It’s difficult for me to comprehend why Facebook, a company with 11,000 employees, hasn’t figured out spam enforcement and an easy-to-use user interface for spam reporting yet. It’s almost as if they actively try to deter the reporting of spam.

One particular type of post that Facebook seems to struggle with spam enforcement on involves a spammer creating a fake account or compromising an existing account and posting a ‘life event’ with image(s), tagging victims with high friend counts. Anyone who follows or is friends with those victims will likely see the life event, as life events are weighted higher than regular posts for maximum visibility.

facebook-tag-spam-a1-spam-post-bruce

 

If you see a spam post that a friend is tagged in, you’re never able to actually report the spam to Facebook. After you click “Report post” and select “It’s spam”, you’re given three options:

  1. “[This] account is hacked” – If you choose this option, Facebook links you to their Help Center, which is essentially an FAQ on understanding how your account was hacked, or it gives you the option to block not the spammer’s account, but instead your friend’s account – your friend, the victim, who was tagged in the spammer’s post. You cannot report hacked accounts to Facebook, and this workflow doesn’t let you block the spammer.
  2. “It’s a spammy post” – If you choose this option, Facebook allows you to send a message to the spammer which includes the pre-filled text “You may want to take the post down before someone reports it to Facebook”, or again, you can block your friend, the victim. Also, you cannot report the spam to Facebook, and this workflow doesn’t let you block the spammer.
  3. “This is a fake account” – If you went with this option, Facebook presents you with the option to block or unfollow your friend, again, not the spammer. To be clear, the spammer – who you are not friends with and do not follow – tagged your friend in a post, and Facebook’s suggested resolution is to block or unfollow your friend. You cannot report fake Facebook accounts to Facebook, nor block the spammer here.

If you manage to reach the individual post page for the spam, which should be disconnected from your friend, Facebook suggests you block or unfollow the spammer. I wasn’t following the spammer to begin with, so I already knew something bad was going on: indeed, when you actually execute a ‘block’ or ‘unfollow’ on the spammer’s account, it actually blocks or unfollows your friend, not the spammer. Again, no option to report this kind of spam to Facebook.

If you are a user who doesn’t understand intuitively understand Facebook – perhaps aggravated by Facebook frequently changing their user interface around multiple times a year – you may inadvertently block your friend and not realize it. At Facebook’s scale – 1.5 billion monthly active users – you can be sure that people have accidentally blocked friends because Facebook suggested they do so in order to combat tagging spam. And given the prominence of Facebook today, blocking someone can mean the end of a human relationship and connection.

That’s a really big deal.

This speaks to a lack of empathy, accountability, and flawed manual and automated quality assurance processes, but it also speaks to a lack of innovation on spam enforcement. Spam enforcement might not be as lucrative or attention-getting to Facebook as, say, finding new monetization strategies or flying drones around to beam internet access down to Earth with lasers, but it’s absolutely essential to the smooth operation of a community.

Spam should be trivially easy for Facebook to detect for the purposes of filtering, moderating, or adding extra verification steps for. This specific post had plenty of data points that could have been used:

  • The post was made by a brand new account with no avatar and only 13 Facebook friends
  • The user tagged all 13 Facebook friends in a life event
  • The post included phrases only spammers would use
  • Sunglasses, prices, and percentage-off amounts could have been detected in the image
  • The post linked to a free .TK domain
  • The link redirected to another spam Facebook post, which had a link to sunglasses store with meta tags containing phrases only spammers would use
  • The post was one in a series of others, all posted at exactly 12:00am ET.

And here it’s still online because Facebook didn’t bother to implement any automated spam enforcement and because Facebook has effectively blocked any ability to report this type of spam.

____

Here are some screenshots demonstrating the above:

facebook-tag-spam-a1-spam-post-bruce

My Facebook friend Peter is an elected official with 4,200 Facebook friends, so he’s frequently the target of spam. In this case, “Bruce” – who is not my friend – tagged Peter in a Facebook ‘life event’ advertising sunglasses.

Here we go!

facebook-tag-spam-a2-report-post

Remember that Bruce is the spammer (who I am not friends with) and Peter is the victim (who I am friends with). The options presented immediately are concerning: “Hide post” seems to be training Facebook on posts you’d like to see less of, but with little transparency into what that means, I’m concerned it might indicate I want to see less legitimate life events. “Unfollow Peter” is just non-sensical, as Peter is my Facebook friend and the victim of this spam tagging incident. “Hide all from Bruce” is reasonable, as I would stop seeing Bruce’s spam, but I want to report it to Facebook so “Report post” is what I’ll go with.

facebook-tag-spam-a3-why-dont-you-want-to-see-this-its-spam

A spam post about a sales on sunglasses is all of the above – but it’s most definitely spam, so “It’s spam”.

facebook-tag-spam-a4-what-kind-of-spam-hacked

Well I don’t know Bruce so I can’t say for certain that his entire account is fake. It is a spammy post, but I’m thinking his account is probably hacked. But hey, whichever option I choose should take care of this since Facebook has surely figured this stuff out, right? So, let’s go with “Bruce’s account is hacked”.

facebook-tag-spam-a5-what-you-can-do

Wait, what? Facebook wants me to call, text, or e-mail Bruce – the spammer who I don’t know and am not friends with? And the only other option is to block my friend Peter, who is the victim in this ‘life event’ tag spam?

