccasale-au.com, which was nearly identical to Mecca’s real website. The website takes your order and payment details but no goods are ever delivered. It’s a scam.

“[I knew] it was fake right away as Mecca never had sales and the prices were way too cheap to be real,” Julia, 41, told Crikey.

The website is one of dozens of fraudulent store websites from Australian retailers found by Crikey. Each of them uses the same tactic: clone a company’s website, create a blank Facebook page, use Meta’s advertising platform to target fans of companies with the promise of cheap sales, direct them to the website, and simulate the normal online shopping experience to obtain a user’s credit card details — presumably to be used for fraudulent purchases or sold on to other people.

A FAKE PETER ALEXANDER WEBSITE. Source: META AD LIBRARY

The fake Mecca website leaves few clues as to who is really behind it. The public records for ownership of the meccasale-au.com domain don’t list the owner. The only hint is the website’s IP address. A reverse IP address search shows that more than 400 websites are hosted on the same address, suggesting that they’re all run by the same individual or group.

These linked websites include fake stores for Peter Alexander, Cotton On, Macpac, Asics, Oroton, Seed, Skechers, Timberland and others. Each of these websites uses a similar design and promotes discounted products. Their domains were all registered on Chinese e-commerce website company Alibaba’s registrar service, Alibaba Cloud. The company did not respond to a request for comment.

Meta’s advertising library shows that many of these URLs have been featured in advertisements on the platform. There’s no information about how many users were shown these advertisements or how they were targeted. The advertisements are typically run from accounts started earlier this year with a different name — like “Marylynne”, in the case of one set of fake Mecca advertisements — that are then changed to a brand name before the advertisement is run.

A SERIES OF ADVERTISEMENTS FOR A FAKE SEED WEBSITE ON META. Source: META AD LIBRARY

After being sent a set of advertisements by Crikey, a Meta spokesperson said that the company had removed the advertisements and the associated Facebook profiles.

“We strongly encourage people to report content that may breach our rules so we can review and take the appropriate action,” the spokesperson said in an email.

But by the next day, new advertisements with the same fake promotions for the same websites had popped up from fresh Facebook profiles. Nearly a week later, these advertisements remain active.

Fake online stores are a common online scam. The Australian Consumer and Competition Commission received 2,760 reports of fake online stores between the start of the year and the end of September, costing Australians $6.2 million.

What makes this different and noteworthy is the way that these scammers are paying one of the most profitable tech companies in the world to target vulnerable consumers while taking advantage of a product design that makes it almost impossible to distinguish between real and fake advertisers at a glance.

While Meta’s rules prohibit fraudulent activity, the scammers seem to have no problem using its advertising platform. As the middleman that connects the advertiser to the audience, Meta has no idea what happens once someone clicks through to another website. But these scammers rely on Meta’s advertising platform to find their victims. In some cases, Meta is taking money from both the fake retailer at the same time as the real retailer — Mecca is a frequent advertiser with Meta — whose audience scammers are targeting. Mecca didn’t respond to a request for comment.

Julia, who posted a warning about the advertisements to the subreddit r/AustralianMakeUp, said she was frustrated with Meta’s role in the scam.

“I feel there’s something going wrong in Meta’s vetting process and they should be held responsible for anyone scammed by these ads,” she said.

This article was first published by Crikey.