Fake Ad For Apparent Credit-Card Scam Was On Our Site

Publisher’s note: From July 16 to 22, MIT Technology Review served a fake ad that led to a fake e-commerce site, one that most likely was trying to steal credit-card information. We didn’t mean to; we were duped. We have no way of knowing whether anyone gave the site a credit card number, but we served around 10,000 impressions of the ad. We’re very sorry. We’ve learned from the experience, and have made a number of common-sense changes to make sure we aren’t scammed again.

The scam began with a beguiling e-mail. Our advertising team received an e-mail on July 11 from someone calling himself Nick Sampson, saying (falsely) that he was with an online retailer called Gilt. “I can spend as much as $100,000 per month,” he wrote.

The request struck our team as odd, in that it came directly from the would-be advertiser (in the jargon of the media business, “the client,” and not an agency), and the person was ready to close a sizable deal instantly. Nonetheless, the ad went live on July 16. Soon, another oddity emerged: we weren’t getting click information back from the ad. We suspended it. But after getting an excuse from “Nick” via e-mail, we reinstated it.

On July 22, we got a message from a reader saying that the ad was associated with a Web address listed by Sophos, the security company, as a possible malware site. Only Sophos and BitDefender had flagged the site as potentially dangerous—apparently because it was newly created, one warning sign of malicious activity. Another 31 security vendors called it a “clean site.” And six more had not rated it. (See the details here.)

Why was the site on Sophos’s list? A Sophos rep says there was no evidence the site contained actual malware, but it raised flags in part because it had recently been created. We investigated and quickly understood that our ad was directing people to a fraudulent clone of the real Gilt site. “Nick” was likely part of a scam to steal credit-card numbers.