I guess I’ll go with “Get info to help Bruce” maybe?

facebook-tag-spam-a6-facebook-help-center

 

It’s a dead end. Facebook’s ‘Help Center’ on hacked accounts isn’t helpful for me. All I want to do is report the post to Facebook and have Facebook take care of it. So, let’s go back and try this again.

facebook-tag-spam-e1-i-dont-like-this-post

Since new posts came in, I couldn’t find the spam post in my news feed any longer. I went to my friend Peter’s wall and found the post there. No longer is “Report post” an available option – now I only get to turn on notifications on the post (which would surely just be people commenting “SPAM!”) or clicking “I don’t like this post”.

facebook-tag-spam-e2-help-us-understand-whats-happening

Yup, still spam… “It’s spam”.

facebook-tag-spam-e3-its-a-spammy-post

Alright, since “Bruce’s account is hacked” was a dead end last time, let’s go with “It’s a spammy post”.

facebook-tag-spam-e4-what-you-can-do

This time I’m given the option to send a message to Bruce, the spammer who I am not friends with. I don’t know Bruce, and I certainly don’t want to expose my identity to him – I just want to report the account and post to Facebook and let Facebook take care of it. And again, the only other option is to block Peter, my friend who is the victim of the tag spam. Unacceptable. Let’s go with “Message Bruce about this”, I guess?

facebook-tag-spam-e5-facebook-community-standards

No Facebook, I don’t feel comfortable sending this message to someone I don’t know and am not friends with, who might be a spammer and might attack my account or retaliate against me. Moreover, this isn’t the time to say “take the post down before someone reports it” – this is the time for the post to actually be reported. Facebook really hates their users.

Let’s go back and try it from the start…

facebook-tag-spam-f1-why-dont-you-want-to-see-this

This is getting really old, but yes, “It’s spam”.

facebook-tag-spam-f2-this-is-a-fake-account

Let’s try the only option left: “This is a fake account”.

facebook-tag-spam-f3-heres-what-you-can-do-about-fake-accounts

No Facebook! Bad Facebook! Bruce is the spammer who I am accusing of being a fake account, not Peter. Peter is my friend, who is the victim. Peter was tagged in Bruce‘s spammy post. Why would I unfriend or block my friend Peter because someone tagged him in a spammy post? This is absolutely terrible.

Just then, I discovered my friend Peter was tagged in another spammy post, this time by a spammer named “Broderick”.

facebook-tag-spam-d1-broderick-what-you-can-do

I went through one of the spam workflows again, and was eventually presented with a different set of options: message the spammer, block the spammer, or unfollow the spammer. I’m not following nor friends with the spammer to begin with, so that’s a bit concerning. Let’s go with “Unfollow Broderick”.

facebook-tag-spam-d2-are-you-sure

After I clicked “Unfollow Broderick”, Facebook asks “Are you sure?” with the option “Hide” or “Cancel”. Wait, I’m confused. What am I hiding? Is “hiding” the same as “unfollowing”? Probably, maybe, let’s go with it: “Hide”.

facebook-tag-spam-d3-unfollowed

Noooooo! I clicked to “Unfollow Broderick” the spammer, and Facebook instead unfollowed Peter, my friend and the victim who was tagged in the spam. Unreal.

I clicked on the timestamp on the post to reach the post on the spammer’s wall – i.e. the URL changed from facebook.com/(peter)/… to facebook.com/(bruce)/… – and Facebook’s user interface stopped suggesting I block my friend Peter, but it still offered no resolution; no way to actually report the post or account to Facebook:

facebook-tag-spam-g1-heres-what-you-can-do-about-fake-accounts

By the way, the URL that was advertised in the post – “hbods.tk” – is a free .TK domain name, which sounds like another element of data the Facebook spam filters could have acted upon. Moreover, it redirects to another spam Facebook post:

facebook-spam-h2-hbods

facebook-spam-h1-oakjoin

This post advertises the URL “oakjoin.com”, which is a spam store selling fake products. Since these products are a very frequent topic of spam, and since Facebook crawls the meta tags of every site pasted into a post, this seems like yet another data element Facebook could use in its determination that the post is spam:

facebook-spam-i1-EGIHosting

facebook-spam-i2-energy-group-networks

 

There’s no reason for Facebook to make spam reporting as challenging for users as it is. While it makes sense to ask users to try to differentiate between hacked accounts and spam posts to give Facebook’s algorithms and spam enforcement workflows a hint based on what a user might know about an account, ultimately Facebook should have known from the start that the post was spam, should have known from the start that it was a fake account or a compromised ‘hacked’ account, and there’s no reason I should have seen the post in the first place.

Photo: “Facebook HQ” by Eston Bond, CC-BY-NC-SA 2.0.