When American conservative commentator Tucker Carlson interviewed Russian IT entrepreneur Pavel Durov in April, he had an additional unexpected audience: scammers.
After the video was published, a phony Russian-language transcript of the interview tried to attract “investors” to a cryptocurrency scheme that promised monthly earnings of $13,000.
That scheme came to VOA’s attention because its creators used a copy of a VOA Russian article page in their attempts to defraud internet users.
It is one of many examples of legitimate media outlets being exploited for fraudulent purposes.
These schemes buy advertising using Facebook accounts — often hacked without the user’s knowledge — spanning countries like the Philippines, Mexico and Afghanistan.
The strategy and rhetoric follow a pattern, according to Jordan Liles, at American fact-checking site Snopes.com.
"There are so many scams online that pose as legitimate publishers,” he told VOA. “Name any publisher – they’ve probably been used in scams to try to fool people who don’t look at their web address bar.”
There is no indication that Durov or Carlson is involved in the scheme. VOA reached out to them for comment but received no response.
In a statement, Facebook parent company Meta told VOA it takes scams seriously.
“Fraud is a problem that’s always persisted with new technology,” the company wrote. “But that’s exactly why Meta always has — and always will — take a hard line against scams, fraud and abuse in all of its forms to help keep it off of our platforms.”
Scammers have previously posed as Voice of America, using deepfakes in two separate cases that targeted VOA Russian journalists.
Those cases relied on artificial intelligence.
In contrast, the Durov scam takes a distinctly low-tech approach: It uses a Q&A-style text transcript in Russian that falsely claims to be a “continuation” of Carlson’s interview.
The founder of Russian social media site VKontakte and messenger app Telegram, Durov is a well-known tech entrepreneur. That makes him harder to impersonate.
According to an April 2024 report by the Microsoft Threat Analysis Center, while deepfakes of public figures “are relatively routine,” they also tend not to be believable.
Layers of lies
At the center of the cryptocurrency scam impersonating VOA is an intriguing promise and a trail of stolen accounts spanning the globe.
The fake story claims that Durov told Carlson about his latest creation: ProTON-Invest, an open program that will allow even the least financially literate person to earn large sums of money with minimal effort.
VOA attempted to trace the origins of the ProTON-Invest scheme and its promotional content, but the fraudsters had done a good job covering their tracks.
When VOA approached the owners of the Facebook accounts that bought advertising for the scheme, those who responded said they had lost access to their pages.
One of the accounts, called “Simply News” in Russian, had previously been the page of a business in Calumpit, a provincial city in the Philippines, that sold house plants and baked goods during the coronavirus pandemic.
The business’s co-owner, Dannie Roxas, told VOA that the page had been hacked.
"We do not have any access to it and we cannot take it back anymore,” she said in a Telegram message. “We already have reported it.”
Another Facebook page promoting the scam (but without the fake VOA story) was “Golden News.” It formerly belonged to a travel agency in Kabul, Afghanistan.
VOA wrote to the agency over WhatsApp. A man who did not identify himself said the most recent posts were not from the company and they had likely been hacked.
When VOA inquired further, he declined to provide more information.
VOA also identified several more accounts sharing the fake transcript or pushing the fraud scheme. Two appeared to belong to a graphic designer in the Punjab region of Pakistan. He did not respond to a request for comment.
Another belonged to a Mexican rapper. The man behind that page did not respond to a request for comment but had previously written from his personal Facebook page that his music account was hacked.
According to Facebook’s Page Transparency data, the stolen accounts often had managers supposedly located in multiple countries, including Vietnam, Bangladesh, Ukraine, China and the U.S.
But it’s unclear how Facebook determines where the managers are located. Meta did not respond to a question from VOA about that.
If the determination is based on an IP address, that can easily be spoofed using a virtual private network (VPN), a basic tool for maintaining privacy online.
Trouble fighting back
At its core, the ProTON-Invest scam appears to benefit from the current online environment.
When hackers take over an account, they often change the password, recovery email and phone number. That makes it extremely difficult to retake the account.
After cryptocurrency scammers took over his Facebook account in early 2024, it took journalist Yuri – who asked to be identified only by his first name to discuss the hack without his employer’s permission – nearly six months to regain control. Ultimately, he had to hire a lawyer to engage with Facebook parent company Meta.
“If the lawyer hadn’t helped me, I would have spent a long time writing to Meta,” Yuri said.
The scams are also relatively inexpensive to create.
Facebook advertising costs very little, according to Snopes’ Liles. Meanwhile, people who fall victim to the scams give them hundreds or even thousands of dollars.
“If [the scammer] spent only $100, their scam has, unfortunately, been successful,” Liles told VOA.
So, how can internet users distinguish a scam from real VOA?
Besides looking for an accurate VOA URL in the web address of any supposed VOA page, users should also look for specific signs that VOA social media pages are legitimate.
“In our branding, VOA uses specific colors, and the social media accounts’ names are the same across platforms. On Facebook, Instagram and YouTube, look for the verification check mark, and follow links to other social media platforms from our website or official social media accounts,” a representative of VOA Public Relations said. “On X, not all of our accounts are verified because they require a paid subscription, so always crosscheck the link on the website or official social media accounts.”
